Privacy policy

Last updated: 23 October 2026

This Privacy policy explains what personal data we collect when you use www.eoliasailing.com (the “website”), why we collect it, who we share it with and what rights you have. We process data in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Greek Law 4624/2019.

1. Data controller

Eolia Sailing I.K.E.
VAT: 803015395
Address: 30IS 39, Volou / Magnisias, 37400, Greece
Email: [email protected]

For any question about your data, write to us at the address above. We are not required to appoint a Data Protection Officer (DPO), so we answer these questions directly.

2. What data we collect

2.1 Charter inquiry (Contact page and boat pages)

  • first and last name, phone number and, if you enter it, email address
  • boat type, month or exact departure date, number of people and the boat you are asking about
  • the message you write
  • whether you want to receive news about promotional and last-minute offers
  • the website language you send the inquiry from

2.2 Sailing school sign-up

  • full name, email address and phone number
  • course date, number of participants, sailing experience and any note you add

2.3 Contact by email, WhatsApp or Instagram

If you write to us directly, we process the data you send us (name, phone number or profile, and the content of your message). WhatsApp and Instagram are services of Meta, which processes that data under its own privacy rules.

2.4 Technical data

With every visit, the server automatically records technical data such as your IP address, browser type and time of access. The website cannot be delivered or protected against abuse without it.

2.5 Website usage data (only with consent)

If you choose “Accept all” in the cookie banner, we use Google Analytics 4 to see how many visits we get and which pages are read. See section 4 and our Cookie policy.

We do not collect special categories of data (such as health data) and ask you not to include them in your messages.

  • Answering your inquiry and preparing an offer: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
  • Booking, organising the trip or course and communicating during it: performance of a contract (Article 6(1)(b)).
  • Accounting and tax obligations once a booking is made: legal obligation (Article 6(1)(c)).
  • Running and securing the website, protecting forms against bots and abuse: legitimate interest (Article 6(1)(f)).
  • Website analytics: your consent (Article 6(1)(a)).
  • Promotional and last-minute offers: your explicit consent (Article 6(1)(a)), given by ticking a separate box in the form.

You can withdraw your consent at any time; this does not affect the lawfulness of processing before the withdrawal. We do not make decisions based solely on automated processing and we do not profile visitors.

4. Cookies, local storage and analytics

  • We store your choice from the cookie banner in your browser’s local storage (key eolia-consent) so we don’t ask you on every visit.
  • Google Analytics 4 is loaded only after you choose “Accept all” and only on www.eoliasailing.com. Advertising features are turned off: Google receives no consent for advertising cookies or ad personalisation. GA4 does not store IP addresses.
  • The video on the About us page is loaded from youtube-nocookie.com only when you click on it. From that moment, Google (YouTube) processes data under its own rules.
  • Fonts are served from our own server, not from third-party servers.

You can change your choice at any time with the Cookie settings link at the bottom of every page. Details are in our Cookie policy.

5. Who we share data with

We do not sell your data or share it for marketing purposes. We use the following service providers, who process data on our behalf and only as far as their service requires:

  • Cloudflare, Inc.: website hosting, content delivery and attack protection; processing of submitted forms; Cloudflare Turnstile checks that a form is sent by a human and not a bot.
  • Resend (Plus Five Five, Inc.): delivering submitted forms to our business email.
  • Zoho Corporation: hosting our business email, where inquiries and correspondence are kept.
  • Google Ireland Limited / Google LLC: Google Analytics (only with consent) and the YouTube video (only when you play it).

When a booking is made, we share the data needed to perform the contract (such as passenger names) with the partner charter company that owns the boat, with port authorities where required by law, and with our accountant.

6. Transfers outside the European Union

Cloudflare, Resend, Zoho and Google may process data outside the European Economic Area, mainly in the United States. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses, together with additional technical and organisational safeguards.

7. How long we keep data

  • Inquiries and correspondence without a booking: up to 24 months after the last contact, unless you ask us to delete them sooner.
  • Booking data and invoices: as long as Greek tax and accounting rules require.
  • Consent to promotional offers: until you withdraw it.
  • Google Analytics: according to the retention period set in Google Analytics, at most 14 months.
  • Your cookie banner choice: until you change it or clear the site data in your browser.
  • Technical server logs: briefly, according to the hosting provider’s rules.

8. Your rights

Under the GDPR you have the right to:

  • access your data and get a copy of it
  • have inaccurate data corrected
  • have your data erased (“right to be forgotten”)
  • restrict processing
  • receive your data in a structured, machine-readable format (portability)
  • object to processing based on legitimate interest
  • withdraw your consent at any time

Send your request to [email protected]. We will reply within one month at the latest.

You also have the right to lodge a complaint with the Greek supervisory authority, the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, www.dpa.gr), or with the supervisory authority in the country where you live.

9. Data security

The website runs only over an encrypted connection (HTTPS), forms are protected against bots, and only our team has access to inquiries. We take reasonable technical and organisational measures to protect data against unauthorised access, loss and misuse.

10. Minors

The website is not intended for people under 16. An inquiry or sign-up for a minor should be sent by a parent or guardian.

The website contains links to WhatsApp, Instagram and YouTube. When you open them, the privacy rules of those services apply, and we are not responsible for them.

12. Changes to this policy

We may update this policy from time to time. The current version is always on this page, with the date of the last update at the top.