Last updated: 21 October 2026
This Privacy Policy explains how Orange Travel collects, uses and protects your personal data when you visit orange-travel.gr, book an excursion or contact us. We process personal data in accordance with the EU General Data Protection Regulation 2016/679 (GDPR) and Greek Law 4624/2019.
1. Data controller
Petra Pondelova, sole proprietorship trading as Orange Travel
Kato Gouves, 70014 Heraklion, Crete, Greece
VAT number (ΑΦΜ): 170299801 · G.E.MI.: 143432427000 · GNTO licence (ΜΗΤΕ): 1039E60000247301
Email: info@orange-travel.gr · Tel.: +30 2897 501640
For any question about your data, contact us at info@orange-travel.gr with the subject “Personal data”.
2. What data we collect
| Category | Data | Source |
|---|---|---|
| Booking data | Name, email, phone, address of stay / pickup point, number of adults and children, children’s age group, tour date, add-ons, special requests | You, through the booking form |
| Payment data | Card payments are processed directly by Stripe. We receive only the payment status, amount, the last 4 digits and the card brand. We never see or store your full card number. | Stripe |
| Contact data | Name, email, phone, message content | Contact form, email, phone |
| Newsletter | Email address, consent and subscription date | Newsletter form of our partner Book in Greece (Brevo), shown in our footer |
| Chat data | The messages you type in the Tour Assistant chat | You, through the chat window |
| Usage data | IP address, device and browser type, pages visited, clicks and scrolling, referral source | Cookies and similar technologies, only after your consent where required (see our Cookie Policy) |
Please do not share health information, payment details or other sensitive data in the chat or in free-text fields. If you tell us about a mobility or health need so that we can assist you on a tour, we use it only for that purpose and with your explicit consent.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Processing your booking, pickup and payment, sending confirmations and tour updates | Performance of a contract (6.1.b) |
| Answering enquiries through the contact form, email, phone or chat | Steps before a contract / legitimate interest in responding (6.1.b, 6.1.f) |
| Issuing invoices and receipts and keeping accounting records | Legal obligation (6.1.c) |
| Newsletter with hotel and villa deals, sent by our partner Book in Greece | Consent (6.1.a), which you can withdraw at any time via the unsubscribe link |
| Website statistics and improvement (Google Analytics 4, Microsoft Clarity) | Consent (6.1.a) through the cookie banner |
| Advertising and remarketing (Google Ads, Meta Pixel) | Consent (6.1.a) through the cookie banner |
| Website security, fraud prevention, legal claims | Legitimate interest (6.1.f) |
4. Who receives your data
We do not sell your personal data. We share it only with the following processors and partners, to the extent needed:
| Recipient | Role | Location / safeguard |
|---|---|---|
| VFM Host | Website hosting and backups | EU |
| Stripe Payments Europe Ltd | Card payment processing | EU / USA – EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs) |
| OpenAI (ChatGPT) | Powers the Tour Assistant chat | USA – DPF / SCCs |
| Make (Celonis) | Automation that forwards booking and form data to our internal systems | EU |
| Book in Greece (TAVLARIDOU MARIA TAVLARIDIS THEODOSIOS IKE), using Brevo (Sendinblue SAS) | Separate controller for the newsletter you subscribe to through the form in our footer; see the Book in Greece privacy policy | EU |
| Google Ireland Ltd | Analytics (GA4), advertising (Google Ads), maps, video (YouTube) | EU / USA – DPF |
| Meta Platforms Ireland Ltd | Advertising measurement (Meta Pixel) | EU / USA – DPF |
| Microsoft Ireland Operations Ltd | Session analytics (Clarity) | EU / USA – DPF |
| Vimeo | Embedded videos | USA – DPF / SCCs |
| Tour guides, drivers, boat operators and other local partners | Carrying out the excursion you booked (name, number of guests, pickup point, phone) | Greece |
| Accountants, tax and public authorities | Legal and tax obligations | Greece |
5. How long we keep your data
- Booking and invoicing data: for as long as Greek tax law requires, normally 5 years from the end of the tax year, or longer if a legal claim is pending.
- Enquiries and chat messages: up to 12 months after our last communication.
- Newsletter data: until you unsubscribe.
- Analytics and advertising data: according to the cookie durations listed in our Cookie Policy; Google Analytics data is kept for 14 months.
6. Your rights
You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interest, and to withdraw your consent at any time without affecting earlier processing. You can change your cookie choices at any time through the “Cookie settings” link in the footer.
To exercise your rights, email info@orange-travel.gr. We will reply within one month. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr, Kifissias 1-3, 11523 Athens, complaints@dpa.gr).
7. Security
The website uses an encrypted HTTPS connection. Card payments are handled by Stripe, a PCI-DSS Level 1 certified provider. Access to booking data is limited to authorised staff and partners who need it to provide the service.
8. Minors
Bookings can be made only by adults (18+). Data about children travelling with their parents or guardians is limited to what is needed for the booking (number and age group).
9. Changes
We may update this policy when our services or the law change. The date at the top shows the latest version.