GDPR

Privacy Policy

1. Preamble

The company under the name “EVERGOOD Single-Member S.A.”, with the distinctive title “EVEREST”, having its registered office at Spata, Attica, Athens International Airport “EL. VENIZELOS”, Building 14B, Postal Code 19019 (hereinafter the “Company”), acting as the Data Controller, is subject to all obligations and commitments arising from data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (hereinafter the “GDPR”) and Law 4624/2019 (hereinafter the “Data Protection Legislation”).

For the Company, respect for and protection of your personal data is an absolute commitment. We understand and take seriously the fact that you are aware of and interested in your personal data.

This Privacy Policy describes the personal data that the Company collects and processes in the context of the operation of the website www.everest.gr (hereinafter the “Website”), the mobile application everest app (hereinafter the “Application”), and the loyalty program everest Bite Club (hereinafter the “Program”), the manner in which we use and protect them, the legal bases for processing, as well as the rights and choices you possess. Its purpose is to inform you about the company's policy regarding the personal data you provide to us, so that you know the purpose of our processing, the category of recipients, and the procedures you can follow to exercise your legal rights.

Recognizing its ongoing responsibility to protect your personal data, and acting as a Data Controller in their lawful processing, the Company has implemented all technical and organizational measures based in particular on the principles of proportionality, purpose limitation, processing duration limitation, and data minimization, exclusively for the purpose for which the data were collected and strictly for the duration of the respective processing purpose, ensuring that your personal data remain completely secure.

We recognize that data protection is an ongoing responsibility and, consequently, we will update and modify this Policy from time to time to ensure it remains fully compliant with the law. Please visit our website www.everest.gr periodically to ensure that you are informed of and satisfied with any changes. If you have any doubts regarding any term of this privacy policy, you can contact us via e-mail at contact-us@everest.gr.

We would also like to assure you that the Company does not process personal data concerning minors under the age of 18.

The Company has appointed Mr. Emmanouil Laskaridis as the Data Protection Officer (DPO), with contact email: dpo@evergood.group.

2. Basic Principles of Processing

The processing of personal data is carried out in accordance with the data protection principles set out in Article 5 of the GDPR. All policies and procedures have been designed to ensure compliance with these principles:

• Personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject (lawfulness, fairness, and transparency).
• Personal data shall be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes (purpose limitation).
• Personal data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (data minimization).
• Every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (accuracy).
• Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (storage limitation).
• Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures (integrity and confidentiality).
• The controller shall be responsible for, and be able to demonstrate compliance with, the fundamental processing principles (accountability).

3. Who We Are

EVEREST operates in the mass catering market and is one of the largest restaurant chains in Greece. EVEREST provides its services to consumers through its store network operating under the franchise system, via its website www.everest.gr, through the mobile application everest app, etc.

4. What Personal Data We Collect About You

Please note that providing your personal data is under no circumstances mandatory. This means that you voluntarily provide us each time with those personal data that are minimally necessary for the correct and effective provision by EVEREST of the service you wish to receive from it, primarily concerning the execution of your orders regarding our products. It is clarified that the non-provision for any reason of those personal data characterized as "non-mandatory" can under no circumstances lead to EVEREST's refusal to provide the respective service you wish to receive, which is associated with said non-mandatory personal data.

Customers who create a user account via the Website will be referred to for brevity as “Users”. However, only customers who wish to use the Website (not the Application) without creating a user account are provided with the option to use it simply as visitors (hereinafter the “Guests”).

More specifically, for the use of the Website, the Application, and the loyalty and rewards program “EVEREST Bite Club”, the following personal data are collected:

• a. Full Name: The full name of Users is collected necessarily for the creation and management of the user account, for full access to the services provided via the Website and/or the Application, and in particular for the execution of the order requested through them (preparatory work up to delivery) of the products from EVEREST's price catalog, for the identification of Users should they also wish to participate in the Program, and for registering customers in the Program via tablets located in participating stores of the network. The full name of Guests is collected exclusively and solely for the execution of the order requested via the Website (preparatory work up to delivery) of the products from EVEREST's price catalog.
• b. Mobile Phone Number: EVEREST collects the mobile phone number of Users after they choose to log in to the Website or Application to create an account, to enable the use of the mobile phone number as a "username" for logging into the account, for the identification of Users should they also wish to participate in the Program, to enable customers to be verified solely by this element by a participating store cashier as to whether they are Program members or not, to enable registration in the Program via tablets in participating network stores, to enable customers to register in the Program via SMS, as well as to receive news, offers, and promotional content via SMS (and Viber) for direct marketing and/or promotional purposes for Users upon their consent, and for Program participants for the purpose of effectively implementing the Program through the provision of benefits, etc. Guests share their mobile phone number with EVEREST exclusively and solely for the execution of their order (preparatory work up to delivery) of products from EVEREST's price catalog via the Website.
• c. Landline Phone Number: The landline phone number of Users or Guests is collected optionally in case they wish to place an online order with the aim of facilitating the execution and delivery of the requested order (preparatory work up to delivery) of products from EVEREST's price catalog.
• d. Email Address: EVEREST collects the email address of Users after they choose to log in to the Website or Application to create an account, to enable the use of email as a "username" for logging into the account, for the identification of Users should they also wish to participate in the Program, to enable registration in the Program via tablets in participating network stores, as well as to receive news, offers, and promotional content via email for direct marketing and/or promotional purposes for Users upon their consent, and for Program participants for the purpose of effectively implementing the Program through the provision of benefits, etc. The email address of Website Guests is collected exclusively and solely for sending the proof of the order requested through it.
• e. Postal Address: The postal address and its designation as home, work, etc., are collected mandatorily from Users and Guests in case they wish to use the delivery service, with the aim of facilitating the execution of the order (preparatory work up to delivery) of products from EVEREST's price catalog. Optionally, details such as postal code, floor, a specific doorbell indication, etc., can be provided.
• f. Credit or Debit Card Information: EVEREST mandatorily collects data and information concerning the credit or debit cards of Users and Guests in case they choose to prepay (i.e., prior to order delivery via the Website or Application) the transaction price using their credit or debit card, or to pay upon order delivery using their credit or debit card. Card details will be requested upon completion of the order if they choose the relevant payment method and will be used exclusively for electronic transmission through the secure environment of Viva Wallet solely to complete their payment. EVEREST does not store any credit/debit card details in its electronic systems or physical archives. To authenticate the cardholder, it may be necessary to transfer card details of the User to a third-party provider cooperating with Viva Wallet, which implements the card payment completion process.
• g. Billing Details: Billing details such as Tax Identification Number (TIN/AFM) and Tax Office (DOY) are collected for the issuance of an invoice as a legal tax document, if requested during the order.
• h. Order History Information: Information concerning recent purchases made by Users via the Website is collected with the aim of facilitating them in selecting future orders.
• i. Facebook ID, Gmail: To log in to the ordering service via the Website, the User may choose to use the account they maintain on Facebook or their Gmail account. A necessary element we receive from the social media platform is the User's email address.
• j. Personalized Communication - Preferences (“profiling”): Wishing to provide those who voluntarily participate in the Program with the most effective implementation of the Program, their collected personal data may be used to analyze their profile and categorize them into respective customer groups (custom audiences), with the aim of sending them personalized updates according to their preferences.

For the www.everest.gr service, we collect the names (first name, last name), contact phone number, and email address of our customers to answer and manage their requests in case of communication via the website's special form. If a customer voluntarily transmits additional personal data via the message they send, these will be retained for the better and prompt handling of their request. The Company does not use email contents, chats, or other personal files for advertising targeting.

We do not process sensitive personal data within the framework of the services and content of our website.

Our company does not process personal data knowingly concerning minors under 18 years of age. If the company is notified of the provision of personal data of an individual under 18 without the consent of a parent or person exercising parental responsibility, the company will take appropriate measures to delete such data from its databases and refrain from using them.

5. How We Collect Your Personal Data

Your personal data are collected when you express interest in our services, when you make purchases from EVEREST's online services or our stores, and when we provide you with our services via the Website, the Application, and the Program.

6. Method of Processing Data (Article 4(2) GDPR)

The processing of your personal data includes operations such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission to authorized persons/partners, restriction, erasure, or destruction, as defined in Article 4(2) of the GDPR. Processing is carried out primarily by automated (electronic) means and supplementarily by non-automated (paper) means, always with the application of strict security procedures.

