Privacy Policy
This policy explains which personal data we keep when you book, buy or sign up with us, why we keep them, who else sees them and what your rights are.
Who We Are
The controller of your personal data is Demo Ltd (ΑΦΜ 123456789), with its seat in Demo Town, Greece, contactable at hello@demo.test.
This policy covers this website, its booking system and online shop, the newsletter, and the declarations and check-in on the day of an experience (the "Services"). The booking software is provided to us by a supplier that processes data only on our instructions, under a data processing agreement.
Data We Collect
Depending on how you use the Services, we keep:
- Identity & contact:name, email address, phone number and country.
- Bookings:the experience, date and time, number of guests and their names, notes and requests you give us, how and when you paid, and whether you checked in.
- Participant declarations:where an activity requires it, each participant's name, date of birth, answers to the safety questions, signature and the time of signing; for a minor, the parent's or guardian's name and signature.
- Passenger lists:for trips at sea, the passenger details that maritime rules require us to keep for each departure.
- Account:login email, an encrypted password and account activity.
- Payments, receipts & invoices:amounts, transaction references and the details printed on receipts and invoices, such as a company's VAT number. Card details are entered on the payment provider's page; we never see or store them.
- Gift cards:the buyer's and the recipient's names and email addresses, the message, the value and its use.
- Technical:IP address, browser and device information in server and security logs.
Allergies, health conditions or accessibility needs are health data. We keep them only when you give them to us, only to run the experience safely, and only for as long as that requires.
Why We Use Them
We process personal data only on one of these legal bases (article 6 GDPR):
To take and manage your booking or order: confirmation, ticket, changes, cancellation, refund and check-in.
To issue receipts and invoices and send them to the Greek tax authority (AADE, myDATA), to keep accounting records, and to keep passenger lists where the law requires them.
To keep the Services secure and prevent fraud and abuse, to answer your questions, and to improve our experiences.
For the newsletter, for maps from Google, and for health data you choose to give us (article 9(2)(a) GDPR). You may withdraw consent at any time, without affecting what was done before.
Cookies
This site sets only the cookies it needs to work, so it does not ask for cookie consent when you arrive. It sets no analytics or advertising cookies.
- Strictly necessary: keeping you signed in, holding your basket and booking while you pay, and remembering choices such as your language.
- Security: the sign-in, sign-up and password pages use Google reCAPTCHA to stop automated abuse, which sets Google's own cookies on those pages.
- Payment: the payment provider's page sets its own cookies for fraud prevention when you pay.
- Maps: a Google map of a meeting point loads only when you choose "Show map"; Google then sets its own cookies. The choice is remembered on your device.
You can delete cookies at any time in your browser settings.
Who Sees Your Data
We do not sell or rent personal data. We share it only with:
- Our providers, acting on our instructions: database and website hosting, the payment provider shown at checkout, email delivery, error monitoring and the booking software supplier.
- Marketplaces: if you book through a marketplace such as GetYourGuide or Viator, it sends us your booking, and its own privacy policy applies to it.
- Our accountant and advisers: for tax and legal compliance.
- Authorities: the tax authority, port authorities or others where the law requires.
Transfers Outside the EU
Our database is hosted in the EU. Some providers (website hosting, email, error monitoring, reCAPTCHA) are US companies; transfers to them rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.
How Long We Keep Them
- Bookings, receipts and invoices: for as long as Greek tax law requires, usually five years after the end of the tax year.
- Participant declarations: until claims about the activity can no longer be made.
- Passenger lists: for the period the maritime rules set.
- Account: until you delete it or ask us to.
- Newsletter: until you unsubscribe.
After that, data are deleted or anonymised.
Security
Each business on this booking software has its own separate database. Access is limited to the staff who need it, every change to a booking or a payment is recorded, and data are encrypted in transit and backed up daily. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
Your Rights
You may ask for access to your data, correction, deletion, restriction or a copy in a portable format, and you may object to processing based on legitimate interests. Write to us; we answer within a month. Data the law requires us to keep, such as receipts, cannot be deleted before the end of that period.
You may also complain to the Hellenic Data Protection Authority (www.dpa.gr) or the authority of the country where you live.
Children
Bookings and accounts are for adults. A minor's details are given by the adult who books for them, and a minor's declaration is signed by a parent or guardian.
Changes to This Policy
We update this policy when what we do with data changes, and change the date at the top of the page.