PRIVACY POLICY

Last updated: 28 September 2026

1. Who we are

This website, https://eloundaweb.gr (the "Website"), is operated by George Sfyrakis, based in Elounda, Crete, Greece ("Eloundaweb", "we", "us"). We are the data controller for the personal data described in this policy.

We process personal data in line with the EU General Data Protection Regulation (GDPR, Regulation 2016/679), Greek Law 4624/2019 and Greek Law 3471/2006 (electronic communications).

2. What data we collect

Data you give us. When you message us via WhatsApp, phone, email or a contact form, or ask us to arrange a boat trip, safari, restaurant reservation, private chef, massage or other experience, we may collect: your name, phone number, email address, the content of your messages, travel dates, accommodation area, group size and ages, and special requirements (for example dietary needs, mobility needs or health-related information you choose to share).

Data collected automatically. When you visit the Website, our server and the tools we use may collect your IP address, browser type, device type, operating system, pages visited, referring page, and date and time of visit. Some of this is collected through cookies (see our Cookie Policy).

Social media. If you contact us or interact with us through Facebook or another platform, we receive the information you make available to us there.

We do not knowingly collect special categories of personal data unless you volunteer them (for example a health condition relevant to a boat trip). We use such information only to arrange your request safely, and only with your consent.

3. Why we use your data and on what legal basis

Purpose Legal basis
Replying to your enquiries and messages Steps at your request before entering a contract, or our legitimate interest in answering questions (Art. 6(1)(b), (f) GDPR)
Arranging and confirming experiences and services you ask for Performance of a contract or pre-contractual steps (Art. 6(1)(b))
Passing your details to the operators or partners who deliver the service Performance of a contract (Art. 6(1)(b))
Handling health or accessibility information you share Your explicit consent (Art. 9(2)(a))
Keeping accounting and tax records Legal obligation (Art. 6(1)(c))
Securing and improving the Website, preventing abuse Legitimate interest (Art. 6(1)(f))
Analytics and marketing cookies Your consent (Art. 6(1)(a); Law 3471/2006, Art. 4)

4. Who we share data with

We do not sell your personal data. We share it only where needed:

  • Service providers and partners who deliver what you request, such as boat operators, safari and tour organisers, restaurants, private chefs and wellness providers. We share only what they need to fulfil your request (for example name, contact number, date and group size).
  • Website and technology providers: hosting, WordPress plugins and related services, and communication tools such as WhatsApp (Meta). If you click the chat button, you leave the Website and your messages are handled by WhatsApp under its own privacy policy.
  • Booking platforms. Some links on the Website lead to third-party platforms (for example GetYourGuide). If you book there, the platform is responsible for your booking data under its own privacy policy, not us.
  • Professional advisers (accountant, legal adviser) and public authorities where the law requires it.

5. Transfers outside the EEA

Some providers (for example Meta or Google) may process data outside the European Economic Area. Where that happens, we rely on safeguards such as the EU-US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.

6. How long we keep data

  • Enquiries and messages: up to 24 months after our last contact, unless a booking or dispute requires longer.
  • Booking and accounting records: for the period required by Greek tax and accounting law.
  • Consent-based data (for example newsletter): until you withdraw consent.
  • Cookies: see the Cookie Policy.

7. Your rights

You have the right to access your data, correct it, request erasure, restrict or object to processing, receive your data in a portable format, and withdraw consent at any time (withdrawal does not affect processing done before). To exercise any right, email info@actionweb.gr. We will respond within one day.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr, 1-3 Kifissias Ave., 115 23 Athens, Greece).

8. Security

We use reasonable technical and organisational measures to protect your data, including access controls and HTTPS. No online transmission is completely secure, so we cannot guarantee absolute security.

9. Children

The Website is not directed at children under 15, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. The current version is always on this page, with the "Last updated" date above.

11. Contact

Questions about this policy: info@actionweb.gr.