Privacy Policy

Who we are

G&G VIP Transfer (“we”, “us”) provides private chauffeur and airport transfer services in Athens and Attica. When you book a transfer or contact us, we decide why and how your personal data is used — which makes us the data controller under the General Data Protection Regulation (EU) 2016/679.

What we collect

We only collect what a transfer actually requires. There is no newsletter, no profiling, and no data bought from third parties.

• Booking details — name, email, phone, pickup and drop-off addresses, date and time, passenger and luggage count, flight number where you give one, and any notes you add.
• Payment details — entered at checkout and processed by Viva Wallet, our payment provider. We do not see or store your card number.
• Your location — only if you choose “use my location” in the booking form and allow it in your browser. It is used once, to fill in the pickup point.
• Direct correspondence — whatever you tell us by phone, email or WhatsApp.
• Technical data — standard server logs kept by our host, such as IP address and time of request, for security and troubleshooting.

Why we use it, and on what legal basis

• To perform the transfer you booked — sending confirmations, giving the driver your pickup point, tracking your flight. Legal basis: performance of a contract (Art. 6(1)(b)).
• To answer you when you call, email or message. Legal basis: contract, or our legitimate interest in replying to enquiries (Art. 6(1)(f)).
• To meet tax and accounting duties for completed bookings. Legal basis: legal obligation (Art. 6(1)(c)).
• To keep the site secure. Legal basis: legitimate interest (Art. 6(1)(f)).
• To load the interactive map, only if you press the button. Legal basis: consent (Art. 6(1)(a)).

Cookies and local storage

This site sets no advertising, analytics or tracking cookies. There is no Google Analytics, no Meta Pixel, no heatmapping. That is why you are not being asked to accept anything — there is nothing to consent to.

One item is stored, strictly necessary and exempt from the consent requirement under Art. 5(3) of the ePrivacy Directive (Greek Law 3471/2006). We list it here because the exemption covers consent, not transparency:

Our fonts are served from our own server rather than a font CDN, so simply opening this site sends your IP address to no one but us.

Who else sees your data

We do not sell your data, and we do not share it for anyone's marketing.

• BookingPlan — runs the booking widget embedded on this site and processes your booking details solely to operate that service for us, acting as our processor.
• Viva Wallet (Vivabank S.A.) — processes your card payment at checkout, including your bank's 3-D Secure check. As a regulated payment institution it handles card data under its own responsibility and privacy policy; we receive only confirmation that the payment went through.
• Our drivers — receive only what is needed to collect you: name, pickup point, time, contact number.
• Cloudflare — hosts this site (Cloudflare Pages) and delivers it through its network. It processes connection data such as your IP address in order to serve the page and to protect the site from attack.
• Authorities — only where the law requires it.

The map, and transfers outside the EEA

The map on our contact page is a still image hosted by us. It loads nothing from Google. Only if you press “Interactive map” do we place the Google Maps embed on the page — at that point your IP address and browser data go to Google LLC, which may process them outside the EEA under the European Commission's adequacy decision for the EU–US Data Privacy Framework.

That request is yours to make. If you never press the button, nothing about you reaches Google. See Google's privacy policy.

Separately, Cloudflare delivers this site to you and therefore always handles your connection data. Cloudflare is based in the United States and operates a global network, so that data may be processed outside the EEA. It is covered by Cloudflare's data processing terms, which include the European Commission's Standard Contractual Clauses. This is the unavoidable minimum of putting a website online — it is how the page reaches your screen at all.

How long we keep it

Booking records: 5 years, counted from the end of the year in which the relevant tax return was filed — the period Greek tax law requires us to keep accounting records. We cannot delete these earlier even if you ask, because a legal obligation overrides erasure for as long as it lasts.

Correspondence that never became a booking: kept only as long as it is useful to answer you, then deleted.

Connection data handled by our hosting provider for delivery and security: kept for a short period under their own retention schedule, not ours.

Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider in a portable format. Where we rely on your consent, you can withdraw it at any time.

Write to g.g.viptransfer@gmail.com and we will answer within one month. If you are not satisfied, you can complain to the Hellenic Data Protection Authority: www.dpa.gr, Kifissias 1-3, 115 23 Athens, +30 210 6475600.

Changes to this policy

If we change how we handle your data — for example if we ever add analytics — we will update this page and change the date at the top before the change takes effect.