This Privacy Policy explains what personal data we process when you visit web-greece.gr or contact us, why we process it, on what legal basis, for how long, and what rights you have. The key points are below; the details follow in the next sections.
The data controller is “Web Greece Traveller” (trading as Web-Greece.gr, GEMI no. 147196516000), which has operated the website since 2015.
You can browse the entire website without giving us any information. There are no user accounts and we never collect payment data; bookings are made directly with the accommodation providers or through their own booking engines.
Cookies and similar technologies for statistics and advertising are activated only if you consent. Until then, all non-essential storage is switched off (Google Consent Mode v2).
You can change or withdraw your consent at any time, using the floating cookie button shown on every page or the “Cookie settings” button on this page.
If you consent to statistics or marketing cookies, some browsing data is used jointly with our group websites xionodromika.gr, 3days.gr, voyagebay.com and holidaysgreece.gr, with whom we are joint controllers.
Some features (maps, weather forecasts, videos, webcams, fonts) are loaded from third-party servers, which necessarily receive your IP address.
You have the right to access, rectify, erase, restrict, port and object. Write to us at [[wgm:cmcuZWNlZXJnLWJld0BvZm5p]]; we reply within one month, free of charge.
If you believe the processing infringes your rights, you can lodge a complaint with the Hellenic Data Protection Authority.
Who we are – data controller
The data controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) is:
Name: Web Greece Traveller (trading as Web-Greece.gr)
GEMI (Greek General Commercial Registry) no.: 147196516000
This Policy applies to all language versions of the website (Greek, English, German and Italian), as well as to your communications with us, newsletter sign-ups, push notifications and business listing requests. It does not apply to third-party websites we link to, such as hotel and business websites.
Legal framework
Regulation (EU) 2016/679 (GDPR);
Greek Law 4624/2019 on the Hellenic Data Protection Authority and measures implementing the GDPR;
Greek Law 3471/2006 on the protection of personal data in electronic communications, in particular Article 4(5) on storing and accessing information on the user’s terminal equipment (cookies).
The Greek text of this Policy is the authoritative version; in case of any discrepancy with a translation, the Greek text prevails.
Joint controllership with our group websites
web-greece.gr belongs to the same business group as the following websites:
For certain processing operations these websites and web-greece.gr jointly determine the purposes and means of processing and are therefore joint controllers under Article 26 GDPR.
What data is used jointly
Shared Meta Pixel: browsing events (e.g. page views, clicks on links or buttons), together with cookie identifiers (e.g. _fbp), your IP address and browser and device information, are recorded in the same Pixel used by all group websites.
Shared advertising audiences: based on this data, groups of visitors are created (e.g. “visitors who viewed pages about Crete”) who may be shown advertising for any group website (remarketing), as well as “lookalike” audiences with similar interests.
Shared statistics: aggregated or pseudonymised traffic and behaviour data (e.g. which pages and destinations attract interest, which group websites visitors come from), so that we can assess our content and campaigns across all websites.
Purposes
Cross-site traffic analysis within the group, measuring advertising effectiveness, remarketing and building advertising audiences.
Legal basis
Exclusively your consent (Article 6(1)(a) GDPR and Article 4(5) of Law 3471/2006), which you give through the cookie banner under the “Statistics” and “Marketing” categories. If you do not consent, or withdraw your consent, these tools are not loaded and no data is collected for joint use.
Arrangement between the joint controllers
The joint controllers have set out their respective responsibilities in an arrangement between them, in particular regarding informing visitors, obtaining consent and handling requests to exercise rights. The essence of this arrangement is available to you on request at [[wgm:cmcuZWNlZXJnLWJld0BvZm5p]].
Irrespective of the arrangement, you can exercise your rights against any of the group websites (Article 26(3) GDPR). If you contact us about data concerning another group website, we will coordinate with it so that you receive a single reply.
