Privacy Policy

1. Who we are

Greeko is a bespoke Greek holiday planning service operated as a commercial travel business with a social and environmental purpose. Bookings are ABTA/ATOL protected via our booking agent InteleTravel UK (ABTA No. P7384/Y6792).

For the purposes of data protection law, Greeko is the data controller of the personal information you provide to us. If you have any questions about this policy or how we handle your data, please contact us at [email protected].

2. What personal data we collect

We collect personal data in the following ways:

• Enquiry and contact forms — your name, email address, phone number, and any details you share about your holiday requirements.
• Holiday planning tool (Eleni) — the questions you ask and the itinerary preferences you share during a planning session.
• Newsletter sign-up — your email address and, optionally, your name.
• Booking information — travel dates, passenger details, and payment information processed securely by our booking agent InteleTravel UK.
• Website usage data — pages visited, time on site, and device/browser information collected via analytics tools (see Section 6).

3. How we use your data

We use your personal data to:

• Respond to your holiday enquiries and provide bespoke travel planning advice.
• Process and manage your holiday booking through InteleTravel UK.
• Send you relevant travel inspiration, destination guides, and offers — only where you have given consent or we have a legitimate interest to do so.
• Improve our website, services, and the Eleni AI planning tool.
• Comply with our legal and regulatory obligations as a travel business.

4. Legal basis for processing

We process your personal data on the following legal bases under UK GDPR:

• Contract — processing necessary to fulfil a holiday booking or respond to a pre-booking enquiry.
• Legitimate interests — improving our services, sending relevant travel content to existing customers, and operating our business securely.
• Consent — marketing emails to new subscribers, and the use of non-essential cookies.
• Legal obligation — retaining booking and financial records as required by law.

5. Who we share your data with

We do not sell your personal data. We may share it with:

• InteleTravel UK — our ABTA/ATOL-protected booking agent, to process and manage your holiday.
• Greek accommodation and transport partners — hotels, ferry operators, and car rental companies, solely to fulfil your booking.
• Technology providers — including our website hosting provider, email delivery service, and analytics platform, all of whom process data on our behalf under data processing agreements.
• Regulatory authorities — where required by law, such as HMRC or ABTA.

6. Cookies and analytics

Our website uses cookies to improve your experience and to understand how visitors use the site. We use:

You can manage your cookie preferences at any time via the cookie banner on our site.

• Essential cookies — required for the site to function correctly. These cannot be disabled.
• Analytics cookies — we use Google Analytics 4 to understand page performance and visitor behaviour. These are only set with your consent.

7. How long we keep your data

• Enquiry data — retained for up to 2 years from the date of your last contact, unless a booking is made.
• Booking data — retained for 7 years to comply with financial and regulatory requirements.
• Marketing data — retained until you unsubscribe or withdraw consent.
• Analytics data — aggregated and anonymised; individual session data is retained for 14 months by Google Analytics.

8. Your rights

Under UK GDPR you have the right to:

To exercise any of these rights, email us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your data where there is no lawful reason to retain it.
• Restriction — ask us to limit how we use your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests, including direct marketing.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.

9. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. All data is transmitted over encrypted HTTPS connections. Payment data is processed exclusively by InteleTravel UK and is never stored on our systems.

10. International transfers

Some of our technology providers (including Google Analytics) may process data outside the UK or EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the ICO.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. We encourage you to review this page periodically.