Privacy Policy

PRIVACY POLICY

Last updated: July 30, 2026

1. Who We Are

This Privacy Policy explains how Alorta collects, uses, stores, and protects personal data.

The data controller is:

[Medicross ike]
Trading name: Alorta
Business address: [Merarxias 53], Greece
Email: info@alorta.com
VAT number: [VAT NUMBER, IF APPLICABLE]

2. Scope of This Policy

This Privacy Policy applies to:

• visitors to alorta.com;
• customers who purchase or enquire about Alorta products;
• users of Alorta’s product and social media management tools;
• users who connect a TikTok or other supported social media account to Alorta.

Third-party platforms, including TikTok, process personal data under their own privacy policies.

3. Personal Data We Collect

Depending on how you use Alorta, we may collect the following categories of personal data.

A. Information You Provide

• name;
• email address;
• telephone number;
• billing and shipping address;
• order and payment-related information;
• customer-support communications;
• product customization information;
• account and business information that you provide to us.

Payment card details may be processed directly by the relevant payment provider and may not be stored by Alorta.

B. TikTok Connection Data

When you explicitly connect a TikTok account through TikTok Login Kit, TikTok may provide Alorta with:

• the TikTok open_id associated with the Alorta application;
• display name;
• profile image or avatar URL;
• the permissions or scopes that you approved;
• access-token and refresh-token information;
• token expiry information;
• connection and verification timestamps;
• technical status information required to maintain or disconnect the connection.

For the current TikTok connection, Alorta requests only the user.info.basic permission.

Alorta does not request your TikTok password.

The current TikTok integration does not automatically publish videos, comments, messages, advertisements, or other content to TikTok.

C. Technical and Security Data

When you use Alorta, we may process:

• IP address;
• browser and device information;
• request timestamps;
• server, authentication, and security logs;
• error and diagnostic information.

4. How We Use Personal Data

We process personal data for the following purposes:

• to provide and maintain the Alorta website and services;
• to process and fulfil customer orders;
• to respond to enquiries and support requests;
• to connect, verify, maintain, and disconnect authorized social media accounts;
• to display the identity of the connected TikTok account;
• to prevent unauthorized access, fraud, abuse, and security incidents;
• to comply with tax, accounting, consumer-protection, and other legal obligations;
• to establish, exercise, or defend legal claims;
• to improve the reliability and usability of Alorta services.

We do not sell personal data.

5. Legal Bases for Processing

Depending on the activity, we rely on one or more of the following legal bases:

• Contract: processing necessary to provide a requested service, process an order, or perform a contract with you.
• Consent: processing based on your explicit authorization, including connecting a TikTok account and granting TikTok scopes.
• Legal obligation: processing required by tax, accounting, consumer-protection, or other applicable laws.
• Legitimate interests: processing necessary for service security, fraud prevention, troubleshooting, business administration, and the protection of legal rights, provided that those interests do not override your rights and freedoms.

You may withdraw consent for the TikTok connection by disconnecting the account or contacting us.

6. TikTok Authorization and Tokens

TikTok authorization takes place through TikTok’s official authorization interface.

Alorta receives an authorization code and exchanges it server-side for the tokens required to maintain the authorized connection.

Access and refresh tokens are stored securely on the server and are not intentionally exposed through the public Alorta interface or sent to the WordPress browser interface.

Tokens are used only for the purposes and permissions explicitly authorized by the user.

7. Sharing of Personal Data

We may share personal data only where reasonably necessary with:

• website, cloud-hosting, email, database, and security providers;
• payment processors;
• shipping and fulfilment providers;
• TikTok and other social media providers when you request an integration;
• professional advisers, including accountants and legal advisers;
• public authorities where disclosure is required by law.

Service providers may process personal data only for the relevant service and under applicable contractual and legal obligations.

8. International Data Transfers

Some technology or social media providers may process personal data outside Greece or the European Economic Area.

Where required, appropriate safeguards will be used, such as an applicable adequacy decision, Standard Contractual Clauses, or another legally recognized transfer mechanism.

TikTok’s own processing is also governed by TikTok’s privacy policy and applicable data-transfer arrangements.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy.

In particular:

• order, invoice, and transaction records are retained for the period required by applicable tax, accounting, and commercial laws;
• customer-support communications are retained for as long as necessary to resolve the request and protect legal rights;
• active TikTok connection data is retained while the account remains connected;
• access and refresh tokens are deleted or rendered unusable after disconnection, revocation, or expiry, subject to reasonable technical processing time;
• limited security and audit records may be retained after disconnection where necessary for fraud prevention, security, legal compliance, or dispute resolution;
• server and security logs are retained only for a limited period appropriate to security and diagnostic needs.

10. Security

We use reasonable technical and organizational measures designed to protect personal data, including access controls, server-side credential handling, encrypted storage for sensitive connection credentials, and restricted administrative access.

No internet-based service can guarantee absolute security. Users must also protect their own account credentials and devices.

11. Your Data-Protection Rights

Subject to applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of personal data;
• request restriction of processing;
• object to certain processing;
• receive applicable data in a portable format;
• withdraw consent at any time;
• lodge a complaint with a competent data-protection authority.

In Greece, complaints may be submitted to the Hellenic Data Protection Authority.

To exercise a right, contact info@alorta.com. We may request reasonable information to verify your identity before completing the request.

12. Disconnecting and Deleting TikTok Connection Data

You may disconnect TikTok through the Alorta Social Media Center where the control is available.

You may also request disconnection or deletion by emailing info@alorta.com with the subject:

TikTok Data Deletion Request

After a valid request, Alorta will remove or render unusable the stored TikTok access credentials and disconnect the TikTok account, except for limited records that must be retained for security or legal reasons.

Revoking access from TikTok’s own settings may also invalidate the Alorta connection.

13. Automated Decision-Making

Alorta does not use the basic TikTok connection data to make decisions that produce legal or similarly significant effects concerning users.

14. Children

Alorta services are not directed at children. We do not knowingly use the TikTok integration to collect personal data from children without appropriate authorization where required by law.

15. Changes to This Policy

We may update this Privacy Policy when our services, integrations, data practices, or legal obligations change.

The updated version will be published on this page with a revised “Last updated” date.

16. Contact

For privacy questions, requests, or complaints, contact:

Alorta
[Medicross Ike]
[Merarxias 53]
Greece

Email: info@alorta.com