Joint controllership with Meta
In addition, for the collection and transmission of data through the Meta Pixel we are joint controllers with Meta Platforms Ireland Ltd, in line with the case law of the Court of Justice of the EU (Case C‑40/17, Fashion ID) and Meta’s Controller Addendum. Any further processing of that data is carried out by Meta under its own responsibility, in accordance with the Meta Privacy Policy.
What data we collect
1. Data recorded automatically when you visit
As with any website, our server and the Cloudflare network record technical data needed to deliver and protect the page:
IP address;
date and time of the request;
the page or file requested and the response code;
the page you came from (referrer);
browser and operating system type and version (user agent);
security indicators (e.g. whether the request appears to come from an automated program).
2. Data from cookies and third-party tools
Only if you consent, statistics and advertising tools collect device identifiers or cookies, the pages you visit, visit duration, clicks and movements on the page, approximate location (country or city level), language and device type. See the Cookies and Third-party services sections for details.
3. Data you give us
Contacting us (e-mail, phone): name, e-mail address, phone number and anything else you choose to write or tell us.
Newsletter sign-up: e-mail address and records documenting your consent (date, time and method of sign-up).
Business listing request: business name and details (address, phone numbers, website, description, photographs), name and contact details of the contact person and, where required, tax details for invoicing.
Taking part in contests via Facebook: your profile name, your comment or reaction and, if you win, the details needed to deliver the prize. The Contest Terms also apply.
Messages via social media: your profile name and the content of the message. The platform’s own privacy policy applies to the data the platform itself processes.
4. Newsletter
The newsletter is sent through the Mailchimp service. The e-mails contain small embedded elements (pixels) and tracking links, so that we know whether a message was opened and which links were clicked. We use this information to improve our content and avoid sending messages that do not interest you. You can unsubscribe at any time using the “unsubscribe” link in every message or by writing to [[wgm:cmcuZWNlZXJnLWJld0BvZm5p]].
5. Push notifications
You can subscribe to push notifications about new offers and news. Subscription happens only after you give explicit permission in the prompt displayed by your browser itself. To send notifications, a unique subscription identifier (endpoint) and the encryption keys generated by the browser are stored, together with your language and the date of subscription. Notifications are delivered through the push service of your browser’s vendor. You can revoke permission at any time in your browser’s site settings.
6. What we do not collect
We have no user account or login system.
We never collect payment data (cards, bank accounts). Bookings and payments are made directly with the accommodation providers or through their own booking engines, under their responsibility.
We do not ask for special categories of data (e.g. health data). Please do not include such data in your messages.
Purposes and legal bases of processing
We process data only where there is a legal basis under Article 6 GDPR. The table summarises each purpose:
Processing purposes, data categories and legal bases
Purpose
Data categories
Legal basis
Delivering, operating and securing the website; protection against attacks and abuse
Server logs, Cloudflare security cookies, CAPTCHA data
Legitimate interest (Article 6(1)(f) GDPR); for strictly necessary cookies, the exemption in Article 4(5) of Law 3471/2006
Storing your choices (cookies, accessibility, language)
The wg-consent, wg-a11y and wg-lang entries
Storage strictly necessary for a service you explicitly request (Article 4(5) of Law 3471/2006); for documenting consent, legal obligation (Article 6(1)(c) in conjunction with Article 7(1) GDPR)
Legitimate interest in providing the features you request; consent for any cookies or storage by the provider
Traffic statistics and website improvement
Cookies and identifiers, pages, events, device type, approximate location
Consent (Article 6(1)(a) GDPR)
Advertising, conversion measurement, remarketing and shared group advertising audiences
Cookies and identifiers, browsing events, IP address, device data
Consent (Article 6(1)(a) GDPR)
Sending the newsletter and measuring opens/clicks
E-mail address, consent record, e-mail interaction data
Consent (Article 6(1)(a) GDPR)
Push notifications
Subscription identifier, encryption keys, language
Consent (browser permission)
Replying to messages and requests
Contact details, message content
Legitimate interest in replying to communications you initiate; where the request concerns a contract, steps prior to entering into it (Article 6(1)(b) GDPR)
Business listings and invoicing
Business and contact-person details, tax details
Performance of a contract (Article 6(1)(b) GDPR); legal obligation for tax matters (Article 6(1)(c) GDPR)
Running contests
Profile name, entry, prize delivery details
As set out in the Contest Terms (as a rule, performance of the terms you accept, Article 6(1)(b) GDPR)
Establishing, exercising or defending legal claims; complying with requests from authorities
Where we rely on legitimate interest, we have assessed that the processing is limited, expected and does not override your own interests. You always have the right to object (see Your rights).
