This document describes our policy regarding the personal data we collect from visitors to our pages (hereinafter “users”).

The Data Controller is the company CHRYSIKOS ILIAS & CO. LP, trading as PRIORITY TRAVEL & TOURISM, established in Athens, 5 Sofokleous Street, 10559, VAT No. 800355730, Tax Office A’ Athens, e-mail: info@prioritytravel.gr (the “Data Controller”).

In the daily activities of our business and our website, we process data relating to natural persons, including:

• Clients
• Visitors to our website
• Other interested parties (employees, suppliers)

Our business complies with the General Data Protection Regulation (EU 2016/679, GDPR) and with all other European and national legislation concerning the protection of personal data, electronic communications and related matters, and undertakes to safeguard the protection of your Data at all times:

• Data is collected for specified, explicit and legitimate purposes and is not further processed in a manner incompatible with those purposes.
• We collect the personal data necessary for each processing purpose and process it lawfully, fairly and in a transparent manner in relation to the data subjects.
• We take care that it is, as far as possible, accurate and up to date, and we retain it only for the period necessary for the purposes for which it is processed.
• In each case, the criterion we use to determine the storage period is based on, and duly takes into account, the need to comply with every relevant legal requirement as well as the principle of data minimisation.
• We process Data electronically and manually and take every appropriate measure to protect personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Collection, purpose, legal basis of processing and retention period of your data

Data we collect automatically through our website

The website https://prioritytravel.gr/ uses the SSL protocol (Secure Sockets Layer), which applies encryption methods to the data exchanged between two devices (most commonly computers), establishing a secure connection between them over the internet, which results in the protection of your personal data.

When you visit our website, our server collects so-called server log files, specifically:

• Date and time of entry to the website.
• The volume of data sent, in bytes.
• The browser and operating system you used to access the website.
• Internet Protocol (IP) address when you enter the website. The IP address constitutes personal data together with the date and time of your visit, although we cannot identify you on the basis of this data alone.

The legal basis on which we collect your IP address and retain it in dedicated files (log files) is our legitimate interest in processing this data in order to ensure the security of networks, information and services against accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted data (e.g. monitoring of denial-of-service “ddos” attacks), as well as our legal obligation to provide a safer environment for the processing of your personal data (GDPR Article 6(1)(f) and (c)). The data will neither be transferred nor used in any other way. However, we reserve the right to check the server log files if specific indications of unauthorised use are identified.

Client data

When you use the services of our business, we collect personal data such as first and last name, father’s name, e-mail, postal address, gender, age, occupation, address, and any other information connected with the provision of travel services to you.

The purpose of processing your data is the provision of the services you have requested, and the legal basis for the processing is the performance of the contract between us (GDPR Article 6(1)(b) and Article 9(2)(h)), as well as our compliance with legal obligations. Your data is retained for the period required, and potentially longer where legal claims arise.

Please note that we do not maintain a publicly accessible directory of the e-mail addresses of our subscribers/users. Consequently, any personal data (e.g. access names, etc.) appearing anywhere on the pages and services of the Data Controller’s website is intended solely to ensure the operation of the corresponding service and may not be used by any third party without compliance with the provisions of the legislation on protection against the processing of personal data, as in force from time to time. The Data Controller acts in accordance with applicable legislation and aims at the best implementation of good practice as regards the Internet. Your personal details are held securely for as long as you are registered with a service of the Data Controller and are deleted after your transactional relationship with the Data Controller ends in any manner.

Data we collect through e-mail and the Contact Form

In the context of communication between us by e-mail and through the Contact Form, we collect your name, e-mail address and any other information you provide to us. This data is stored and used exclusively in order to respond to your request. The legal basis for processing your personal data is your consent (GDPR, Article 6(1)(a)). Your data will be deleted after the final handling of our communication. This will occur once the purpose and scope of our communication has been fulfilled, provided that there are no legal requirements for the storage of such data.

Newsletter

With your consent, we will collect your e-mail address in order to send you a newsletter with news about our Company and articles you may find of interest. The legal basis for the processing is your consent (GDPR, Article 6(1)(a)) and you have the right to withdraw it at any time.

Supplier data

For the performance of the contract between us, we collect our suppliers’ data such as name, address, contact details, delivery details and financial data, which you provide to us yourselves. The legal basis for processing your data is the performance of a contract and our compliance with legal obligations (GDPR Article 6(1)(b) and (c)), and we retain it for a period of up to twelve years from the last provision of services, or for as long as tax and any other relevant legislation requires.

Who has access to your data. Data transfers.

Your data is accessible to our employees as well as to any other person authorised to process your data in the course of their duties. In addition, we cooperate with third parties, natural or legal persons, professionals, independent consultants and others who provide us with commercial, professional or technical services (e.g. website hosting, accounting services, transport services) for the purposes stated above, and who support our business in whole or in part in relation to our activities. Depending on the case, these natural or legal persons will act as Joint or Independent Controllers, Processors, or persons authorised to process personal data for the same purposes as stated above, with the same security measures and in accordance with applicable legal obligations.

