Last updated: 26 October 2026
This Privacy Policy explains how Aethra Travel collects, uses and protects your personal data when you visit www.aethratravel.gr (the “website”), contact us or send us a trip brief. We process personal data in line with the EU General Data Protection Regulation 2016/679 (“GDPR”), Greek Law 4624/2019 and Greek Law 3471/2006 on electronic communications.
1. Who we are (data controller)
The controller of your personal data is:
AETHRA TRAVEL ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε., a single-member private company (Μονοπρόσωπη Ι.Κ.Ε.), trading as Aethra Travel Agency
- Registered office: Persefonis 49, Gazi, 118 54 Athens, Greece
- General Commercial Registry (G.E.MI.) no.: 181010801000
- VAT no. (ΑΦΜ): 802690803
- GNTO registration no. (ΜΗΤΕ): 0206E60001006701
- Email: contact@aethratravel.gr
- Phone: +30 210 3247 011
For any question about your personal data or to exercise your rights, contact us at contact@aethratravel.gr or by post at the address above, marked “Data protection”. We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR.
2. What personal data we collect and why
2.1 Contact form
When you use the form on our Contact page, we collect:
- full name (optional);
- email address (required);
- phone number (optional);
- your message (“How can we help?”);
- your confirmation that you have read this Privacy Policy, with the date and time.
Purpose: to answer your enquiry and, if you ask, to prepare an offer.
Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) when your enquiry concerns our services; otherwise our legitimate interest in answering messages sent to us (Article 6(1)(f) GDPR).
2.2 Trip brief form (“Brief submission”)
When you send us a trip brief, we collect:
- Step 1, “What you need”: type of travel (business or pleasure), number of travelers (1–8 or 9 or more), departure date, return date, departure city, destination and accommodation preferences;
- Step 2, “About you”: full name, company (optional), email address, phone number, comments (optional), and your confirmation that you have read this Privacy Policy, with the date and time.
Purpose: to understand your travel needs, prepare tailored proposals, contact you about them and, if you accept a proposal, organize your trip.
Legal basis: steps taken at your request before entering into a contract, and performance of the contract (Article 6(1)(b) GDPR).
Please do not include sensitive information (for example health details or passport numbers) in the free-text fields. If a trip needs such information, for example for special assistance, we will ask for it separately and explain how we will use it.
2.3 How form submissions are stored and sent
Each submission is:
- stored in our website’s database (WordPress), in an area that only our authorized staff can access. Together with the form fields we store the form type, the date and time of submission and of your confirmation, a one-way encrypted (hashed) version of your IP address and your browser’s user agent. We keep these technical details to prove when the confirmation was given and to protect the forms against abuse;
- emailed through our email service provider, Hostinger International Ltd (Cyprus), to our mailbox contact@aethratravel.gr, so our team can reply.
Legal basis for the technical details: our legitimate interest in keeping records of the confirmation and in securing our website (Article 6(1)(f) GDPR).
2.4 Protection against spam
To protect our forms against automated spam we use:
- invisible checks on our own server (a hidden field, a minimum time to fill in the form and a limit on the number of submissions per IP address within a short period; the IP address is used only temporarily for this limit);
- Cloudflare Turnstile, a service of Cloudflare, Inc. that checks whether a form is being filled in by a person rather than a bot. Turnstile processes technical data from your browser and device, such as your IP address, browser characteristics and interaction signals, and does not ask you to solve puzzles in most cases. See Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/.
Legal basis: our legitimate interest in keeping our website and mailbox secure and free of spam (Article 6(1)(f) GDPR). Turnstile is strictly necessary for the security of the form and runs only on pages that contain a form.
2.5 Website hosting and server logs
Our website is hosted by Hostinger International Ltd (Cyprus), on servers located in the European Union. When you visit the website, the server automatically records technical data in log files: your IP address, the date and time of the request, the page requested, the referring page, and your browser and operating system.
Purpose: to deliver the website, keep it secure and investigate errors or attacks.
Legal basis: our legitimate interest in operating a secure website (Article 6(1)(f) GDPR).
2.6 Cookies, analytics and our cookie consent tool
We use our cookie consent tool (ZeroComplexity) to ask for and record your cookie choices. The tool is provided by ZeroComplexity, a sole proprietorship based in Athens 173 43, Greece (VAT no. 154957212), which acts as our processor. It stores your choices in the first-party cookie zc_consent on your device for 6 months (182 days), so we do not ask again on every page. As proof of consent, ZeroComplexity keeps a record of your choice on our behalf (a random consent ID, your choices, the policy version and the time, without your IP address) on Cloudflare infrastructure in the EU for 25 months. See ZeroComplexity’s privacy policy: https://zerocomplexity.io/en/privacy-policy/.
We use Google Tag Manager (a tag management tool) and Google Analytics 4 (website statistics), services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us understand how visitors use the website, for example which pages are visited, how visitors arrive and on what kind of device, so we can improve it. IP addresses are not logged or stored by Google Analytics 4.
We use Google Consent Mode v2. By default, analytics and advertising storage are set to “denied”. Google Analytics cookies are set only after you accept the Statistics category in our cookie consent tool. If you have not consented, Google tags may send cookieless signals without identifiers, which Google uses to model aggregate statistics.
Legal basis: your consent (Article 6(1)(a) GDPR and Article 4(5) of Law 3471/2006). You can withdraw your consent at any time through the “Cookie settings” link in the footer of every page. Withdrawal does not affect the lawfulness of processing before it.
