Skip to content
My Crete Holiday
EN
My Crete Holiday
My account+30 28210 07442

Privacy policy

How we process your personal data when you visit the site, request a quote, book an excursion or subscribe to the newsletter.

Draft: This text must be reviewed by a legal adviser before publication.

1. Data controller

The data controller is My Crete Holiday Tour Operator, El. Venizelou 79, Kounoupidiana, 73100 Chania, Crete, Greece, VAT EL800920691, EOT licence 104E60000256301.

For any privacy question write to info@mycreteholiday.com or call +30 28210 07442.

2. What data we collect

  • Contact details: first and last name, email, phone.
  • Trip details: dates, number of people, preferences and requests entered in our forms.
  • Excursion participants’ details: name, date of birth, document type and number, required for the passenger list requested by the excursion operator.
  • Account data: login credentials (the password is stored encrypted) and preferences.
  • Payment data: handled by Stripe; we only receive the payment outcome and basic transaction references, never your full card number.
  • Technical browsing data: IP address, browser type, pages visited, collected by our servers and, only with your consent, by analytics tools.

3. Why we process it and on what legal basis

  • Answering quote and information requests: pre-contractual steps you asked for (Art. 6(1)(b) GDPR).
  • Managing bookings, payments, cancellations and refunds, and informing you of schedule changes or weather suspensions: performance of the contract (Art. 6(1)(b)).
  • Meeting tax, accounting and tourism-sector obligations: legal obligation (Art. 6(1)(c)).
  • Sending the newsletter and offers: consent, which you can withdraw at any time (Art. 6(1)(a)).
  • Protecting the site from abuse and fraud: legitimate interest (Art. 6(1)(f)).

4. Online payments

Card payments take place on the secure page of Stripe Payments Europe Ltd., which acts as an independent controller of payment data under its own privacy policy. Stripe complies with PCI DSS security standards.

5. Who we share data with

  • Providers of the services you book (accommodation, car hire companies, boat operators, guides), only with the data needed to deliver the service.
  • Technical providers that help us run the website, booking system, email and file storage, appointed as data processors.
  • Public authorities, when required by law.

Some technical providers may process data outside the European Economic Area: in such cases we rely on the safeguards provided by the GDPR, such as standard contractual clauses.

6. How long we keep it

We keep booking data for the period required by tax and accounting law, quote requests not followed by a booking for [period to be defined], newsletter data until you withdraw consent and account data until the account is deleted.

7. Your rights

You can ask at any time to access, correct or delete your data, restrict processing, object to processing based on legitimate interest and receive your data in a portable format. You can unsubscribe from the newsletter via the link in every email or from your profile.

You can also lodge a complaint with the Hellenic Data Protection Authority or with the authority of the country where you live.

8. How to contact us

Write to info@mycreteholiday.com with your request: we will reply within the time limits set by the GDPR.

Last updated: [publication date].