Privacy policy

Last updated: 18 October 2026

1. Who is responsible for your data

Holiday Stork is a trading name of [legal name of the sole proprietor], a sole proprietorship registered in Greece (VAT / ΑΦΜ [ΑΦΜ], tax office [ΔΟΥ]), Kapodistriou 20, Heraklion 71306, Crete, Greece. Email: hello@holidaystork.com.

We are the data controller for the personal data described here. Questions or requests: hello@holidaystork.com.

2. What we collect

Booking details: your name, email, mobile number, hotel or delivery address, arrival and departure dates and times, flight number, the gear you choose and any notes you add.
About your child: only an age range (for example 1 to 2 years) and whether you use a car or taxi, so we can supply the right car seat. We do not ask for your child's name or date of birth.
Payment: handled by Stripe. We receive the payment status and the last digits of the card, never the full card number.
Emails: the messages you send us and the booking emails we send you.
Technical data: our hosting provider keeps standard server logs (IP address, browser, pages requested) for security.

3. Why we use it and on what legal basis

To take, deliver and collect your booking, send confirmations and handle changes, cancellations and refunds: performance of our contract with you (GDPR art. 6(1)(b)).
To issue receipts and keep accounting records: legal obligation (art. 6(1)(c)).
To keep the website and payments secure and prevent fraud: our legitimate interests (art. 6(1)(f)).
To send offers or newsletters: only if you opt in, and you can opt out at any time (art. 6(1)(a)). We do not do this today.

4. Who we share it with

We do not sell your data. We share it only with providers who help us run the service, under data processing agreements:

Stripe (payments), Supabase (booking database, hosted in the EU), Resend (booking emails), Cloudflare (website hosting and security) and Google Fonts (website fonts, which your browser loads from Google's servers).
Our accountant and the Greek tax authorities, for receipts and accounting.
Authorities, if the law requires it.

Some of these providers are based in the United States. Transfers outside the European Economic Area are protected by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

5. How long we keep it

Booking and payment records: as long as Greek tax and accounting law requires, normally up to 5 years after the end of the tax year of your booking.
Emails and messages: up to 2 years after your rental, unless needed for a dispute.
Server logs: a few weeks.

6. Cookies and similar storage

We do not use advertising or tracking cookies. The website stores your basket and booking progress in your browser's local storage so they survive moving between pages; this is strictly necessary for the service. If we add analytics in future, we will ask for your consent first and update this policy.

7. Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, or to receive it in a portable format. Email hello@holidaystork.com and we will reply within one month. Some data we must keep for tax reasons. You can also complain to the Hellenic Data Protection Authority (dpa.gr) or the authority in your own country.

8. Changes

We may update this policy. The date at the top shows the latest version. See also our Terms of rental.