7. Who Else is a Recipient of Your Personal Data?

The company does not transfer, disclose, or assign your personal data in any way to third-party companies or external providers, with the exception of specialized partners who support the operation of our website and services, acting as Data Processors on our behalf and bound by the foreseen confidentiality and data protection agreements (DPAs).

The processing of your personal data is carried out primarily internally by the Company and specifically by our authorized personnel, who are bound by strict confidentiality and secrecy obligations, exclusively and only to the extent necessary for managing and answering your requests and for handling your reservations. Access by unauthorized persons, including non-competent employees, is strictly prohibited.

At the same time, the technical implementation, maintenance, and management of the website and application are supported by the company ATCOM, and the “EVEREST Bite Club” Program by the company POBUCA, which may have access to data within the scope of technical support and security duties as Data Processors on behalf of the Company.

The electronic payment service for your orders is provided through an integrated interface with the Viva Wallet platform, which operates as a licensed electronic money/payment institution for the secure processing and clearing of transactions, meeting the specifications required by the PCI-DSS standard for payment card data security. At the same time, during electronic card payments, Strong Customer Authentication (SCA) is applied under protocol 3-D secure, in compliance with European Directive 2015/2366 (PSD2) and requirements for strong customer authentication. Within this framework, upon order completion, sensitive payment personal data (such as card number, expiration date, and CVV/CVC code) are entered directly into the secure and encrypted environment of Viva Wallet. Our Company does not collect, record, or store your full card details under any circumstances. For more information regarding how Viva Wallet processes your personal and financial data, you can refer to Viva Wallet's Privacy Policy at the following link: https://www.viva.com/el-gr/privacy-policy

In any case, our Company will not sell, transfer, or publicize personal details of website visitors/users to third parties, except for the application of relevant legal requirements, where access may also be gained by:

• Lawyers, judicial bailiffs, or other persons necessary for the judicial or out-of-court handling of the company's claims.
• Public services, administrative and judicial authorities, supervisory and regulatory authorities if required by law, court order, or any other act binding on the company, in the context of compliance with general obligations under legislation.
• External partners of EVEREST providing accounting or legal services, general consulting services, IT, IT support, technical safety/occupational doctor services, etc.
• External partners of EVEREST providing research and/or advertising services, provided you have given your consent.

8. Why We Use Your Data & Legal Bases for Processing

The Company collects, retains, and processes only the personal data that are minimal and absolutely necessary for the following purposes and on the basis of the following legal bases of Article 6(1) of the GDPR:

1. Creation and management of a user account, full access to services, and execution of online orders

• Purpose: Full access to services provided via the Website and/or Application, creation and management of a user account, as well as the execution of orders for products from EVEREST's price catalog (via website, application, or social media), i.e., the provision of our products and services to you.
• Legal Basis:
• Article 6(1)(b) GDPR: Conclusion and execution of the sales contract and product delivery, or — upon your explicit request — taking preparatory steps / measures at the request of the data subject prior to entering into a contract.
• subsidiarily Article 6(1)(f) GDPR: Legitimate interest of the Company to facilitate the user in future orders and ensure the smooth operation of the platform.

2. Payment and financial management of transactions

• Purpose: Processing of payments and financial management of your transactions.
• Legal Basis:
• Article 6(1)(b) GDPR: Contract execution and processing of order payments.
• Article 6(1)(c) GDPR: Compliance with a legal obligation of the Company based on tax legislation and e-commerce legislation regarding the issuance and retention of accounting documents.

3. Direct Marketing, promotional activities, and Program implementation

• Purpose: Sending informative and promotional material and participating in promotional activities (such as participation in contests, periodic emails to those who have consented to receive news and offers via SMS, Viber, or email), as well as the implementation of the Program so that participants are informed of the benefits they can receive.
• Note: In every informative email, the recipient is given the option to state that they do not wish to receive such emails anymore (newsletters), either via a relevant unsubscribe link, or by sending a request to contact-us@everest.gr, or by changing the relevant setting in their account.
• Legal Basis:
• Article 6(1)(a) GDPR: Explicit consent of the user.