We do not use advertising or remarketing cookies.
Details of each cookie, its provider and duration are in our Cookie Policy.
2.7 Google Maps (only after you click)
Our Contact page shows a map of our office. The map is not loaded automatically. You see a placeholder, and Google Maps loads only when you click it. When it loads, Google receives your IP address and technical browser data and may set cookies on your device (see the Cookie Policy). Google Maps is provided by Google Ireland Limited. See Google’s privacy policy: https://policies.google.com/privacy.
Legal basis: your consent, given by clicking to load the map (Article 6(1)(a) GDPR and Article 4(5) of Law 3471/2006). You can also find our address in text on the same page without loading the map.
2.8 Google reviews widget (Trustindex)
On our homepage we show reviews that our clients have left on Google, using a widget provided by Trustindex Ltd, Hungary. See Trustindex’s privacy policy: https://www.trustindex.io/privacy-policy/. The widget loads files from Trustindex’s servers (cdn.trustindex.io), and the reviewers’ profile pictures load from Google’s servers (googleusercontent.com). To deliver these files, those servers receive your IP address and technical browser data.
Legal basis: our legitimate interest in showing genuine client reviews (Article 6(1)(f) GDPR). The widget sets no cookies on your device.
2.9 Links to social media
Our footer links to our Instagram and LinkedIn pages. These are simple links: no data is sent to those networks until you click them. Once you visit them, the privacy policy of each network applies.
2.10 Email and phone
If you email or call us directly, we process your contact details and the content of your message to answer you, on the same legal bases as in section 2.1.
3. How long we keep your data
| Data | Retention period |
|---|---|
| Contact form and trip brief submissions that do not lead to a booking | 24 months after our last communication with you, then deleted |
| Submissions and correspondence that lead to a booking | for as long as required by Greek tax and accounting law (generally 5 years from the end of the financial year in which the booking was invoiced, longer if a legal obligation or dispute requires it) |
| Record of your confirmation (date, time, hashed IP, user agent) | as long as the related submission |
| Copies of form emails in our mailbox | same periods as the related submission |
| Anti-spam rate-limit data (IP address) | a few hours at most, then deleted automatically |
| Server log files | 30 days, unless needed to investigate a security incident |
| Google Analytics 4 data | 14 months (data retention setting in Google Analytics) |
| Your cookie choices | 6 months (182 days), after which we ask again |
When a retention period ends, we delete or anonymize the data.
4. Who receives your data
We do not sell your personal data. We share it only with:
- Hostinger International Ltd, Cyprus (website hosting and email);
- Google Ireland Limited (Google Tag Manager, Google Analytics 4 with your consent, Google Maps after your click, review profile images);
- Cloudflare, Inc. (Turnstile anti-spam);
- Trustindex Ltd, Hungary (Google reviews widget);
- ZeroComplexity, a sole proprietorship based in Athens 173 43, Greece (VAT no. 154957212), as our processor (cookie consent tool; consent records are stored on Cloudflare infrastructure in the EU);
- travel suppliers such as airlines, ferry and rail operators, hotels, transfer companies and insurers, but only when you ask us to make a booking and only the data each booking needs;
- our accountant and legal advisers, under a duty of confidentiality, where needed;
- public authorities, when the law requires it.
Providers that process data on our behalf do so under a data processing agreement (Article 28 GDPR) and only on our instructions.
5. Transfers outside the European Economic Area
Some of our providers, or companies in their groups, are based in the United States (for example Google LLC and Cloudflare, Inc.). Where personal data is transferred outside the EEA, the transfer is based on:
- the European Commission’s adequacy decision for the EU-US Data Privacy Framework, for companies certified under it; and/or
- the European Commission’s Standard Contractual Clauses, with additional safeguards where needed.
You can ask us for more information about these safeguards using the contact details in section 1.
6. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy;
- rectification of inaccurate or incomplete data;
- erasure of your data (“right to be forgotten”);
- restriction of processing;
- data portability, for data you gave us based on consent or a contract;
- object to processing based on our legitimate interests;
- withdraw your consent at any time, without affecting processing before the withdrawal. For cookies, use the “Cookie settings” link in the footer.
To exercise your rights, email contact@aethratravel.gr. We will reply within one month. This can be extended by two further months for complex requests, in which case we will tell you. We may ask you to confirm your identity. Some rights are subject to the limits set by the GDPR and Greek Law 4624/2019, for example when we must keep data to meet a legal obligation.
7. Right to complain
If you believe that we process your personal data unlawfully, you have the right to lodge a complaint with the Hellenic Data Protection Authority:
- Address: Kifisias 1–3, 115 23 Athens, Greece
- Phone: +30 210 6475 600
- Email: complaints@dpa.gr
- Website: www.dpa.gr
We would appreciate the chance to address your concern first, so please contact us before you complain.
8. Do you have to give us your data?
Fields marked as required in our forms are needed to answer your enquiry or prepare a proposal. If you do not provide them, we cannot process your request. All other fields are optional.
9. Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.
10. Children
Our website and services are not aimed at children. We do not knowingly collect personal data from children under 15 through the website. Travel arrangements for minors are made with their parents or guardians.
11. Security
We take appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS), restricted access to submissions for authorized staff only, hashing of IP addresses, regular updates and backups.
12. Changes to this policy
We may update this Privacy Policy when our services, our website or the law change. The current version is always available on this page, with the date of the last update at the top.