PRIVACY POLICY — HAGIOTOPIA

Last updated: 12 August 2026

1. Purpose

This Policy explains how Hagiotopia collects and processes personal data relating to Website visitors, prospects, travellers, participants and business contacts.

The applicable framework includes Regulation (EU) 2016/679 (GDPR), Greek Law 4624/2019 and, for electronic communications, Greek Law 3471/2006.

2. Controller

[HAGIOTOPIA LEGAL NAME]

Address: [TO BE COMPLETED, GREECE]

AFM: [TO BE COMPLETED]

Privacy email: [TO BE COMPLETED]

DPO, if appointed: [TO BE COMPLETED]

3. Data we may process

Depending on your relationship with Hagiotopia:

• identity: name, surname, title, date of birth where necessary;
• contact information: address, email, telephone;
• booking data: trip, dates, participants, room and preferences;
• data necessary for formalities: nationality, passport or travel document data where necessary;
• payment and billing data; full card details may be processed directly by the payment provider;
• communications and requests sent to Hagiotopia;
• technical data: IP address, logs, device, browser and cookie data according to your choices;
• information concerning special requirements, potentially including health data where necessary and lawful;
• information relating to a claim or assistance case where necessary.

4. Purposes and legal bases

Hagiotopia may process data:

1. a) to respond to enquiries and take pre-contractual steps;
2. b) to enter into and perform the travel contract;
3. c) to manage payments, invoices, bookings, transport, accommodation, visits and assistance;
4. d) to comply with legal, accounting, tax, tourism, safety or public-authority obligations;
5. e) to establish, exercise or defend legal claims based on legitimate interests or applicable obligations;
6. f) to secure the Website and prevent fraud on the basis of legitimate interests;
7. g) to send marketing communications where consent is required or otherwise as permitted by law;
8. h) to measure audience or use non-essential trackers on the basis of consent where required.

5. Special category data

Information revealing health is special category data. Hagiotopia limits collection to what is necessary and processes such data only where a lawful basis and, where relevant, an Article 9 GDPR condition apply, for example explicit consent where appropriate or another legally permitted condition.

6. Data about other travellers

If you provide information about other participants, you must be authorised to disclose it and provide them with relevant information about how their data are processed.

7. Recipients

Data may be shared as necessary with:

• authorised Hagiotopia staff and representatives;
• hotels and accommodation providers;
• carriers;
• guides, tour leaders and activity providers;
• partner agencies or destination management companies;
• payment providers and banks;
• IT, hosting, email and management service providers;
• BIRIS, insurer(s), assistance companies and claims handlers where necessary;
• professional advisers;
• public authorities where legally required.

Each recipient receives only data necessary for its role, subject to its own legal obligations.

8. Transfers outside the European Economic Area

Some trips or suppliers may require data transfers outside the EEA. Where required by the GDPR, Hagiotopia uses an appropriate transfer mechanism such as an adequacy decision, Standard Contractual Clauses or another recognised safeguard. Where a transfer is necessary for performance of a contract or pre-contractual measures requested by the individual, relevant statutory derogations may also apply.

9. Retention periods

Data are retained for periods proportionate to their purpose:

• enquiries without booking: [TO BE COMPLETED, e.g. 2 years after last contact];
• customer files and contracts: for the relationship and thereafter as necessary for legal obligations and limitation periods;
• accounting/tax records: for periods required by Greek law;
• marketing data: [TO BE COMPLETED] or until consent is withdrawn/objection exercised where applicable;
• cookies: as stated in the Cookie Policy;
• dispute data: until closure and expiry of relevant limitation periods.

An internal retention schedule should be approved with Greek legal/accounting advisers.

10. Security

Hagiotopia implements technical and organisational measures appropriate to risk, including access controls, restricted permissions, backups and system security measures. No system can guarantee zero risk.

11. Your rights

Subject to the GDPR, you may request:

• access;
• rectification;
• erasure;
• restriction;
• portability where applicable;
• objection to processing based on legitimate interests;
• withdrawal of consent at any time without affecting prior lawful processing;
• information about safeguards for certain international transfers.

Rights requests may be sent to [PRIVACY EMAIL]. Proof of identity may be requested only where necessary to verify identity.

12. Complaint to the supervisory authority

You may lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), without prejudice to any other administrative or judicial remedy.

13. Marketing

Electronic marketing communications are sent in accordance with the GDPR and Greek Law 3471/2006. Where consent is required, it may be withdrawn at any time. Relevant communications must provide an unsubscribe mechanism.

14. Minors

Hagiotopia processes minors’ data only where necessary for travel arrangements and in accordance with applicable legal requirements. Required information and authorisations are obtained from authorised persons where legally required.

15. Cookies

Information about cookies, trackers, purposes, retention and consent choices is provided in the Cookie Policy.

16. Changes

This Policy may be updated. The latest update date appears above. Material changes are communicated where required by law.

17. Contact

Hagiotopia — Data Protection

Address: [TO BE COMPLETED]

Email: [TO BE COMPLETED]