4. Profiling, statistical analysis, and personalized offers

• Purpose: Profiling of Program participants for its effective implementation, as well as statistical analysis aimed at creating and providing personalized offers and tailored communication.
• Legal Basis:
• Article 6(1)(a) GDPR: (Where explicit consent for profiling is required) / Article 6(1)(f) GDPR: (Legitimate interest of the Company for commercial development and optimization of its services, where applicable).

5. Management, service, and response to communication requests

• Purpose: Managing, servicing, and effectively responding to communication requests you submit.
• Legal Basis:
• Article 6(1)(b) GDPR: Taking measures at the user's request prior to entering into a contract or in the context of customer service.
• subsidiarily Article 6(1)(f) GDPR: Legitimate interest of the Company for effective communication and excellent customer service.

6. Compliance with other legal obligations

• Purpose: EVEREST's compliance with obligations imposed by the applicable legislative and regulatory framework, including data protection legislation (GDPR / Data Protection Legislation).
• Legal Basis:
• Article 6(1)(c) GDPR: Compliance with obligations imposed by law.

7. Establishment, exercise, or defense of legal claims

• Purpose: Protection of the Company's rights and its defense against potential judicial or extrajudicial claims.
• Legal Basis:
• Article 6(1)(f) GDPR: Legitimate interest of the Company for safeguarding and supporting its legal claims.

9. How Long Do We Retain Your Personal Data?

When processing is imposed as an obligation by legal provisions, your personal data are retained for as long as required by the relevant provisions.

For the purpose of executing its product orders, EVEREST will retain your personal data for the period deemed absolutely necessary for fulfilling this exact purpose, for the fullest satisfaction of customer requests regarding the respective order, and for establishing, exercising, and/or supporting legal claims based thereon.

We will also retain account data created on the Website and/or Application for as long as you maintain it and have not requested its deletion. Where required for compliance with legal or regulatory requirements, dispute resolution, fraud and abuse prevention, or enforcement of website access terms and conditions, we may retain your data for a longer period.

For promotional/marketing activities, your personal data are retained until you withdraw your consent. You can exercise this right at any time. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal. In any case, if two years elapse from your consent and you have not made use of EVEREST's services during that period, your personal data will be automatically deleted.

For the safeguarding of its legitimate interests, EVEREST will retain only the mobile phone number of Users who registered but deleted their account for a period of one (1) month, in order to identify them in case they intentionally create a new account to receive new user benefits again.

Order History information is retained for a period of two (2) months, to facilitate the user in placing new orders.

Guest data will be retained for a period of two (2) months, exclusively and solely for the purpose of executing the order requested via the Website (preparatory work up to delivery) of products from EVEREST's price catalog.

In the event that any legal claim by a User or Guest arises against EVEREST, their data will be retained until the relevant claim is irrevocably settled.

10. Guarantees We Take for the Protection of Your Data

When you provide us with your personal data, we take steps to ensure they are kept and managed securely. To protect your personal data, we implement adequate physical, technical, and organizational protection measures. We continuously update and review the security technology we use. We restrict access to your personal data only to those employees who need to know such data to provide you with the requested services. Additionally, we train all employees regarding the importance of confidentiality, privacy preservation, and the security of your personal data.

Among other things, we have implemented the following technical and organizational measures and procedures to protect your personal data from any loss, alteration, unlawful processing, or modification:

• Access to your personal data is restricted only to the number of authorized persons for specific purposes.
• IT systems used for data processing ensure access only by authorized individuals.
• Access to said IT systems is monitored to immediately detect and prevent unauthorized access.
• Use of IT systems and computer programs installed in a way that minimizes the use of personal data and/or user identification data.
• Adoption of individual data retention procedures and secure deletion/destruction processes.

