Privacy policy | multishop21.com

Last updated: 12 November 2026

This Privacy Policy explains how 21SHOPS LTD UK processes personal data through the online store multishop21.com and its related services and subdomains. It applies to visitors, customers and people who contact us.

1. Data controller and contact details

21SHOPS LTD UK
128, City Road,
London, EC1V 2NX, UNITED KINGDOM.
Telephone: +30 6947281596
Email: info@multishop21.com

For privacy matters or to exercise your rights, email us using the subject “Personal data”. Processing is subject to applicable data protection legislation, including the UK GDPR and Data Protection Act 2018, as amended, and the EU General Data Protection Regulation (GDPR) where applicable.

2. Adults-only store — 18+

The store sells, among other goods, products intended for adults. Access, use of our services and purchases by anyone under 18 are strictly prohibited. Our services are intended exclusively for people who are at least 18 years old.

On your first visit, you are asked to confirm that you are an adult. Confirmation is stored in a cookie for 3 months in that browser. This dialog does not request a date of birth or an identity document. It is a self-declaration, not verification against official identification. Selecting “I am under 18” redirects you to Google, where that third party’s privacy policy applies.

We do not seek to collect children’s personal data. If we learn that a child has created an account or submitted personal data, we assess restriction of access and deletion of that data, unless specific legal obligations or claims require its retention. Parents or guardians can contact info@multishop21.com.

3. Personal data we process

Account and contact details: name, email address, telephone number and login information when you create an account.
Order and delivery details: products, quantities, value, order history, delivery and billing addresses, recipient details and necessary delivery instructions.
Billing and payment information: business and tax invoice details where requested, payment method, transaction reference and payment or refund status.
Communications: enquiries, messages, complaints, return requests and related correspondence.
Technical data: IP address, browser, device, access date and time, security logs and information needed for cart, login and preference functions.
Preferences and records of choices: language, adult confirmation and cookie choices.

Data comes mainly from you and your use of the store and, where necessary to handle an order, from payment or delivery providers concerning payment and delivery. If you provide another recipient’s details, please inform them and ensure you are entitled to share those details.

Some purchases may be particularly personal. Please avoid including unnecessary information about your health or sex life in order notes or messages. Processing special category data requires both a lawful basis and an applicable condition under Article 9 GDPR. Simply acknowledging this policy is not blanket or explicit consent for such processing.

4. Purposes and lawful bases

Contract performance or steps before entering a contract: purchases and account management, payment, delivery, order updates, support and returns.
Legal obligations: issuing and retaining invoices, tax and accounting requirements, consumer protection obligations and responding to lawful requests from authorities.
Legitimate interests: store security, fraud and abuse prevention, troubleshooting and establishing, exercising or defending legal claims, balanced against your rights.
Consent where required: non-essential traffic analytics technologies through Google Analytics. Withdrawal does not affect the lawfulness of processing before withdrawal.

Necessary order information must be provided so that we can complete a purchase. Without it, we may be unable to deliver goods or issue an invoice. Advertising consent is not a condition of purchase. Providing this privacy information does not mean that every processing activity relies on your consent.

5. Recipients and service providers

Necessary information may be shared with hosting and technical support providers, PrestaShop platform services used to operate the store, email providers, delivery companies, payment providers and banks, accountants, legal advisers and competent authorities, depending on the purpose and lawful basis. Store hosting is provided through Hostinger.

The payment provider and delivery service applicable to a purchase are displayed during checkout. Electronic payment providers may also provide their own privacy information. Do not send full card details or card security codes by email or through the contact form.

We use Google Analytics, a service provided by Google, to analyse website traffic. Depending on its configuration and your consent choices, it may process browser or device identifiers, technical details, page visits and usage events to help us understand how the store is used and improve its services. It is not necessary to complete a purchase. For processing by Google, see the Google Privacy Policy and information about data from sites using Google services. We do not use Meta Pixel, newsletters or other advertising services in the store.

6. Cookies and Google Analytics

The store uses storage technologies for login, cart, security and preference functions. The multishop_age_verified cookie stores adult confirmation for 3 months. It does not contain a date of birth or a copy of identification. Deleting it in your browser settings causes age confirmation to be requested again.

Session cookies expire with the session; persistent cookies expire on their expiry date or when deleted. Current expiry periods can be viewed in your browser’s storage settings. Blocking necessary cookies may affect login or ordering.

Non-essential Google Analytics cookies and similar technologies require prior consent where the law requires it. Continuing to browse or confirming that you are 18+ does not constitute consent to advertising tracking. For information about active technologies or to withdraw a related choice, contact info@multishop21.com. Deleting cookies in your browser is not a substitute for disabling an optional tracking tool.

Essential order, payment and security messages are sent to support the transaction and are separate from marketing communications. The store does not operate a newsletter service.

7. International transfers

The company is based in the United Kingdom, and some technical providers may process data in other countries. Where an international transfer mechanism is required, the relevant adequacy decision or other lawful safeguards apply, such as appropriate standard contractual clauses and, for transfers governed by the UK GDPR, the corresponding UK transfer instruments. You can request information about safeguards applying to a particular transfer.

8. Retention

We retain personal data only as long as needed for its purpose and relevant obligations. In particular:

Account information is retained as needed to manage the account, unless deletion is requested or a lawful reason requires further retention.
Accounting and tax records are retained for statutory periods: for ordinary UK company tax requirements, generally 6 years from the end of the relevant company financial year, and longer where required.
Communications, returns and disputes are retained as necessary to resolve the matter and for applicable legal claim periods.
Security logs and technical information are retained according to incident investigation needs and system functions.
Google Analytics data is retained according to the service retention setting and applicable consent choices. You can request details of the specific retention period at info@multishop21.com.

When the retention purpose ends, data is deleted or anonymised. Backup copies may remain until their scheduled replacement. Deleting an account does not delete invoices that must legally be retained.

9. Your rights

Subject to the lawful basis and applicable conditions, you have rights of access, rectification, erasure, restriction, portability and objection, as well as withdrawal of consent. You may object to processing for direct marketing at any time.

Send requests to info@multishop21.com. We may request only reasonable information needed to verify your identity. We normally respond within one month. Where the law permits an extension because of complexity or the number of requests, we will explain this to you. Certain requests may be limited by retention obligations or other people’s rights.

You can complain to the UK Information Commissioner’s Office (ICO) and, where the EU GDPR applies, to the competent supervisory authority in your place of habitual residence, work or the alleged infringement. In Greece, you can contact the Hellenic Data Protection Authority.

10. Security, automated decisions and third-party websites

The store is accessed using HTTPS. Data protection requires appropriate technical and organisational measures, restricted access and secure account management. No electronic system can guarantee absolute security. Use a strong, unique password and do not share it.

Displaying product suggestions or popular purchases does not, on its own, constitute a decision producing legal or similarly significant effects. Any processing that falls within such automated decision-making requires specific information and the safeguards required by applicable law.

Links to social networks or other third parties lead to services with their own privacy policies. This policy covers processing for which 21SHOPS LTD UK is responsible.

11. Changes to this policy

This policy may be updated when services or legal requirements change. The update date appears at the beginning. Material changes will be communicated appropriately and new consent requested where necessary.