Privacy Policy

1. Introduction & Purpose

Viblyshufflespot Hellas Travel Group S.A. ("Viblyshufflespot", "we", "our", or "us") respects your privacy and is dedicated to securing the personal data you entrust to us when accessing viblyshufflespot.homes (the "Portal"). This Privacy Policy details our operational protocols concerning the processing, collection, storage, and transfer of personal information collected through our travel platform, spatial WebGL visualizers, and concierge correspondence services.

By interacting with this Portal, submitting inquiry forms, or configuring interactive itinerary parameters, you consent to the information practices outlined in this policy.

2. Categories of Information Collected

We collect and process various categories of personal information depending on the nature of your interaction:

• Directly Provided Information: When you submit our itinerary generator, contact form, or concierge dispatch, we gather your full name, email address, telecommunication contact details, destination preferences, party composition, and any qualitative travel requirements you provide.
• Automated Telemetry & Technical Identifiers: During your navigation through our Greek guides, our servers automatically record Internet Protocol (IP) addresses, device hardware profiles, browser signatures, operating systems, referring URLs, time spent per regional portal (e.g., Santorini, Meteora), and interactive filter choices.
• Session & Cookie Information: LocalStorage keys and cookies to track cookie consent choices (e.g., `viblyshufflespot_cookie_consent`), active coordinates, and dynamic layout preferences.

3. Legal Bases for Data Processing (GDPR Article 6)

We process personal data solely where a legitimate lawful foundation exists under European and Greek law:

• Performance of Contract or Pre-Contractual Steps: To evaluate and formulate requested travel itineraries, respond to villa availability inquiries, or coordinate logistical arrangements.
• Legitimate Business Interests: To optimize our WebGL spatial rendering engine, detect and prevent malicious automated crawler behavior, and enhance destination UX performance.
• Consent: Explicit authorization granted for marketing dispatches, non-essential analytical cookies, or bespoke travel updates.
• Statutory Compliance: Archival requirements enforced by Hellenic fiscal authorities and European consumer travel directives.

4. Third-Party Service Providers & Cross-Border Transfers

We never monetize, vend, or trade your personal data to commercial brokerages. We share data only with strictly vetted sub-processors bound by compliant Data Processing Agreements (DPAs):

• Cloud hosting infrastructure and CDN content delivery platforms located inside the European Economic Area (EEA).
• Encrypted email dispatch gateways for concierge replies.
• Analytical engines configured with anonymized IP masking to measure travel guide viewership.

Any international data transfers outside the EEA are conducted in strict compliance with the European Commission's Standard Contractual Clauses (SCCs).

5. Data Retention Protocols

We retain personal information exclusively for as long as necessary to fulfill the operational purposes described in this policy. Inquiry communications submitted through the contact portal are maintained for twenty-four (24) months to facilitate recurring travel assistance, after which they are either purged or rendered irreversibly anonymous. Log files and technical access metrics are overwritten within ninety (90) days.

6. Your Statutory Rights under GDPR & International Frameworks

Under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), you maintain enforceable rights:

• Right of Access (Article 15): Request a full structured copy of the personal information we hold concerning your person.
• Right to Rectification (Article 16): Demand correction of incomplete or erroneous travel records.
• Right to Erasure ("Right to Be Forgotten", Article 17): Request the permanent deletion of personal files where lawful retention grounds have ceased.
• Right to Restriction of Processing (Article 18): Restrict processing pending verification of disputes.
• Right to Data Portability (Article 20): Receive your information in a structured, machine-readable format.
• Right to Object & Revoke Consent: Discontinue any marketing or telemetry tracking at any moment.

7. Data Protection Officer (DPO) Contact

To exercise any statutory data right or submit inquiries concerning our privacy operations, contact our designated privacy governance officer:

Data Protection Officer
Viblyshufflespot Hellas Travel Group S.A.
14 Dionisiou Areopagitou St, Plaka, 105 58 Athens, Greece
Direct Email: [email protected]