1. Who We Are
The data controller responsible for your personal data is:
| Controller | Kimon Gasparatos (sole proprietorship), trading as "KCG Travel Services Kefalonia" |
| Address | Lassi, Argostoli–Aerodromiou, 28100 Kefalonia, Greece |
| VAT No. (ΑΦΜ) | 025649536 |
| Email for privacy requests | info@kcgservices.gr |
| Phone | +30 2671 025653 |
We have not appointed a Data Protection Officer. For any question about your personal data, please contact us at info@kcgservices.gr.
2. What Data We Collect
When you book a tour
- Contact details of the Lead Passenger: full name, email address, mobile phone number.
- Booking details: tour, date, number of adults and children, pickup point and accommodation (bus tours), any notes you add, price and payment status.
- Passenger list details (cruises and boat tours only): full name, date of birth, passport number and nationality of every participant. The captain needs these to prepare the passenger list required by the Port Authority.
- Payment details: online bookings are paid through Stripe; on-request bookings are paid on the secure payment page of our bank (National Bank of Greece). We receive confirmation of payment and limited details (e.g. card type and last four digits), but we never see or store your full card number.
When you send us a request through our website (e.g. "Tailored Experiences" or a private tour request)
- Name, email address, preferred date, number of guests, the tour or places you are interested in, and your message.
- Please do not include sensitive information (for example about your health) in your message unless it is needed for your request.
When you contact us
- The content of your emails, phone calls and messages (including WhatsApp and Viber), and the contact details you use.
When you visit our website
- Technical data: IP address, browser type, device type, operating system, and information about errors that occur on the page.
- Usage data (only with your consent): pages visited, time spent, links clicked, referral source, and booking steps — see our Cookie Policy.
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects for you.
3. How We Collect Your Data
Most of the data we process comes directly from you, when you:
- book a tour on our website, by email, by phone or at our office;
- send us a request through a form on our website;
- contact us by email, phone, WhatsApp or Viber;
- browse our website (through cookies and similar technologies, where you have consented).
We may also receive data from:
- our booking platform (Bokun) and payment providers (Stripe, National Bank of Greece) — booking and payment confirmations;
- our Partner Operators — for example, if they need to tell us about a change to your trip.
4. How We Use Your Data and Our Legal Basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Processing your booking, issuing your Voucher, organising pickups, and passing your booking to the Partner Operator for boat tours | Performance of a contract (6(1)(b)) |
| Contacting you about your booking (confirmations, pickup times, changes, cancellations) | Performance of a contract (6(1)(b)) |
| Preparing the passenger list for cruises and boat tours, which the captain submits to the Port Authority | Legal obligation (6(1)(c)) and performance of a contract (6(1)(b)) |
| Processing payments and refunds, and issuing receipts and invoices | Performance of a contract (6(1)(b)) and legal obligation (6(1)(c)) |
| Keeping accounting and tax records | Legal obligation (6(1)(c)) |
| Answering requests you send us through our forms or by email/phone | Steps prior to a contract at your request (6(1)(b)) / legitimate interest (6(1)(f)) |
| Sending one thank-you email after your tour with an invitation to leave a review | Legitimate interest (6(1)(f)) — you can unsubscribe at any time |
| Handling complaints and legal claims | Legitimate interest (6(1)(f)) and legal obligation (6(1)(c)) |
| Keeping our website secure and working, and fixing errors | Legitimate interest (6(1)(f)) |
| Measuring website use with cookieless, aggregated statistics | Legitimate interest (6(1)(f)) |
| Website analytics with cookies (Google Analytics) | Consent (6(1)(a)) |
| Measuring the results of our advertising (Google Ads) | Consent (6(1)(a)) |
Where we rely on legitimate interest, we have balanced our interest against your rights. You can object at any time (see Section 10).
5. Emails We Send You
We do not send newsletters or promotional emails. The emails you receive from us are:
- your booking confirmation and Voucher;
- messages about your booking (pickup details, changes, cancellations, refund receipts);
- answers to your requests;
- one thank-you email after your tour, with an invitation to leave a review.
Every thank-you email contains an unsubscribe link. You can also ask us at any time not to send it, by writing to info@kcgservices.gr.
6. Who We Share Your Data With
We do not sell, rent or trade your personal data. We share it only as needed for the purposes above:
Partners who carry out your tour
- Partner Operators (boat owners, captains and crews), for boat tours you booked with us — the booking details and the passenger list they need to run your trip.
- The Port Authority (Hellenic Coast Guard), to which the captain submits the passenger list for cruises and boat tours.
