Santorini Yachting Cruises
Geniki Touristiki EPE
Last updated: 14 October 2026

1 Who we are

Geniki Touristiki EPE, trading as Santorini Yachting Cruises (we, us or our), is the controller responsible for the personal data described in this policy. This policy explains how we collect, use, share and protect personal data when you visit our website, contact us, book a cruise or travel with us, and describes your data protection rights.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation or GDPR), Greek Law 4624/2019 and other applicable data protection and electronic communications legislation.

Privacy contact: Geniki Touristiki EPE, Santorini Yachting Cruises
Contact address: 25is Martiou, Thira 847 00, Santorini, Greece
Email: info@santoriniyachtingcruises.com
Telephone: +30 22860 36935
Website: www.santoriniyachtingcruises.com

2 Personal data we collect

We collect only the data needed for the relevant service or purpose. Depending on your interaction with us, this may include:

Contact and booking information: your name, email address, telephone or WhatsApp number, booking reference, cruise date, group size, correspondence and special requests. For transfers, we may collect your hotel or accommodation name, pickup location and relevant arrival or departure details.

Passenger information: names, dates of birth or ages, nationality and identity document details where required for passenger lists, maritime obligations or identity checks. We request document copies only where necessary and supported by an appropriate legal basis.

Payment and invoice information: billing details, tax information where required, payment references, transaction amounts, refund details and bank account information where needed. The precise card data handled by us and by payment providers depends on the payment method.

Dietary and assistance information: food preferences, allergies, accessibility needs or relevant health information that you choose to provide so we can consider your request and arrange appropriate assistance. Allergies and some dietary or assistance information may reveal health, religious or other special category data.

Technical information: IP address, browser and device information, security logs and information about website use. Cookies and similar technologies may collect additional information, subject to your choices and applicable consent requirements.

Marketing preferences and feedback: your consent choices, subscription preferences, complaints and feedback. If we wish to use identifiable guest photographs or videos for promotional purposes, we will explain that use and obtain appropriate permission separately.

3 How we obtain personal data

We obtain data directly from you through bookings, forms, email, telephone, messaging services, social media and in-person contact. We may also receive relevant booking and passenger information from travel agents, hotels, online booking platforms, transfer partners or the person organising your group booking.

If you provide information about other passengers, please ensure you are entitled to share it and give them this policy. Where information concerns a child, it should be supplied by, or with the authority of, a parent or guardian. Special category information requires an appropriate legal basis in addition to any authority to make a booking.

Where we receive your data indirectly, we provide the information required by Article 14 GDPR within the applicable time limits, unless a lawful exception applies, and can explain the source and categories of data on request.

4 Why we use data and our legal grounds

Bookings and enquiries: we use necessary contact, booking and payment information to answer requests, enter into contracts, administer bookings, communicate service information and manage payments, changes and refunds. Our basis is Article 6(1)(b) GDPR where you are the contracting customer. For companions and other passengers who are not parties to the contract, necessary operational processing may rely on our legitimate interests in organising and delivering the booked service, subject to their rights, or on a relevant legal obligation.

Cruise operations and transfers: we use necessary passenger and pickup information to organise sailing, catering, transfers and customer assistance. The basis is performance of a contract where applicable, legitimate interests in providing and coordinating the service for other passengers, or compliance with a relevant legal obligation.

Legal compliance: we process information required for passenger records, port or maritime authority requirements, accounting, taxation and lawful authority requests under Article 6(1)(c) GDPR. We identify the applicable obligation when requesting mandatory information.

Dietary and health requests: where special category data are needed to accommodate a request, we normally seek your explicit consent under Article 9(2)(a), together with an applicable Article 6 basis. You may withdraw consent at any time, although we may then be unable to accommodate the request. In an emergency, vital interests may apply under Articles 6(1)(d) and 9(2)(c) where the legal conditions are met.

Security and claims: we may process necessary records to prevent fraud, protect our systems, handle complaints and establish, exercise or defend legal claims. Our basis is our legitimate interests in protecting customers and the business, balanced against your rights, or a legal obligation where applicable. Special category data used for legal claims require an additional condition such as Article 9(2)(f).

Marketing: we send promotional email or messages with your consent unless a specific applicable existing-customer exception permits this with an easy opt-out. You can unsubscribe or object to direct marketing at any time. Necessary booking and service messages are separate from promotional messages.

