Privacy Policy & Cookie Policy

1. Introduction

This Privacy Policy explains how Eightarrows Travel ("we", "us", "our") collects, uses, and protects your personal data when you visit https://eightarrowstravel.com (the "Website"), contact us, request a travel proposal, or use our services. It also explains the cookies and similar technologies used on the Website.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR), Greek Law 4624/2019, and other applicable data protection legislation.

Please read this policy carefully. By using the Website, you acknowledge the practices described here. Where the law requires your consent — for example, for non-essential cookies or marketing emails — we will ask for it separately and clearly.

2. Who we are — Data Controller

The data controller responsible for your personal data is:

[Legal Company Name], trading as Eightarrows Travel
Registered address: [Business Address]
VAT / Registration number: [VAT / Registration Number]
Email: info@eightarrowstravel.com
Phone: +30 694 947 2274

For privacy-related questions or requests, you can also contact us at [Privacy Email].

3. What personal data we collect

Depending on how you interact with us, we may collect:

• Identity and contact data: name, email address, phone or WhatsApp number.
• Travel inquiry data: destinations of interest, travel dates, number of travellers, budget range, and any details you choose to share in your message.
• Booking and order data (where applicable): billing details, order history, and information needed to arrange your trip, which may include passport details, dates of birth, and special requirements when these are necessary for travel arrangements.
• Payment-related data (where applicable): handled by our payment provider — see Section 6. We do not store full card numbers on our servers.
• Technical data: IP address, browser type, device information, and pages visited, collected through cookies and similar technologies — see Sections 8–9.
• Communication data: the content of emails, calls, or messages you exchange with us.

We only ask for the information we genuinely need to respond to you or to arrange your trip.

4. Contact forms and travel inquiries

When you submit a contact or inquiry form on the Website, we collect the details you provide (such as your name, email, phone number, and trip preferences) in order to:

• respond to your inquiry;
• prepare and send you a travel proposal;
• communicate with you about your request.

Form submissions are delivered to our email system and may be stored on the Website's hosting environment. We do not use your inquiry details for marketing unless you have separately opted in.

5. Orders and customer accounts

If you place an order or booking through the Website (operated via WooCommerce), we process the data needed to provide the service you have requested, including:

• your name, contact details, and billing information;
• details of the services ordered;
• any account information if you create a customer account;
• communications related to your order.

This data is used to process your order, arrange the travel services, issue any required documents and invoices, provide customer support, and comply with our legal obligations (such as tax and accounting requirements).

6. Payments

Online payments, where offered, are processed by [Payment Provider]. Your payment details are submitted directly to the payment provider through a secure connection and are processed under that provider's own terms and privacy policy. We do not store full payment card details on our servers.

We may retain limited payment-related records (such as transaction references and invoices) where required for accounting and legal purposes.

7. Email communication and newsletters

We use your email address to respond to your inquiries and to communicate about your bookings or proposals.

If you have given us your consent — for example, by ticking the optional newsletter box on a form — we may also send you occasional travel ideas and seasonal offers. You can withdraw this consent at any time by using the unsubscribe link in any marketing email or by contacting us at info@eightarrowstravel.com. Withdrawing consent does not affect service-related communication about your existing inquiries or bookings.

Where we use email marketing tools, these are listed under [Marketing Tools].

8. Cookies and similar technologies

Cookies are small text files stored on your device when you visit a website. We use cookies and similar technologies to make the Website work properly, remember your preferences, and — only with your consent — to measure how the Website is used and to support marketing.

When you first visit the Website, our cookie consent tool ([Cookie Consent Tool]) lets you accept or decline non-essential cookies and change your choices at any time. Strictly necessary cookies do not require consent because the Website cannot function without them.

A summary of the cookie categories we use is set out in Section 21 below.

You can also control or delete cookies through your browser settings. Restricting cookies may affect how parts of the Website work.

9. Analytics and marketing technologies

Where we use analytics services ([Analytics Tools]), they help us understand how visitors use the Website — for example, which pages are most visited — so we can improve it. Analytics cookies are set only with your consent.

