Privacy Policy

Who we are

Athena Volcano Cruises (Αθήνα Βολκάνο Ν.Ε.Π.Α.) operates private cruises from Santorini, Greece, and the website www.athenavolcano.com. For anything related to your personal data, contact us at info@athenavolcano.com or +30 698 614 9191.

What we collect

Booking details. When you book a cruise we collect your name, email address, phone number, party size, chosen date, and any special requests you share — the minimum needed to run your charter and stay in touch about it.

Passenger details. Greek port authority rules require a passenger list for every cruise, so after booking we ask for each passenger’s full name, nationality, date of birth and passport or ID-card number, a photo of that document, an emergency contact, and optionally your pick-up hotel, dietary needs and any occasion you are celebrating. The passport reader on our form runs entirely in your browser; nothing is sent to a third-party scanning service.

Payment. Payments are processed entirely by viva.com (Viva Payments S.A.), a licensed European payment institution. Your card details are entered on viva.com’s secure checkout and never reach or pass through our servers. We receive only a confirmation of payment and a transaction reference.

Pick-up location. If you ask for a hotel pick-up, we store the hotel or place you choose, its address and map position, the pin you set on the map, and any note you leave for the driver. When you type in the hotel search, the text you type is sent from our server to Google (Google Places) so it can suggest matching places. The map itself loads its images from OpenFreeMap, which sees your IP address, as any website you load does.

Guest accounts (optional). If you sign in to see your bookings, we keep your email address — and, if you choose “Continue with Google”, the name and profile picture Google shares — so you can sign in. Your account shows the bookings made with the same email address. For security, our sign-in provider also records the IP address and browser of each sign-in, to detect and block misuse. You can delete your login at any time from your account page; this removes the login only, not your booking records.

Cookies. We group cookies into three kinds. Analytics and marketing cookies are set only if you allow them in the cookie banner, and you can change your choice at any time via “Cookie settings” in the footer.

• Strictly necessary (always on). Keeping you signed in to your account and holding, for up to a day, the sign-in link you opened from your email; av_nl_confirm, which holds the newsletter confirmation link you opened from your email for up to 7 days, until you tap “Yes, subscribe me”; av_nl_join, which holds the one-tap newsletter join link you opened from a review email for up to a day, until you tap “Yes, subscribe me”; av_consent, which remembers your cookie choice for one year; and a note in your browser’s local storage so we do not show you the same pop-up again. These are not used for tracking and need no consent.
• Analytics (needs consent). Google Analytics cookies (_ga, _ga_*), to understand how the site is used.
• Marketing (needs consent). Meta (_fbp, _fbc), TikTok (_ttp, ttcsid*, _tt_enable_cookie) and Google Ads (_gcl_*), to measure and improve our advertising. These tools are not loaded at all unless you accept marketing cookies, and we never send them your name, email, phone number or booking reference.

Why we use it

• Your booking, payment, pick-up and the emails about your cruise: to perform our contract with you.
• The passenger list (names, nationality, date of birth, document number): a legal obligation under Greek port authority rules.
• Tax and accounting records: a legal obligation.
• Your guest account: at your request. You can delete the login at any time.
• Analytics: only with your consent.
• The newsletter: only with your consent (see below).

The emails we send are your booking confirmation, a reminder before the cruise, a request to complete passenger details, your pick-up and driver details, a cancellation or refund notice if a booking is cancelled, the sign-in link and code if you sign in to your account, and, after the cruise, a request for a review.

We never sell personal data or use it for third-party advertising.

Who helps us

Your data is handled by a small set of service providers acting on our instructions. Each processes only what is necessary for its role.

• viva.com: payments
• Supabase: secure database hosting (EU region) and sign-in for guest accounts, including sign-in security logs (IP address and browser)
• Resend: emails, including sign-in links and the newsletter
• Railway: website hosting
• Cloudflare: private storage for passenger document photos, and delivery of the photos shown on this website (which, like any website you load, sees your IP address)
• Google: analytics (with consent), hotel search for pick-ups, and sign-in if you choose “Continue with Google”
• OpenFreeMap: map images on the pick-up map

Your driver. When we arrange a pick-up we send the driver what they need to collect you — your booking reference, date and pick-up time, your name, the number of guests, the pick-up place with a map link, and any note you left — by WhatsApp. We do not send your phone number or passport details. Your account and pick-up page show the driver’s photo (if we have one), name, phone number, vehicle and number plate, so you can recognise and contact them.

Some of these providers may process data outside the European Union; where they do, the transfer is covered by the safeguards the GDPR requires, such as the European Commission’s Standard Contractual Clauses.

How we protect it

The site is served only over an encrypted connection (HTTPS). Booking and passenger data can be read only by our staff and, for your own booking, by you. Document photos are kept in private storage and shown through short-lived links, and your card details never reach us.

How long we keep it

Booking and payment records are retained for as long as Greek tax law requires. Passenger document photos are stored privately, visible only to our staff and to you, and deleted automatically 30 days after your cruise (or shortly after a cancellation); the typed passenger details stay with the booking record. Pick-up details stay with the booking record too. If you delete your login, the login is removed at once; booking records stay as described above. Analytics data follows Google Analytics’ standard retention periods. You may ask us to delete data we are not legally required to keep.

Your rights

Under the GDPR you can ask to access, correct, delete, or receive a copy of your personal data, and to object to or restrict its processing. Email info@athenavolcano.com and we will respond promptly. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

Updates

We may revise this policy as the service evolves; the current version always lives on this page. Last updated: 17 October 2026.