Privacy & Cookies Policy

The data controller for the personal data described in this policy is:

• [TO CONFIRM: legal entity name of the data controller / contracting party (live site: member of the Mykonos Concierge Group)], trading as Athens Luxury Cars
• Registered office: [TO CONFIRM: registered office address]
• G.E.MI. number: [TO CONFIRM: G.E.MI. number]
• VAT number: [TO CONFIRM: VAT number and tax office]
• Rental office: [TO CONFIRM: rental office address (live site: 30 B Artemidos Street, Kantza 153-51, near Athens International Airport)]
• Mobile: +30 6936 521171
• Email: info@athensluxurycars.com

Data Protection Officer

Data Protection Officer: [TO CONFIRM: Data Protection Officer name, or confirm that no DPO is appointed]. For any question about your personal data, please email [TO CONFIRM: privacy contact email (live site shows dpo@athensluxurycars.com, links to info@athensluxurycars.com)].

This policy applies to our website www.athensluxurycars.com, our enquiry forms, our online booking [TO CONFIRM: name of the online booking platform and any customer area, once integrated] and our communication with you about enquiries, rentals, transfers and chauffeur services.

Our website contains links to other websites, such as our partner companies and social networks. Those websites have their own privacy policies, and we are not responsible for how they process personal data.

When you book a vehicle

• Identity and contact details, such as your name, email address, telephone number and address.
• Booking details, such as vehicle category, rental dates and times, pick-up and return locations, extras and special requests.
• Arrival and delivery details, such as flight or ferry details and the name and address of your hotel or residence.
• Driver details needed to check the rental conditions, such as date of birth or age, and driving licence details for every declared driver.
• Copies of driving licence and identity documents [TO CONFIRM: whether documents are uploaded online or only presented at pick-up].
• Payment and transaction details related to your booking.
• Details of the rental itself, such as the rental agreement, the condition of the vehicle and any accident or damage reports.

When you send an enquiry

Through our contact form we collect your first and last name, email address, telephone number (optional), subject and message.

Through our transfer, chauffeur, armored car, wedding car and car rental request forms we collect your name, email address and telephone number, and the details of the service you ask about, such as the service type, vehicle preference, date and time, pickup location, destination, number of passengers and any message you add. The car rental request form also asks for your address and city and country.

When you email, call or message us, we receive the details you choose to give us.

When you visit our website

Like most websites, our website and the services embedded in it receive technical data needed to deliver the pages, such as your IP address, browser type and the pages requested. Our hosting provider’s servers may record such data in technical logs for operation and security.

We use personal data only for the purposes below. The legal bases are those of Article 6(1) of the General Data Protection Regulation (EU) 2016/679 (GDPR).

You do not have to provide personal data, but without the details needed for a booking we cannot provide the rental or service.

Messages sent through our forms are delivered by email to our team so that we can answer you [TO CONFIRM: form delivery method and recipient mailbox; the forms are not yet connected].

To prevent abuse, the website may keep a short-lived record of submissions to limit repeated messages [TO CONFIRM: anti-abuse record and how long it is kept].

An enquiry is not a reservation: we use it to check availability and prepare a quotation.

The forms are protected by Cloudflare Turnstile (see “Service providers and embedded content”).

Online bookings are made through our booking platform [TO CONFIRM: booking platform, its provider and any customer area for managing a reservation]. The data you enter there is used to manage your booking, your change requests and your rental.

Your booking details are shared within our team only as needed to prepare, deliver and collect your vehicle [TO CONFIRM: whether a CRM or other customer system is used].

Online payments are processed by the payment service provider shown at checkout, which acts under its own terms and privacy policy. We receive the information needed to confirm and reconcile your payment [TO CONFIRM: payment methods and providers; the previous site described PayPal and myPOS].

We do not ask you to send card details by email or through our enquiry forms.

Payments made when you collect the vehicle are recorded for our accounting and legal obligations.

[TO CONFIRM: whether newsletters or promotional emails are sent, and with which service]. We send marketing emails only with your consent. Every marketing email contains an unsubscribe link, and you can withdraw your consent at any time without affecting the lawfulness of earlier processing.

