PrivacyPolicy

1. Who is responsible for your data

Strimonikos Yachting, operating from Stavros harbour, Halkidiki, Greece, is the data controller for the personal data described in this notice. We have not appointed a Data Protection Officer, as our processing does not meet the criteria of Article 37 GDPR. All privacy requests are handled by the contact below.

2. What personal data we collect

We only collect data that is necessary to answer your enquiry, run your booking, and operate the boat safely.

• Booking data: full name, email address, phone number, cruise type, requested date, number of guests, and your booking reference.
• Guest and safety data: names of participants, emergency contact, and any information you choose to tell us about mobility, swimming ability, allergies, or health conditions that affect safety on board.
• Payment data: bank transfer reference and payment status. We never see or store your card details — payments are made directly through your own bank.
• Communication data: the content of emails, messages, and phone enquiries you send us.
• Technical data: IP address, browser and device type, and pages visited, processed in server logs for security and to keep the site running.

3. Why we process it, and on what legal basis

Every processing activity has a lawful basis under Article 6(1) GDPR.

• Performing your booking contract, or taking steps before it — Article 6(1)(b): handling reservations, confirming dates, payment administration, and pre-cruise communication.
• Legal obligation — Article 6(1)(c): tax and accounting records, and any passenger or safety information required by Greek maritime and port authorities.
• Legitimate interests — Article 6(1)(f): keeping the website secure, preventing fraudulent or duplicate bookings, and keeping short records of safety acknowledgements. We balance these interests against your rights.
• Vital interests — Article 6(1)(d): using emergency contact or health information in an incident at sea. Health data is special-category data under Article 9 and is processed only where strictly necessary for safety, with your explicit consent where required.
• Consent — Article 6(1)(a): any optional communication you opt into. You can withdraw consent at any time without affecting processing carried out before withdrawal.

4. Who we share it with

We never sell or rent your personal data. We share it only where it is necessary, and our providers act as processors bound by Article 28 GDPR agreements.

• The skipper and crew assigned to your cruise, limited to what is needed to run the trip safely.
• Hosting, database, and email providers that operate this website and our booking records.
• Our accountant and bank, for invoicing and payment reconciliation.
• Port, coastguard, or public authorities where disclosure is required by law or in an emergency.

5. International transfers

Our infrastructure is operated inside the EU/EEA wherever possible. If a provider processes data outside the EEA, the transfer is covered by an adequacy decision of the European Commission or by Standard Contractual Clauses under Article 46 GDPR, together with supplementary safeguards. You may ask us for a copy of the safeguards in place.

6. How long we keep it

We keep data only as long as we need it, then delete or anonymise it.

• Enquiries that do not become bookings: up to 12 months.
• Booking and safety records: for the duration of the cruise season and up to 5 years afterwards, to handle claims and disputes.
• Invoices and accounting records: 10 years, as required by Greek tax law.
• Server and security logs: up to 12 months.

7. Your rights

As a data subject you can exercise the following rights free of charge. We respond within one month of receiving your request, as required by Article 12(3) GDPR.

• Access — obtain confirmation of processing and a copy of your data (Article 15).
• Rectification — correct inaccurate or incomplete data (Article 16).
• Erasure — have your data deleted where no legal obligation requires us to keep it (Article 17).
• Restriction — limit how we process your data in certain cases (Article 18).
• Data portability — receive your data in a structured, machine-readable format (Article 20).
• Objection — object to processing based on our legitimate interests (Article 21).
• Withdraw consent — at any time, with no effect on processing already carried out (Article 7(3)).

8. Complaints

If you believe we have handled your data unlawfully, please contact us first so we can resolve it. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifissias 1-3, 115 23 Athens, Greece — tel. +30 210 6475600, contact@dpa.gr, www.dpa.gr — or with the supervisory authority of your country of residence.

9. Security

We apply technical and organisational measures appropriate to the risk under Article 32 GDPR: encrypted HTTPS connections, access control on our booking database, restricted staff access on a need-to-know basis, and regular backups. No system is completely secure, so we notify you and the Authority of any breach that meets the thresholds of Articles 33 and 34.

10. Children

Bookings are made by adults. Where minors join a cruise, their details are provided by a parent or legal guardian, who is also responsible for consenting to their participation. We do not knowingly collect data directly from children.

11. Cookies

This website uses only strictly necessary storage and does not run advertising or profiling trackers. Full details, including every cookie we set, are in our Cookie Policy.

12. Changes to this notice

We may update this notice to reflect changes in our operations or in the law. The current version is always published on this page with its effective date. Material changes will be highlighted on the website.