- Transfer providers, if we arrange a transfer for you.
Service providers who process data on our behalf (under data processing agreements)
| Provider | Purpose | Location of processing |
|---|---|---|
| Bokun (Tripadvisor LLC) | Online booking platform and booking management | USA / outside the EEA — see Bokun's privacy policy |
| Stripe | Online payment processing | EU / USA |
| National Bank of Greece | Card payments via payment link for on-request bookings | Greece / EU |
| Our reservation management system | Managing bookings and operations | Greece |
| Google Workspace | EU / USA | |
| Resend | Sending emails from our website (form requests and thank-you emails) | EU (Ireland) |
| Supabase | Website database (anonymous tour view counter, log of thank-you emails sent, unsubscribe list) | EU |
| Vercel | Website hosting | Global / USA |
| Sentry | Error monitoring for our website | EU (Germany) |
| Google Analytics / Google Ads | Website analytics and advertising measurement — only with your consent | EU / USA |
Messaging apps If you contact us via WhatsApp or Viber, your messages are also processed by those services under their own privacy policies.
Authorities and advisers
- Greek tax authorities and our accountants, for accounting and tax purposes.
- Courts, police or other public authorities, where required by law.
7. Transfers Outside the EU
Some of our service providers (for example Bokun, Google, Stripe and Vercel) are based in, or may process data in, the United States or other countries outside the European Economic Area. Where this happens, the transfer is protected by an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or by Standard Contractual Clauses approved by the European Commission.
8. How Long We Keep Your Data
| Data | Retention period |
|---|---|
| Booking and payment records, including passenger list details | For the period required by Greek tax and accounting law, as part of the booking record |
| Correspondence about a booking | Together with the booking record |
| Requests sent through our website forms (not followed by a booking) | 2 years |
| Log of thank-you emails sent | 12 months, then deleted |
| Unsubscribe requests (your email address only) | As long as needed to make sure we don't email you again |
| Google Analytics data (with consent) | 14 months |
| Your cookie consent choice | 12 months |
When a retention period ends, we delete or anonymise the data, unless we are legally required to keep it longer.
9. How We Protect Your Data
We use appropriate technical and organisational measures, including encrypted connections (HTTPS/TLS), PCI-DSS compliant payment processing through Stripe, access to personal data limited to authorised staff, and password-protected administration areas.
10. Your Data Protection Rights
You have the right to:
- Access — ask for a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or complete incomplete data.
- Erasure — ask us to delete your data, where there is no legal reason for us to keep it (e.g. tax records must be kept).
- Restriction — ask us to restrict processing, for example while we check the accuracy of your data.
- Objection — object to processing based on our legitimate interest, including the thank-you email.
- Data portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another organisation.
- Withdraw consent — at any time, for cookies through "Cookie settings" at the bottom of every page. Withdrawing consent does not affect processing carried out before.
To exercise any of these rights, email info@kcgservices.gr. We respond within one month, free of charge. We may need to verify your identity before acting on your request.
11. Children
Our tours are booked by adults. We do not knowingly collect personal data directly from children. The names, dates of birth, passport numbers and nationalities of children travelling on a boat tour are provided by the adult who makes the booking, only for the passenger list.
12. Cookies
We use cookies that are strictly necessary for the website and for booking, and — only with your consent — analytics and marketing cookies. You can change your choice at any time through "Cookie settings" at the bottom of every page. Full details are in our Cookie Policy.
13. Other Websites
Our website contains links to other websites and services, such as social media (Facebook, Instagram, YouTube, LinkedIn), review platforms (Tripadvisor, Google), maps, and other providers' booking pages. This Privacy Policy applies only to kcgtours.gr. Please read the privacy policies of other websites you visit.
14. Changes to This Privacy Policy
We review this Privacy Policy regularly and publish any update on this page, with a new "Last updated" date.
15. How to Contact Us
If you have any question about this Privacy Policy or the data we hold about you, or want to exercise one of your rights, contact us:
- Email: info@kcgservices.gr
- Phone: +30 2671 025653
- Post: KCG Travel Services Kefalonia, Lassi, Argostoli–Aerodromiou, 28100 Kefalonia, Greece
16. How to Contact the Supervisory Authority
If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA), or with the data protection authority of your EU country of residence.
Hellenic Data Protection Authority Kifisias Ave. 1–3, 115 23 Athens, Greece Phone: +30 210 6475 600 Email: contact@dpa.gr Website: www.dpa.gr
This Privacy Policy is provided in English. In case of any difference with a translation, the English version prevails.