Cookies and storage on your device
What cookies are
Cookies are small text files stored on your device. Other technologies work in a similar way, such as the browser’s local storage (localStorage), pixels and measurement scripts. In this Policy, the term “cookies” covers all of these technologies.
Categories
Strictly necessary: required for the operation and security of the website and to store your choices. They are always active and do not require consent (Article 4(5) of Law 3471/2006).
Preferences / functional: allow embedded third-party content (e.g. videos, maps, webcams) to remember settings or work fully.
Statistics / analytics: help us understand how the website is used (e.g. Google Analytics 4, Hotjar).
Marketing / advertising: used to measure and personalise advertising and for remarketing, including within the group (e.g. Google Ads, Meta Pixel, TikTok Pixel, Pinterest Tag).
How consent works
On your first visit a banner is displayed with the options “Accept all”, “Reject all” and “Settings”, where you can choose per category. Rejecting is as easy as accepting.
We have implemented Google Consent Mode v2: by default all non-essential storage (ad_storage, analytics_storage, ad_user_data, ad_personalization) is set to “denied” until you consent.
Google Tag Manager (GTM-PMNFS2X) loads the other tags only according to your choices. If you do not consent, no statistics or marketing cookies are set.
Your choice is stored on your device for 12 months; after that period you will be asked again.
You can change or withdraw your consent at any time using the floating cookie button or the button at the end of this section. Withdrawal does not affect the lawfulness of processing carried out before it. Cookies already stored can be deleted in your browser settings.
Storage used by the website itself
First-party and security cookies and local storage
Name
Type
Purpose
Duration
Category
wg-consent
localStorage
Stores your cookie choices and the time you made them
12 months
Strictly necessary
wg-a11y
localStorage
Stores your accessibility settings (text size, dark mode, contrast)
Until you delete it
Strictly necessary (feature you request)
wg-lang
localStorage
Stores your preferred language
Until you delete it
Strictly necessary (feature you request)
__cf_bm
Cookie (Cloudflare)
Distinguishes humans from automated programs (bots)
30 minutes
Strictly necessary
cf_clearance
Cookie (Cloudflare)
Shows that you have successfully passed a security check, so you are not asked again
Limited, according to the security settings
Strictly necessary
Third-party provider cookies (e.g. _ga, _gcl_au, _fbp) are listed in the tables in the Third-party services section. Their exact duration is set by each provider.
Do Not Track and Global Privacy Control
If your browser sends a Global Privacy Control (GPC) signal, we treat it as a refusal of marketing/advertising cookies, without you having to state this again in the banner. For the older Do Not Track (DNT) signal there is no uniform interpretation standard; we recommend that you use the cookie settings to express your choice with certainty.
Third-party services we use
The services below are used, or may be used, on the website. Those in the “Statistics” and “Marketing” categories are activated only with your consent. Some providers act as processors on our behalf, others as independent controllers for the data they collect.
