Privacy Policy

This policy explains what personal data Rethymno Tours collects through this website, why, and what you can do about it. Rethymno Tours and Way to Crete are trading names of the same licensed Greek tour operator, referred to below as "the Company", which is the controller of the data described here.

Personal data is processed in accordance with the General Data Protection Regulation (GDPR 2016/679) as applicable, any specific national and European legislation covering particular areas, current Greek data protection law, the law on personal data and privacy in electronic communications (Law 3471/2006 as applicable), and the decisions of the Hellenic Data Protection Authority (HDPA).

What counts as personal data

Personal data is any information relating to a data subject — a natural person whose identity is known or can be established. It includes, for example, a name, an address, a date of birth, a mobile number and an email address, as well as usage data such as an IP address.

What we collect, and when

Browsing this website does not require you to give us any personal information. There is no account to register for, no newsletter sign-up, and no advertising or analytics tracker on these pages.

We collect personal data at three points, and only what each one needs.

When you send an enquiry or booking request

Our enquiry, tour request, transfer request and trade forms ask for:

• your name and email address, which are required so we can reply;
• optionally your phone number, your hotel or villa in Crete, the date and time you have in mind, the number of guests, flight details for a transfer, your company name on the trade form, and anything you write in the message field.

What you submit is sent to our own inbox as an email so a member of the team can answer it. We do not build a customer profile from it and this website keeps no database of enquiries.

We never ask for card or payment details on this website. Where a payment is taken it happens through our booking provider or by bank transfer arranged directly with the team, and the card details are handled by that provider, not by us.

When you use the chat assistant

Messages you type into the on-site chat are sent to an AI provider so a reply can be generated. Please do not put anything sensitive into it — for anything personal, email or WhatsApp us instead.

When you save a tour

Tours you save with the heart icon are stored in your own browser, on your own device. That list is never transmitted to us and we cannot see it. Clearing your browser data deletes it.

Server logs

Our hosting provider keeps standard technical logs of requests to this site, including IP addresses, for security and reliability. That is ordinary infrastructure logging, not tracking, and we do not use it to identify visitors.

Why we process it

We process your data to handle your enquiry and your booking, to communicate with you about it, to improve the service we provide, and to run whatever service you gave the data for — including messages about the progress of your request or trip.

Providing the data marked as required is necessary for us to perform the contract; without it we cannot answer or fulfil a request. If you choose not to give it, you may not be able to use that particular service or feature.

The Company handles personal data in line with European legislation, Regulation (EU) 2016/679, and other applicable local law on the storage, processing, access and transfer of personal data. We collect data about you only if you choose to give it to us.

Who else sees it

We do not share personal data with third parties for their own commercial use. Data is not disclosed to third parties unless the law or a court decision permits or requires it.

We do use service providers who process data strictly on our behalf, as processors, to make the site work: our hosting provider, our transactional email provider, the AI provider behind the chat assistant, and our booking and availability provider. Each is bound to process the data only on our instructions.

Access to this website by minors requires the consent of a parent or guardian, and no disclosure of a minor's personal data is required to use it.

Cookies and embedded content

This site sets no advertising cookies, no analytics cookies and no tracking pixels of its own. That is why you are not asked to accept any.

It does use your browser's own storage for one thing: the list of tours you have saved with the heart icon. That list stays in your browser, is never sent to us, and disappears when you clear your site data.

The contact page can show a Google Maps view of where we are. It is not loaded until you press the button, because loading it hands Google your IP address and lets it set its own cookies in your browser. Pressing the button is your consent to that; the address, the coordinates and the directions link work whether you press it or not. Once the map is showing, Google's own privacy policy applies to it, not ours.

The same is true of every outbound link on this site — Google, Tripadvisor, WhatsApp and waytocrete.com. Follow one and you are on someone else's site under their terms.

Your rights

Processing of user and visitor data stays confidential and is carried out only by staff of the Company with the appropriate professional qualifications and the technical security measures needed to keep it private. You have the right to be informed about the processing of your personal data.

As a data subject you may exercise at any time the rights set out in the General Data Protection Regulation (EU) 2016/679, in particular Articles 12 to 23, and in national law, including but not limited to:

1. the right to information about, and access to, the data the Company processes;
2. the right to restrict processing of your data;
3. the right to rectify or erase part or all of your data (the right to be forgotten);
4. the right to object;
5. the right to data portability.

To exercise any of them, write to us at the email address on our contact page. If you believe your data has been handled improperly you may also complain to the Hellenic Data Protection Authority.

How long we keep it

Enquiry and booking correspondence is kept until your request or trip has been completed and for as long afterwards as Greek tax and accounting law requires us to retain records of the transaction. Data processed on the basis of your consent is kept until you withdraw that consent. You can ask us to delete your data at any time, subject to those legal retention obligations.

Consent

By using the services on this website in accordance with its terms of use, you consent to this privacy policy.