We share personal data only with service providers that help us run our website and services, with partners who carry out a service you have booked, with public authorities where the law requires it, or where it is necessary to establish or defend legal claims. We do not sell personal data.

Hosting

Our website and company email are hosted by [TO CONFIRM: hosting provider and server location for the website and company email].

Technical provider

Our website is developed and maintained by Brainart Creative Technologies, which may access personal data only as needed to provide technical support.

Cloudflare Turnstile

Our enquiry forms use Cloudflare Turnstile (Cloudflare, Inc.) to check that messages are sent by people and not by automated programs. When a form loads, Turnstile receives technical information from your browser, such as your IP address. This is used for security purposes, in our legitimate interest in protecting our forms.

Google Maps

The map on our contact page is provided by Google Maps (Google Ireland Limited). When the map loads, your browser connects to Google’s servers, which receive your IP address and may set cookies under Google’s privacy policy [TO CONFIRM: whether the map should load only after consent].

Google Reviews (Elfsight)

Our homepage shows Google reviews through a widget provided by Elfsight. When the widget loads, your browser connects to Elfsight’s servers, which receive technical data such as your IP address. Reviewer photos are delivered through Elfsight from Google’s servers.

Fonts

The fonts used on our website are served from our own website, so no font service receives your data.

Payment providers

See “Payments” above.

Cookies are small files that a website stores on your device. Similar technologies, such as local storage, work in a comparable way. Some are necessary for a website to work; others are optional and are used only with your consent.

Consent management

[TO CONFIRM: consent management platform and how visitors record their choices]. Optional cookies and third-party content that require consent should not be loaded until you agree.

Categories

• Necessary: needed for the website and its security to work, such as protecting our enquiry forms. These cannot be switched off.
• Functional: optional content provided by third parties, such as the Google Maps map on our contact page and the reviews widget on our homepage.
• Analytics and advertising: our website does not currently use analytics or advertising cookies.

According to Elfsight, its reviews widget may use a cookie named “elfsight_viewed_recently”, which lasts 15 seconds and is used to count widget views.

Managing your choices

You can delete or block cookies in your browser settings; some parts of the website may then not work as intended.

Our website and company email are hosted in [TO CONFIRM: hosting country]. Some of the services described above are provided by companies based outside the European Economic Area, for example in Andorra (Elfsight) and the United States (Cloudflare, Google). When using these services involves a transfer of personal data outside the European Economic Area, the transfer must be covered by one of the safeguards of Chapter V GDPR, such as an adequacy decision of the European Commission or standard contractual clauses. You can contact us for more information.

We keep personal data only for as long as needed for the purposes described in this policy:

• Booking and rental records: for the duration of the rental and afterwards for as long as required by tax, accounting and other legal obligations, or as needed to deal with claims.
• Enquiries: for as long as needed to answer you and deal with any follow-up.
• Marketing emails: until you unsubscribe.
• Anti-abuse records of the enquiry forms: [TO CONFIRM: retention period].

We use appropriate technical and organisational measures to protect personal data, such as encrypted connections (HTTPS) and protection of our enquiry forms against automated abuse. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.

Under the GDPR you have the right to:

• access your personal data and receive a copy of it;
• have inaccurate data corrected;
• have your data erased, where the law allows it;
• restrict the processing of your data;
• receive the data you have provided in a structured, machine-readable format (data portability);
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting processing carried out before the withdrawal.

To exercise your rights, email us at [TO CONFIRM: privacy contact email (live site shows dpo@athensluxurycars.com, links to info@athensluxurycars.com)]. We may need to confirm your identity before responding. We reply within the time limits set by the GDPR, normally within one month.

Right to complain

You also have the right to lodge a complaint with a supervisory authority. In Greece, this is the Hellenic Data Protection Authority (www.dpa.gr).

Our services are intended for adults. Drivers must meet the minimum age in our Booking Terms [TO CONFIRM: minimum driver age]. We do not knowingly collect personal data from children through our website.

We may update this policy, for example when we introduce a new service. The current version is always published on this page, with the date of the latest update.

For questions about this policy, email [TO CONFIRM: privacy contact email (live site shows dpo@athensluxurycars.com, links to info@athensluxurycars.com)], call +30 6936 521171 or use our contact page. Our booking conditions are set out in our Booking Terms & Conditions.