A. Infrastructure, security and management
Infrastructure, security and tag management services
Service
Provider (country)
Purpose
Data
Cookies / storage
Legal basis
Privacy policy
Cloudflare
Cloudflare, Inc. (USA)
Content delivery network (CDN), DNS, protection against DDoS attacks and bots
IP address, technical request data, security indicators
__cf_bm, cf_clearance
Legitimate interest (security); strictly necessary cookies
Third-party camera providers, e.g. meteo.gr, meteo.camera, cameraserv.bwd.gr and others (depending on the provider)
Showing live images from destinations
IP address, technical request data
According to each provider
Legitimate interest for display; consent (Preferences) for any provider cookies
On each provider’s website
C. Statistics and analytics (only with consent)
Statistics and traffic analytics services
Service
Provider (country)
Purpose
Data
Cookies / storage
Legal basis
Privacy policy
Google Analytics 4
Google Ireland Limited (Ireland) / Google LLC (USA)
Traffic and usage statistics, including at group level
Pseudonymous identifier, pages, events, duration, device type, approximate location (the IP address is used only to estimate location and is not stored)
The push service of your browser’s vendor (e.g. Google, Mozilla, Apple, Microsoft)
Delivering notifications about offers and news
Subscription identifier, encryption keys, language, subscription date
Subscription managed by the browser (service worker)
Consent (explicit browser permission)
In the privacy policy of your browser’s vendor
Important clarifications
Hotjar: session recordings are pseudonymous. Anything you type into input fields is masked before transmission and is not recorded.
YouTube: we use privacy-enhanced mode (youtube-nocookie.com), so that YouTube does not store information about you before you press play. After playback starts, Google’s policy applies.
Google Fonts, OpenStreetMap, unpkg.com, Open-Meteo: to display fonts, map tiles, code libraries or weather forecasts, your browser connects directly to the providers’ servers, which, for technical reasons, necessarily receive your IP address. These services do not set cookies through our website.
Live webcams: the images come from third-party camera providers. Their own terms and privacy policies apply.
Social sharing: the share buttons for Facebook, X/Twitter, LinkedIn, WhatsApp and e-mail are plain links. No data reaches these networks before you click; once you click, the policy of the respective network applies. The “copy link” button only copies the page address to your device’s clipboard.
QR codes: the QR code for each page is generated on our own server as a static image. No third party is involved.
Recipients of data
Your data may be received, only to the extent necessary for each purpose, by:
Processors acting on our behalf: the website’s hosting provider, Cloudflare (CDN, DNS, security), Google (Tag Manager, Analytics), Hotjar, Mailchimp and the CAPTCHA providers. We have concluded or accepted data processing agreements with our processors in accordance with Article 28 GDPR.
Independent controllers: advertising platforms (Google, Meta, TikTok, Pinterest) for their own further processing, providers of embedded content (YouTube, Google Maps, OpenStreetMap Foundation, Open-Meteo, webcam providers), the push services of browser vendors, and social media platforms when you contact us through them or take part in a contest.
Our group websites (xionodromika.gr, 3days.gr, voyagebay.com, holidaysgreece.gr), as joint controllers, for the purposes described in Joint controllership.
Accountants and tax advisers, for listing invoicing data, to the extent required by tax law.
Public authorities, courts and prosecuting authorities, only where there is a legal obligation or where necessary to defend legal claims.
Transfers outside the European Economic Area
Some providers (e.g. Google, Meta, Cloudflare, Mailchimp, Semrush, hCaptcha, Pinterest, TikTok) are based in, or process data in, countries outside the European Economic Area (EEA), mainly the USA. Such transfers take place only with the safeguards of Chapter V GDPR:
EU-US Data Privacy Framework: for US recipients certified under the Framework, the transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Article 45 GDPR). You can check whether a company is certified at dataprivacyframework.gov/list.
Standard Contractual Clauses: for recipients that are not certified or are located in other third countries, the transfer is based on the European Commission’s Standard Contractual Clauses (Article 46(2)(c) GDPR), combined with supplementary technical and organisational measures where required.
United Kingdom and Switzerland: European Commission adequacy decisions apply to the OpenStreetMap Foundation (United Kingdom) and Open-Meteo (Switzerland).
Please note that in countries outside the EEA, public authorities may be able to access data under conditions that differ from those of European law. You can request a copy of the relevant safeguards at [[wgm:cmcuZWNlZXJnLWJld0BvZm5p]].
How long we keep data
We keep data only for as long as necessary for the purpose for which it was collected. When the retention period ends, we delete or anonymise it.
