Privacy policy
What we collect, why, and how to make us delete it.
These terms are being finalised with the agency's legal advisers. What follows sets out how the office currently works and is published for information, not as final wording. For the terms that apply to a particular booking, ask the office and we will confirm them in writing before you pay.
Controller
The travel agency described on the about page is the data controller. Contact details are on the contact page; the registered legal entity is Charitos Travel, VAT (ΑΦΜ) 094103941, Γ.Ε.ΜΗ. 034527033000.
What we collect, and why
- Booking details: name, email, telephone, travel date, flight number, party size. We need these to perform the contract you asked for. Without them we cannot put a car on the road.
- Payment record: selected method, amount, currency, provider reference and status. Card details are entered on hosted Stripe or Viva.com pages; we do not receive or store the full card number or security code.
- Enquiry details: name, email, telephone, message. Collected on your consent, which you give explicitly on the form and may withdraw at any time.
- Technical data: IP address, browser type and pages visited, collected only if you accept analytics cookies. Declining costs you nothing on this site.
What we do not do
We do not sell personal data. We do not share it with advertising networks. We do not build profiles of visitors.
Who else sees it
- The driver assigned to your journey sees your name, pick-up point, time and party size, and nothing else.
- The selected payment provider sees the booking, contact and transaction data needed to process, verify and, where applicable, refund the payment.
- Our email provider and our hosting provider process data on our instructions.
- Greek tax law requires us to keep invoicing records, and that obligation outlives your booking.
How long we keep it
Booking records are kept for the period Greek accounting law requires. Enquiries that do not become bookings are deleted after two years. Analytics data is retained for fourteen months.
Your rights
You may ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing, or ask for it in a portable format. The GDPR requests page has the form. We answer within one month.
You may also complain to the Hellenic Data Protection Authority.
Transfers outside the EEA
Where a processor operates outside the European Economic Area, the transfer is covered by the European Commission's standard contractual clauses. The current list of processors is available on request and will be published here once finalised.
This page was last generated on 26 September 2026.