11. Your Rights

As a data subject, you possess the following rights under the terms and specific provisions of the GDPR:

• Right of access (Article 15 GDPR): You have the right to be informed whether we process your personal data and, if so, to access your personal data being processed, as well as information concerning their processing. Under this right, you are entitled to request from the Company a free copy of your personal data undergoing processing. If requests are repetitive and manifestly unfounded, the Company reserves the right to charge a reasonable fee.
• Right to rectification (Article 16 GDPR): You have the right to request the correction of any inaccurate data or the completion of incomplete data.
• Right to erasure (“right to be forgotten”) (Article 17 GDPR): You have the right to request the deletion of data without undue delay upon your relevant request under the conditions stipulated by applicable Greek and European Data Protection Legislation. In certain cases (such as when there is a legal obligation to process personal data mandated by law, or public interest), this right is subject to specific limitations or does not apply.
• Right to restriction of processing (Article 18 GDPR): You have the right to request the restriction of processing, meaning the suspension or limitation thereof, when you contest the accuracy of the data, object to their processing, or another reason provided by applicable Greek or European Data Protection Legislation applies.
• Right to data portability (Article 20 GDPR): You have the right to receive the data you have provided to us with your consent in a structured, commonly used format, to use them elsewhere.
• Right to object (Article 21 GDPR): You have the right to object at any time to the processing of your data based on legitimate interest (Article 6(1)(f) GDPR). In this case, we will cease processing unless we demonstrate compelling and legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent (Article 7(3) GDPR): In cases where we process your personal data based on your consent, you also have the right at any time to withdraw your consent or change the degree of consent granted, without affecting the lawfulness of processing based on consent prior to its withdrawal.
• Right to lodge a complaint with the Hellenic Data Protection Authority (HDPA / APDPH) (Article 77 GDPR): You have the right to lodge a complaint with the competent supervisory authority if you believe your rights are violated (see details below in Section 14 [Note: Refers to general supervisory authority framework]).

In case you exercise any of your above rights, the Company will respond within one month, unless your request is particularly complex or there is a multitude of similar requests.

12. Transfer of Personal Data Outside the EU

Personal data collected via the website everest.gr, the Application, and the “EVEREST Bite Club” Program are stored on servers within the European Union (EU) / European Economic Area (EEA) and are neither transferred nor processed in third countries outside the EU.

13. Links to Other Websites

Our website may contain links to other websites. This privacy policy applies only to data provided via the www.everest.gr website and the Application. Therefore, whenever you follow a link from this website to another, we recommend that you carefully read the privacy policies of the respective website. In the event that you choose to connect to any third-party website via special links (links, hyperlinks, banners) contained on our website, the Company bears no responsibility for the terms of management and protection of personal data applied by such third parties.

13. Use of Cookies

We use cookies (small text files stored on your device during your navigation) for the technical operation of the website, the facilitation of your browsing, and the collection of anonymous usage statistics.

For more detailed information regarding the types of cookies used, their management, and how to disable them, please refer to the dedicated Cookies Policy of our website at: https://www.everest.gr/cookies/

In the event that through our website you enter third-party websites or connect with social media platforms (Twitter, Facebook, YouTube), you should be aware that these third-party websites or entities may install cookies as soon as you click the relevant link, which are outside our control and are therefore governed by the respective separate cookies policy of each entity installing them.

14. How to Contact Us

You can contact us for any question regarding the processing of your personal data or our use of cookies, or to exercise your rights, by using the online contact form on our website.

Please visit the company's website at regular intervals to stay informed of any changes to this policy.

If you wish to submit any query regarding the terms of this Statement, please address it either via email to contact-us@everest.gr or by phone at +30 2169392900.

In the event that the company does not appropriately satisfy a request of yours without adequately justifying its refusal, or generally violates its obligations under the Data Protection Legislation, you are entitled to submit a Complaint or other grievance to the Hellenic Data Protection Authority (HDPA) (www.dpa.gr), telephone: +30 2106475600, fax: +30 2106475628, email: contact@dpa.gr.

You can contact the Data Protection Officer by sending an email to dpo@evergood.group.

15. Version Information – Changes and Updates

This Statement was last updated on October 7, 2026.

We reserve the right to modify and update this Statement, either in whole or in part, at our absolute discretion at any time. Any modification hereto shall take effect immediately upon the posting of the modified Statement on the Website. At the same time, an indication will appear on our homepage highlighting the change. In any case, if you continue to use the Website and its services after modifications have been made as above, you will be deemed to accept these modifications. If you do not agree with the terms of this Statement as it may be modified, either in whole or in part, you must cease using the Website.

Any change to this Statement will be posted here immediately.