Retention periods by data category
Data category
Retention period
Correspondence (e-mails and messages to us)
24 months from the end of the communication
Newsletter (e-mail address and consent record)
Until you unsubscribe
Business listing data
For the duration of the listing; tax data for as long as required by tax law
Server and security logs
Up to 12 months
Google Analytics 4 data
14 months (data retention setting)
Cookie consent record (wg-consent)
12 months
Accessibility and language settings (wg-a11y, wg-lang)
Until you delete them from your browser
Push notification subscription
Until you revoke permission or the subscription expires
Contest data
As set out in the Contest Terms
Data held by other providers (Hotjar, advertising platforms, etc.)
According to our settings in each service and the provider’s policy
If data is needed to establish, exercise or defend legal claims, we may keep it for as long as the relevant proceedings last (Article 17(3)(e) GDPR).
Data security
We take appropriate technical and organisational measures (Article 32 GDPR) to protect data against loss, misuse and unauthorised access, in particular:
an encrypted HTTPS/TLS connection on every page;
protection against DDoS attacks and malicious bots through Cloudflare;
access to systems and data restricted to authorised persons only, with strong passwords;
regular backups;
obfuscation of e-mail addresses and phone numbers in the page code, so that they cannot be harvested by automated spam programs;
data minimisation: we keep no user accounts and collect no payment data.
No system is completely secure. In the event of a personal data breach we will notify the Hellenic Data Protection Authority and, where the breach is likely to result in a high risk to you, you as well, in accordance with Articles 33 and 34 GDPR.
Your rights
The GDPR gives you the following rights. You can exercise them free of charge, as described in How to exercise your rights.
Right to be informed (Articles 13 and 14): you have the right to know clearly who processes your data, for what purpose, on what legal basis, for how long and to whom it is disclosed. This Policy fulfils that obligation; you can ask us for any clarification.
Right of access (Article 15): you can find out whether we process data about you and, if so, receive a copy together with information on the purposes, recipients, retention period and source. In practice: you write to us from the e-mail address you used to contact us or sign up, and we send you the data we hold.
Right to rectification (Article 16): you can ask us to correct inaccurate data or complete incomplete data, e.g. a wrong e-mail address or, for businesses, incorrect details in a listing.
Right to erasure – “right to be forgotten” (Article 17): you can ask us to erase your data, in particular when it is no longer necessary, when you withdraw your consent or when you have objected. Erasure may not be possible to the extent that we must retain data to comply with a legal obligation (e.g. tax records) or for legal claims; in that case we will explain why.
Right to restriction of processing (Article 18): you can ask us to “freeze” your data, i.e. store it without using it, for example while we verify its accuracy or consider your objection, or when you need it for a legal claim while we no longer do.
Notification obligation (Article 19): when we rectify, erase or restrict your data, we inform every recipient to whom we have disclosed it, unless this proves impossible or involves disproportionate effort. On request, we will tell you who these recipients are.
Right to data portability (Article 20): for data you have provided to us and that we process by automated means on the basis of consent or contract (e.g. your newsletter e-mail, listing details), you can receive it in a structured, commonly used and machine-readable format (e.g. CSV) or ask for it to be transmitted directly to another controller, where technically feasible.
Right to object (Article 21): you can object, on grounds relating to your particular situation, to processing based on legitimate interest; we will then stop, unless we demonstrate compelling legitimate grounds that override your interests or the processing is necessary for legal claims. For direct marketing (newsletter, advertising) the right to object is absolute: if you object, we stop immediately, without you having to give reasons.
Automated decisions and profiling (Article 22): you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. We do not take such decisions. Advertising platforms build interest profiles to show personalised ads only if you consent; you can prevent this by refusing or withdrawing consent for marketing cookies.
Right to withdraw consent (Article 7(3)): where processing is based on consent, you can withdraw it at any time, as easily as you gave it: in the cookie settings, with the unsubscribe link in the newsletter or in your browser’s notification settings. Withdrawal does not affect the lawfulness of processing carried out before it.
