Privacy Policy

Welcome to ComyMoves (“ComyMoves”, “we”, “us” or “our”). We provide chauffeur-driven VIP transfers, private tours and curated experiences across Santorini, Ios, Athens and the wider Cyclades. We respect your privacy and are committed to protecting your personal data.

This policy explains what personal data we collect when you visit our website (comymoves.com) or use our transfers, tours, experiences and concierge services, how we use it, who we share it with, and the rights you have over it. For the purposes of the EU General Data Protection Regulation (GDPR) and Greek data-protection law, ComyMoves is the data controller of the personal data described here.

We collect and process the following personal data:

• Contact & identity details — your name, email address and phone number.
• Booking & trip details — the information needed to arrange your transfer, tour or experience: pick-up and drop-off points, island or route, date and time, number of passengers, luggage, child-seat requirements, your preferred vehicle, and your flight or ferry number.
• Anything you tell us — special requests, notes and the messages you send us through the website form, WhatsApp, phone or email.
• Payment-related information — where a service is paid for, the details needed to take or reconcile that payment. We do not collect or store full card numbers on this website; any payment is arranged directly with you or handled by a payment provider.
• Technical & usage data — limited technical information such as your IP address (used to keep our booking form secure and prevent abuse) and anonymous, aggregated statistics about how the website is used.

We do not intentionally collect special categories of data. Please share sensitive information only when it is necessary for your journey — for example, an accessibility requirement so we can assign a suitable vehicle — and we will use it solely to fulfil that request.

We use your personal data to:

• arrange and manage your transfer, tour or experience, and assign a suitable vehicle and chauffeur;
• confirm your booking and send you the details and updates, including an automatic email confirmation;
• communicate with you about your request, any changes and your questions;
• provide round-the-clock concierge support;
• keep accurate records for accounting, tax and other legal purposes;
• keep our website and booking form secure and prevent fraud or abuse;
• understand how our website is used so we can improve it and our services;
• where you have agreed, send you occasional service-related or marketing messages — you can opt out at any time.

We rely on the following legal bases under the GDPR:

• Performance of a contract — to provide the transfer, tour or experience you request and manage your booking.
• Legitimate interests — to run, secure and improve our business and prevent abuse, in a way that does not override your rights and freedoms.
• Legal obligation — to meet our tax, accounting and other legal requirements.
• Consent — for optional marketing communications, which you can withdraw at any time.

We never sell your personal data. We share it only where it is needed to deliver our service, and always with appropriate safeguards:

• Our chauffeurs and operational partners — the driver and any partner team meeting you receives the details needed to complete your journey, such as your name, pick-up point and a contact number.
• Service providers acting on our behalf — email delivery, website hosting and infrastructure, and analytics providers, who process data only under our instructions.
• Payment providers — where you choose to pay for a service.
• Authorities or professional advisers — where we are legally required to disclose data, or to establish, exercise or defend legal claims.

Some of our service providers — for example website hosting and email delivery — may process your data on servers located outside Greece and the European Economic Area (EEA). Where that happens, we make sure the transfer is protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or a recognised adequacy decision.

We keep cookies to a minimum. Our website does not use advertising or third-party tracking cookies, and we do not build advertising profiles about you.

• Strictly necessary — the small amount of local storage required for the site to function correctly and securely.
• Privacy-friendly analytics — we use aggregated, cookieless analytics to understand how the site is used. These statistics do not identify you individually.

You can control or block cookies at any time through your browser settings.

We keep your personal data only for as long as necessary for the purposes set out above. Booking and transaction records are retained for the period required by Greek tax and accounting law (generally at least five years, and longer where a longer statutory period applies). Enquiries that do not lead to a booking are kept for a shorter period and then securely deleted.

Under data-protection law you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• ask us to erase your data;
• object to, or ask us to restrict, certain processing;
• request the portability of the data you provided to us;
• withdraw your consent at any time, without affecting processing carried out beforehand.

To exercise any of these rights, contact us using the details below — we will respond within one month. If you are not satisfied with our response, you have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

We use appropriate technical and organisational measures to protect your personal data, including:

• encrypted connections (SSL/TLS) across our website;
• validation and sanitisation of everything submitted through our booking form;
• rate-limiting and abuse protection on our systems;
• access controls that limit who can see your data to those who need it to serve you.

No method of transmission over the internet is ever completely secure, but we work continuously to protect your data and keep these measures up to date.

Our services are intended for adults arranging travel. We do not knowingly collect personal data directly from children. Where a booking includes children — for example, to arrange a child seat — that information is provided by the adult making the booking.

We may update this privacy policy from time to time. The current version will always be available on this page, with the “last updated” date shown below. Where a change is significant, we will make that clear.

For any privacy-related question, or to exercise your rights, please contact ComyMoves, the data controller:

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr), the supervisory authority for Greece.