Optional analytics and advertising: where consent is required, we use these technologies only after consent. See section 7 for website choices.

5 When information is required

We explain whether requested information is required by law, necessary for your booking or optional. Without essential booking, payment, passenger or safety information, we may be unable to confirm your booking or carry you on a cruise. Optional marketing consent is not a condition of booking.

6 Who receives your information

We share relevant information only where necessary with authorised reservation and operational staff, captains and crew; transfer providers; booking and technology service providers; payment providers and banks; accountants, legal advisers and insurers; and competent port, maritime, tax, law enforcement or other public authorities where legally required or otherwise lawfully justified.

Service providers acting as our processors receive appropriate contractual instructions and safeguards. Some recipients, including banks, booking platforms and public authorities, may act as independent controllers under their own privacy notices. We do not sell your personal data.

Where personal data are transferred outside the European Economic Area, we ensure a lawful transfer mechanism applies, such as a European Commission adequacy decision or appropriate safeguards including Standard Contractual Clauses, with additional measures where necessary. You can contact us for information about the safeguards relevant to your data and how to obtain a copy, subject to lawful redactions.

7 Cookies and third party services

Our website may use cookies and similar technologies for essential functions, preferences, analytics or advertising. Technologies that are not strictly necessary are activated only with consent where required by law. You may accept or reject optional categories and change your choices through the website cookie settings. Browser settings may also help manage cookies.

For information about the cookies used on our website, including their providers, purposes and durations, please consult the cookie information provided on the website or contact us.

External booking pages, payment pages, social media and other linked services have their own privacy policies. Our policy applies to our processing; please also read the relevant provider notices.

8 How long we keep information

We retain personal data only for as long as necessary for the purpose for which it was collected, taking account of legal obligations and relevant limitation periods. The criteria below determine the relevant retention period.

Booking and correspondence records are retained for the period needed to administer the booking, resolve queries and manage related claims. Passenger lists and statutory maritime records are retained for the period required by the applicable obligation. Invoice and accounting records are retained for the applicable tax and accounting retention period.

Dietary and assistance details are kept only for the period needed to accommodate your request, unless a specific legal or claims requirement justifies longer retention. Marketing details are kept until you withdraw consent or object, subject to periodic review; a minimal suppression record may be retained to respect your opt-out. Cookie and technical records follow the durations stated in the cookie notice or the relevant security retention schedule.

Where a dispute, investigation or legal requirement justifies longer retention, relevant records may be preserved for that purpose. When retention is no longer justified, we securely delete or anonymise the information.

9 How we protect information

We apply technical and organisational measures appropriate to the nature of the data and the risks involved, including limiting access to authorised people, confidentiality requirements and safeguards for storage, sharing and disposal. No internet transmission or storage system can be guaranteed completely secure.

Where a personal data breach occurs, we assess it and notify the competent authority and affected individuals where required by law. If you suspect misuse of your booking or payment information, please contact us promptly using the contact details in this policy.

10 Children and family bookings

Our website is intended for adults arranging travel. Children may travel on our cruises, and we may process their passenger information where needed to deliver the service, meet legal obligations or arrange appropriate assistance. Parents, guardians and group organisers should supply only the information necessary for these purposes. We do not knowingly collect children’s information for direct marketing.

11 Your rights

Subject to the conditions and exceptions in the GDPR, you may request access to your data and a copy; correction of inaccurate or incomplete information; erasure; restriction of processing; and portability of data you have provided where processing is automated and based on consent or contract.

You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing, including related profiling, at any time. Where processing relies on consent, you may withdraw it at any time without affecting processing lawfully carried out before withdrawal.

To exercise your rights, email info@santoriniyachtingcruises.com. We may request proportionate information to verify your identity. We normally respond within one month of receiving your request. Where legally permitted because of complexity or the number of requests, we may extend this by up to two further months and will inform you within the first month, explaining why. Requests are normally free; a reasonable fee or refusal may apply to manifestly unfounded or excessive requests as permitted by law.

You may complain to the Hellenic Data Protection Authority at www.dpa.gr or to another competent supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement. For complaints about the handling of a rights request, the Hellenic Authority generally requires you to exercise the relevant right with the controller first. Its website explains the complaint procedure.

12 Policy updates

We may update this policy to reflect changes in our services, practices or legal requirements. The version date will appear at the beginning of the policy, and material changes will be communicated where required. Changes to this policy do not replace consent where fresh consent is needed.