Where we use advertising and remarketing technologies ([Marketing Tools]), they may set cookies or pixels to measure campaign performance or show you relevant advertising on other platforms. Marketing cookies are set only with your consent.

The specific tools in use at any time are listed in our cookie consent tool, where you can also manage your preferences.

10. Embedded content and third-party services

Pages on this Website may include embedded content from third parties — for example, maps, videos, or social media feeds. Embedded content behaves as if you had visited the third party's own website: these services may collect data about you, use their own cookies, and monitor your interaction with the embedded content, in accordance with their own privacy policies.

Where possible, such content is loaded only after you have given the relevant cookie consent.

11. Legal bases for processing

We process your personal data on the following legal bases under the GDPR:

• Performance of a contract (Art. 6(1)(b)): to respond to your inquiries, prepare proposals, and provide travel services you have requested.
• Legal obligation (Art. 6(1)(c)): to comply with tax, accounting, and other legal requirements.
• Consent (Art. 6(1)(a)): for marketing emails and non-essential cookies. You can withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)): to operate, secure, and improve the Website and our services, and to handle communications, where these interests are not overridden by your rights.

Where travel arrangements require special categories of data (for example, health or dietary requirements), we process them only as needed to arrange your trip and, where required, with your explicit consent.

12. Who we share your data with

We share personal data only where necessary and only with parties that help us provide our services:

• Travel service providers: cruise operators, accommodation providers, transport providers, and local partners, to the extent needed to arrange your trip.
• Service providers and processors: our website hosting provider, email services, [Payment Provider], [Analytics Tools], and [Marketing Tools], where used.
• Professional advisers and authorities: accountants, lawyers, and public authorities where required by law.

We do not sell your personal data.

13. International data transfers

Some of our service providers, or the travel suppliers involved in your trip, may be located outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place — such as an adequacy decision by the European Commission or the European Commission's Standard Contractual Clauses — or the transfer is necessary for the performance of your travel arrangements (Art. 49 GDPR).

14. How long we keep your data

• Inquiries that do not lead to a booking: kept for as long as needed to handle your request and for a reasonable period afterwards, then deleted.
• Bookings and orders: kept for the duration of the contract and afterwards for as long as required by tax, accounting, and other legal obligations.
• Marketing consents: kept until you withdraw consent or after a prolonged period of inactivity.
• Technical and cookie data: kept for the lifetimes shown in our cookie consent tool.

When data is no longer needed, we delete or anonymise it securely.

15. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS/SSL), access controls, secure hosting, and regular software updates. While no method of transmission or storage is completely secure, we work to protect your data against unauthorised access, loss, or misuse.

16. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten"), where applicable;
• Restrict processing in certain circumstances;
• Data portability — receive your data in a structured, commonly used format;
• Object to processing based on legitimate interests, and to direct marketing at any time;
• Withdraw consent at any time, without affecting processing carried out before withdrawal.

To exercise any of these rights, contact us at info@eightarrowstravel.com or [Privacy Email]. We will respond within one month, as required by the GDPR. We may need to verify your identity before acting on a request.

17. Right to complain to a supervisory authority

If you believe your personal data has been processed unlawfully, you have the right to lodge a complaint with a supervisory authority. In Greece, this is the Hellenic Data Protection Authority (HDPA) — www.dpa.gr. You may also contact the authority in the EU country where you live or work.

18. Children's data

The Website and our services are intended for adults. We do not knowingly collect personal data directly from children. Where a booking includes child travellers, their details are provided by a parent or guardian and are used only to arrange the trip.

19. Changes to this policy

We may update this policy from time to time — for example, when we introduce new services or tools. The latest version will always be published on this page, with the "Last updated" date shown at the top. Significant changes may also be highlighted on the Website.

20. Contact details

For any questions about this policy or your personal data:

Eightarrows Travel — [Legal Company Name]
[Business Address]
Email: info@eightarrowstravel.com
Privacy requests: [Privacy Email]
Phone: +30 694 947 2274

21. Cookie categories used on this Website

The table below summarises the categories of cookies used. The full, current list of individual cookies is available in our cookie consent tool ([Cookie Consent Tool]).