This Privacy Policy explains how Zacharoula (Charis) Kavvada, licensed tourist guide operating under the trade name The Acropolis Treasure Hunt (“we”, “our” or “I”), collects, uses, stores and protects the personal data you provide when using this website or booking our services.

This policy is compliant with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation — GDPR) and with Greek Law 4624/2019 implementing the GDPR at national level.

We encourage you to read this document carefully. By using our website or submitting a booking inquiry, you acknowledge that you have read and understood this policy.

1. Data Controller

Name: Zacharoula (Charis) Kavvada
Trade name: The Acropolis Treasure Hunt
Address: Athens, Greece
Email: info@theacropolistreasurehunt.com
Telephone: +30 6944 176 555
For any questions relating to the processing of your personal data, please contact us at the above details.

2. What Personal Data We Collect

We collect only the personal data that is necessary to provide our services. This includes:

2.1 Data you provide directly through our booking inquiry form:
• Full name
• Email address
• Mobile telephone number
• Preferred tour date and time
• Number of participants (adults, teenagers, children)
• Tour or experience selected
• Any special requirements, accessibility needs or preferences you choose to share

2.2 Data collected automatically when you visit our website:
• IP address
• Browser type and version
• Pages visited and time spent on each page
• Referring website or search query
• Device type and operating system

2.3 Data collected through third-party communication channels:
• If you contact us via WhatsApp or email directly, we collect the content of that communication and any personal data contained within it.
We do not collect sensitive personal data (such as health information, religious beliefs or payment card details) unless you voluntarily provide it in a special requirements field, in which case it is processed solely to accommodate your needs during the tour.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 of the GDPR:

Contract performance (Article 6(1)(b)): Processing your name, contact details, tour preferences and group composition is necessary to respond to your inquiry, confirm your booking and deliver the service you have requested.

Legitimate interests (Article 6(1)(f)): We process website usage data to maintain the security and performance of our website and to understand how visitors interact with our content.

Legal obligation (Article 6(1)(c)): We may be required to retain certain records for tax, accounting or regulatory purposes under Greek law.

Consent (Article 6(1)(a)): Where we send you promotional communications or use non-essential cookies, we will ask for your explicit consent beforehand. You may withdraw consent at any time.

4. How We Use Your Personal Data

We use your personal data exclusively for the following purposes:
• To respond to your booking inquiry and confirm your tour or experience
• To communicate with you before, during and after your tour regarding logistics, timing and any changes
• To personalise your experience based on your group composition and any special requirements
• To issue invoices or receipts where required
• To comply with our legal and regulatory obligations as a licensed tourist guide in Greece
• To improve the functionality and content of our website
• To send you promotional information about our tours and services, only where you have given explicit consent
We will never use your personal data for automated decision-making or profiling.

5. Data Retention

We retain your personal data only for as long as is necessary for the purposes for which it was collected:

• Booking inquiry data: retained for 12 months from the date of inquiry, or for the duration of our service relationship
• Financial and invoicing records: retained for 10 years in accordance with Greek tax law (Law 4308/2014)
• Website usage data: retained for a maximum of 26 months
• Communication records (email, WhatsApp): retained for 24 months from the date of last communication
Once the retention period has expired, your data is securely deleted or anonymised.

6. Who We Share Your Data With

We do not sell, rent or trade your personal data to any third party.

We may share your data with the following categories of recipients, strictly on a need-to-know basis:

Service partners: Trusted partner drivers or activity specialists involved in delivering your experience. These partners are contractually bound to process your data only for the purpose of delivering the agreed service and in compliance with the GDPR.

Technology providers: Our website host, email service provider and booking form provider. These are processors acting on our behalf under data processing agreements.

Legal and regulatory authorities: Where we are required by law to disclose information to Greek or EU authorities.
Where data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place in accordance with Chapter V of the GDPR.

7. Cookies

Our website uses cookies — small text files stored on your device — to ensure the website functions correctly and to understand how it is used.

We use the following categories of cookies:

Strictly necessary cookies: Required for the website to function. These cannot be disabled.
Analytics cookies: Used to understand visitor behaviour and improve our website (e.g. Google Analytics). These are only activated with your consent.
Preference cookies: Used to remember your language or other settings.
You can manage your cookie preferences at any time through your browser settings or our cookie consent tool. Please note that disabling certain cookies may affect the functionality of the website.

8. Your Rights Under the GDPR

As a data subject, you have the following rights under the GDPR, which you may exercise at any time by contacting us at info@theacropolistreasurehunt.com:

Right of access (Article 15): You have the right to request a copy of the personal data we hold about you.
Right to rectification (Article 16): You have the right to request correction of inaccurate or incomplete data.
Right to erasure (Article 17): You have the right to request deletion of your personal data, subject to our legal obligations.
Right to restriction of processing (Article 18): You have the right to request that we limit the processing of your data in certain circumstances.
Right to data portability (Article 20): You have the right to receive your data in a structured, commonly used and machine-readable format.
Right to object (Article 21): You have the right to object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent (Article 7(3)): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

We will respond to all requests within 30 days. If we are unable to comply, we will explain why.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA):
• Website: www.dpa.gr
• Address: Kifissias 1-3, 115 23 Athens, Greece
• Telephone: +30 210 6475 600
• Email: contact@dpa.gr

9. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction or alteration.

These measures include:
• SSL/TLS encryption on all data transmitted through our website
• Password-protected access to systems containing personal data
• Restricted access to personal data on a need-to-know basis
• Regular review of our data handling practices
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the HDPA within 72 hours and inform you without undue delay, in accordance with Articles 33 and 34 of the GDPR.

10. Children’s Data

Our tours welcome participants of all ages, including children. Where a booking includes minors, we collect information about the number of children in the group solely to plan and adapt the experience appropriately.

We do not collect personal data directly from children. All data relating to a group including minors is provided by the adult responsible for the booking, who confirms they have the authority to do so.

11. Third-Party Links

Our website may contain links to third-party websites, including booking platforms such as ToursByLocals. We are not responsible for the privacy practices of these external sites and encourage you to read their privacy policies before submitting any personal data.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations or regulatory requirements. The date at the top of this document indicates when it was last revised.

We encourage you to review this policy periodically. Where changes are material, we will make reasonable efforts to notify you.

13. Contact

For any questions, requests or concerns relating to this Privacy Policy or the processing of your personal data, please contact:

Zacharoula (Charis) Kavvada
Email: info@theacropolistreasurehunt.com
Telephone: +30 6944 176 555
Website: www.theacropolistreasurehunt.com

We aim to respond to all enquiries within 5 working days.

This document was prepared for review by a qualified legal professional before publication.
© 2026 Zacharoula Kavvada — The Acropolis Treasure Hunt. All rights reserved.