Before a third party receives Personal Data, we must: (1) complete a privacy assessment in order to evaluate the privacy practices and risks associated with those third parties; (2) obtain contractual guarantees from those third parties that they will process Personal Data in accordance with our instructions and in accordance with this Policy and applicable law, that they will immediately notify our business of any Data Protection or Security incidents or of any failure to comply with the standards set out in this Policy and applicable legislation, that they will cooperate in remedying any such incident, that they will assist us in responding to the rights of individuals set out below, and that they will allow the Data Controller to audit their processing as regards compliance with these requirements.

Finally, data may be further transmitted to public authorities and institutions, as well as to our legal advisers (lawyers and insurance companies), for lawful purposes.

Other than the above, Data will not be disclosed to third parties, whether individuals or legal entities, and will not be disseminated.

Our business does not transfer Personal Data outside the EU, and if this becomes necessary (for example, in order to use Cloud services) it will take place under the terms and conditions provided for in Articles 44 et seq. of the GDPR, such as with your consent, through the application of standard contractual clauses approved by the European Commission, or to countries considered adequate by the European Commission.

Use of cookies

In order to ensure the proper operation of the website and better navigation for you, as well as the better provision of our services, we use cookies. Cookies are text files containing information which the web server (the Data Controller’s web server) stores on your computer when you visit this website. In this way, the website remembers your actions and preferences for a period of time, for purposes such as the personalisation of online advertising, traffic analysis or other statistical analysis, and the provision of the services you have requested. This means you do not have to re-enter these preferences each time you visit the website or browse its pages. Only the Data Controller and its specifically authorised partners have access to any information relating to cookies.

You can control and/or delete cookies according to your wishes. You will find details at: aboutcookies.org. If you choose to disable cookies on the website https://prioritytravel.gr/, the functionality of some pages may be lost or reduced.

For more information on the use and management of cookies on the website, you may consult the following websites:

About cookies and their management:
http://www.aboutcookies.org/default.aspx
http://www.whatarecookies.com/

About Google’s policy:
https://www.google.com/about/company/user-consent-policy.html
https://www.google.com/policies/technologies/cookies
http://www.google.com/intl/el/policies/privacy/partners/

Security and integrity of Data

The Data Controller applies reasonable technical and organisational security policies and procedures in order to protect personal data and information from loss, misuse, alteration or destruction.

In addition, we endeavour to ensure that access to your personal data is limited to those who need to know it. Persons who have access to the data are obliged to maintain the confidentiality of that data.

Please bear in mind that the transmission of information over the internet is not entirely secure. Although we make every effort to protect your personal data, we cannot guarantee the security of data transmitted to our website. Once we have received your details, we will apply strict security procedures and operations in order to try to prevent unauthorised access.

We make every reasonable effort to retain the personal data we collect from you only for the period for which we need that data for the purpose for which it was collected, or until its deletion is requested (if this occurs earlier), unless we continue to retain it as provided for by applicable legislation.

Links to other websites

Our website may contain links to other websites which are governed by other privacy statements, the content of which may differ from this Privacy Statement. Please review the privacy policy of every website you visit before submitting any personal data to it. Although we endeavour to provide links only to websites that share our high standards and respect for privacy, we bear no responsibility for the content, security or privacy practices applied by other websites.

Data of minors

Where we need to process data of minors (e.g. data of minor travellers) – that is, under the GDPR, those who have not completed their 15th year – such processing takes place only with the written and expressly stated consent of the persons who have parental responsibility for the minor. In every case, we make reasonable efforts to verify that consent is given or approved by the person who actually holds parental responsibility for the child, namely through identity verification and any other available evidence.

Rights of Data Subjects

You may contact us by post or e-mail at the addresses stated in paragraph (1) above in order to exercise your rights under Articles 15 et seq. of the GDPR. You may, for example, request an updated list of the persons who have access to your data, obtain confirmation as to whether or not we process personal data relating to you, check its content, source, accuracy and location (including in relation to any third country), request a copy, request its rectification and restrict its processing, and even its erasure where applicable. Likewise, you may at all times submit comments and lodge complaints with the Hellenic Data Protection Authority, 1-3 Kifisias Avenue, GR 115 23, Athens, telephone: +30-210 6475600, or at http://www.dpa.gr/

Changes to this Policy

The Data Controller keeps this Policy under frequent review and may amend or revise it periodically at our discretion. Where we make any changes, we will record the date of amendment or revision in the Policy. The updated Policy will apply to you and your details from that date. We encourage you to review this Policy periodically in order to check whether there have been any changes in the way we handle your personal data. This Statement was last updated in September 2026.

Contact us

If you have any questions, comments or complaints regarding our handling or protection of your personal data, or if you wish to amend your personal data or exercise any of your rights as a data subject, please contact us at: info@prioritytravel.gr