Right to lodge a complaint (Article 77): if you believe that the processing of your data infringes the law, you can lodge a complaint with the supervisory authority, without prejudice to any other administrative or judicial remedy:
Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα)
Kifisias Ave. 1-3, 115 23 Athens, Greece
Phone: [[wgt:MDA2NTc0NiAwMTIgMDMr]]
Website: www.dpa.gr We would, however, appreciate it if you contacted us first, so that we can try to resolve the matter.
How to exercise your rights
Request: send an e-mail to [[wgm:cmcuZWNlZXJnLWJld0BvZm5p]] stating which right you wish to exercise and, if possible, which data it concerns (e.g. “remove me from the newsletter”, “a copy of our correspondence”). You can also call [[wgt:MDEzNTM4MyAwMTIgMDMr]] for guidance.
Identification: to avoid disclosing data to someone else, we may ask you for information confirming your identity, e.g. to write to us from the e-mail address associated with the data. We ask only for what is strictly necessary.
Time limit: we reply without undue delay and at the latest within one month of receiving the request. This period may be extended by two further months where the request is complex or there are numerous requests; in that case we will inform you of the extension and the reasons within the first month.
Cost: exercising your rights is free of charge. Only where a request is manifestly unfounded or excessive, in particular because of its repetitive character, may we charge a reasonable fee or refuse to act, giving reasons for our decision.
Refusal: if we do not comply with your request, we will explain the reasons and inform you of your right to complain to the Authority and to seek a judicial remedy.
Group websites: for data used jointly, you can contact any of the group websites; we will coordinate so that your request is handled as one.
Third-party platforms: for data processed by platforms as independent controllers (e.g. Google, Meta), you can also contact them directly, using the links in the Third-party services section.
How to switch off each tool
In addition to the cookie settings, you can limit processing in the following ways:
The website’s cookie settings: using the floating cookie button or the “Cookie settings” button in the Cookies section, you can switch off any category.
Browser settings: in your browser’s privacy menu you can delete cookies and site data (including localStorage), block third-party cookies or use private browsing.
Google Ads and Google personalised ads: on Google’s My Ad Center page.
Meta (Facebook, Instagram): in Meta’s ad preferences, where you can also limit the use of activity from other websites.
TikTok and Pinterest: in the privacy and ads settings of your account on each platform.
Behavioural advertising in general: on the European platform Your Online Choices.
Hotjar and other statistics: by switching off the “Statistics” category in the cookie settings.
Newsletter (Mailchimp): with the unsubscribe link in every e-mail or by writing to [[wgm:cmcuZWNlZXJnLWJld0BvZm5p]].
Push notifications: in your browser’s site settings (usually by clicking the icon next to the page address → Notifications → Block) or in your device’s notification settings.
Global Privacy Control: if you enable GPC in your browser, marketing cookies are treated as refused.
Children
The website is intended for adult travellers and is not directed at children. In Greece, the age limit for consent to information society services is 15 years (Article 21 of Law 4624/2019 and Article 8 GDPR). Children under 15 should not sign up for the newsletter or push notifications, or consent to cookies, without the consent of their parent or guardian. Participation in contests is permitted only in accordance with the Contest Terms. If we find that we have collected a child’s data without the required consent, we will delete it. Parents or guardians can let us know at [[wgm:cmcuZWNlZXJnLWJld0BvZm5p]].
Links to third-party websites
Our listings contain links to the websites of hotels, businesses, booking engines and other third parties, which open in a new window. Once you go to those websites, we no longer control what data is collected. Their own privacy and cookie policies apply, and we recommend that you read them, especially before making a booking or payment.
Changes to this Privacy Policy
We may update this Policy when the services we use, the law or our practices change. Every change is announced on the website, and the date of the last update is shown at the top of the page. If a change affects your cookie choices (e.g. a new marketing tool is added), we will ask for your consent again. The Terms of Use also apply to your use of the website.
Contact
For any question about this Privacy Policy or the processing of your data:
Web Greece Traveller (Web-Greece.gr), GEMI no. 147196516000
