1. Who we are

"Explore with Vasilis" (the "Website") is operated by Vasilis Kaltsidis ("we", "us", "the data controller"), based at Tsouredon 7, Chania 731 32, Greece. You can contact us at [email protected] or +30 693 761 0014. This Privacy Policy applies to all visitors to this Website, regardless of where they live — not only to residents of the European Economic Area — because we, the data controller, are established in Greece and are subject to the EU General Data Protection Regulation (GDPR) and Greek Law 4624/2019.

2. What personal data we collect

•Automatically, when you visit the Website: IP address, browser type, device/OS information, approximate location derived from your IP address, pages viewed, referring website, and cookie identifiers (see Section 6).

•Data you provide directly: when you use the contact form, or contact us by phone or email, we collect your name, email address, phone number, travel dates, and the content of your message, including any preferences, group size, or special requests you share with us.

3. Why we process your data, and our legal basis

Responding to your enquiry and preparing a tour, accommodation, or transportation proposal — data used: Name, email, phone, message content, travel details. legal basis: Steps taken at your request prior to a contract, and/or our legitimate interest in responding to enquiries (GDPR Art. 6(1)(b)/(f)).

Fulfilling a confirmed booking — data used: Same as above. legal basis: Performance of a contract (Art. 6(1)(b)).

Keeping the Website secure and diagnosing technical issues — data used: Device information, IP address. legal basis: Legitimate interest (Art. 6(1)(f)).

Non-essential cookies (analytics/marketing) — only if you use them, see Section 6 — data used: Cookie identifiers, browsing behaviour. legal basis: Your consent (Art. 6(1)(a)).

Bookkeeping and tax compliance once you become a paying customer — data used: Name, contact details, invoice data. legal basis: Legal obligation (Art. 6(1)(c)).

4. Who we share your data with

We do not sell your personal data. We may share it with:

• Trusted service providers who help us operate the Website and our business (e.g. our hosting provider, Hostinger; our email provider), acting as our data processors;

• Accommodation providers, car rental companies, or other travel partners, but only when you have asked us to arrange a booking with them, and only the details necessary to complete that booking;

• Public authorities, where required by law.

5. International data transfers

Your data is stored on servers located within the European Economic Area, and no international transfer takes place.

6. Cookies

The Website uses only cookies that are strictly necessary for it to function correctly (e.g. to remember your language or basic session settings). These do not require your consent.

7. How long we keep your data

• Contact form enquiries that do not lead to a booking: up to 12 months from your last contact, then deleted.

• Confirmed bookings and related correspondence: for the duration of our relationship, plus 5 years for tax and accounting records. • Automatically collected technical/log data: up to 12 months.

8. Your rights

Under the GDPR, you have the right to: be informed about how we process your data; access the data we hold about you; request correction of inaccurate data; request erasure; request restriction of processing; receive your data in a portable format; object to processing based on our legitimate interest; and not be subject to solely automated decision-making. We do not use automated decision-making or profiling on this Website. To exercise any of these rights, contact us at [email protected]. We will respond within one month. If you are not satisfied with our response, you have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, Greece — www.dpa.gr — or with the supervisory authority in your own country of residence.

9. Children

This Website is not directed at children under the age of 16, and we do not knowingly collect personal data from children.

10. Security

We take reasonable technical and organizational measures to protect your data against unauthorized access, loss, or disclosure. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

11. Links to other websites

Our Website may link to third-party websites, including social media and travel-partner websites. We are not responsible for the privacy practices of those websites, and encourage you to review their own privacy policies.

12. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date below reflects the most recent version.

13. Contact us

Explore with Vasilis — Τσουδερών 7, Chania 731 32, Greece — Phone: +30 693 761 0014 — Email: [email protected]