Privacy Policy

Last updated: 30 September 2026

IgoumenitsaSTAY (www.igoumenitsastay.gr) is an independent local travel guide and business directory for Igoumenitsa, Sivota and Thesprotia in Greece. It is free to use and sells nothing. This page explains, in plain words, what personal data the site processes, why, for how long, who else sees it, and what rights you have.

1. Who is responsible

The controller of your personal data is Panos Andreou, who runs IgoumenitsaSTAY as a private individual. There is no company behind the site today. If a company is founded later, we will update this page and our other policies.

You can reach us only by email: igoumenitsastay@gmail.com. Please use this address for every privacy question or request.

The site is built, hosted and maintained for us by Wideview Entertainment (TSOKAS G. WIDEVIEW ENTERTAINMENT Ε.Ε.), Greece. It processes personal data only on our behalf and on our instructions, as our processor.

We have not appointed a Data Protection Officer. The law does not require one for a site of this kind and size: we are not a public authority, we do not monitor visitors systematically or on a large scale, and we do not process special categories of data.

2. The short version

• Until you make a choice, browsing the public site sets no cookies and stores nothing in your browser, and the first page load contacts only our own server. Your choice itself is kept in your browser (see section 6).
• Only with your consent do we use Google Analytics, to understand how visitors use the guide (see 3.4). It is off unless you choose “Accept”.
• We count page views and button clicks per listing without cookies and without storing your IP address.
• Maps, videos, social posts and other content from other companies load only when you click to show them, or automatically if you switch this on in “Cookie settings”. Then that company receives your IP address and may set its own cookies.
• If you write to us (error report, contact form, email, newsletter), we use what you send only to deal with it, and we delete it on a fixed schedule.
• We do not sell your data and we do not use it for advertising.

3. What we process and why

3.1 Visiting the site (server logs)

Like every website, our web server records each request: your IP address, date and time, the page requested, the response code, the amount of data sent, the referring page and your browser’s user agent. We need this to deliver the site, to find faults and to protect it against attacks.

When a page is not found, we also record the address that was requested, the referring page and the browser’s user agent, without the IP address, so that we can fix broken links. One of these lists is deleted after one week; the other keeps at most 10,000 addresses and is deleted after 90 days.

• Legal basis: our legitimate interest in running a secure website (GDPR Art. 6(1)(f)).
• Retention: the raw log is emptied several times a day into a monthly archive, and each monthly archive is deleted at the end of the following month, so about one to two months. Copies can also exist in our daily backups for up to 30 more days (see 3.11).

3.2 Security

Our server is protected by a security system (Imunify360) that inspects requests, may show a short check page (“splash”) or a CAPTCHA when traffic looks automated, and keeps its own security logs with IP addresses for about 52 days. Information about attacking addresses may be shared with the security vendor to improve protection.

Our own forms and counters use a short-lived “flood guard” against abuse. It keeps only a scrambled (salted hash) form of your IP address, in the server’s memory, never in the database or in a log. The key changes every day and is deleted at the end of the day, so after that nothing can be linked back to an address.

Rejected login attempts on the administration login page are written, with the IP address, to the server’s error log. That log is rotated every week and kept for about five weeks.

• Legal basis: legitimate interest in security (Art. 6(1)(f)).

3.3 Anonymous statistics

On listing pages (for example a restaurant or an apartment) the site counts, per listing and per day, how many times the page was viewed and how many times buttons such as “Call”, “Directions” or “Book” were clicked. We use these totals to improve the guide and to show businesses how their listing is used.

• What is sent: only the number of the listing and the type of action. No cookie, no identifier of your device.
• What is stored: daily totals only (for example “listing 123, 1 October, 14 views”). We do not store your IP address or your browser details. Your user agent is read only to ignore search engine robots, and your IP address is used only by the flood guard described in 3.2.
• Logged-in editors are not counted.
• This counter is our own, separate from Google Analytics, and does not depend on your choice in the bar.
• Legal basis: legitimate interest (Art. 6(1)(f)). The stored totals are not personal data.

3.4 Google Analytics (only with your consent)

If you choose “Accept” in the bar at the bottom of the page, or switch on “Statistics” in “Cookie settings”, we use Google Analytics 4 to understand how visitors use the guide and to improve it: which pages are viewed and for how long, how visitors found us (for example from a search engine or a link), actions such as scrolling or clicks on links to other websites, the type of device, browser and screen, the language, and the approximate location (country and city), which Google derives from your IP address. Google Analytics uses the cookies _ga and _ga_VWQSRRPWNH with a random identifier for your browser (see our Cookie Policy). We do not send Google your name, your email or anything you type into our forms.

• Until you accept, nothing is loaded from Google and nothing is sent to Google. Logged-in editors are never measured.
• Settings on our side: only storage for statistics is allowed; storage for advertising, advertising data and personalisation (ad_storage, ad_user_data, ad_personalization) always stay denied (Google Consent Mode), and Google signals are off. This Google Analytics property is linked to our own Google Ads account, with ads personalisation switched off in that link: this lets us measure our own Google Ads campaigns for the guide, and is not used for personalised advertising. According to Google, Google Analytics 4 does not log or store IP addresses.
• Legal basis: your consent (GDPR Art. 6(1)(a)) and, for the cookies, Art. 4(5) of Greek Law 3471/2006 (ePrivacy).
• Processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which processes the data on our behalf under Google’s data processing terms for Google Analytics.
• Transfers: Google may process the data in the USA and in other countries. Google LLC is certified under the EU-US Data Privacy Framework (see section 5).
• Data sharing: in our Google Analytics account settings we currently have these Google data sharing options switched on: “Google products & services” (we have accepted Google’s controller-controller data protection terms for this one), “Modeling contributions & business insights”, “Technical support” and “Recommendations for your business”. Under these settings, Google may use aggregated and de-identified Analytics data to improve its own products and for benchmarking, and Google support staff may access our data when needed to help us. More on what each setting means: support.google.com/analytics/answer/1011397.
• Retention: event data and user data are kept in Google Analytics for 14 months and then deleted automatically; this period does not reset with new activity from the same visitor. Totals that no longer relate to any browser (for example the number of visits in a month) may be kept longer.
• Withdrawal: at any time, as easily as you gave it, with “Cookie settings” at the bottom of every page: switch “Statistics” off. Google Analytics then stops at once and we delete its cookies from your browser. Withdrawal does not affect what was measured before.

3.5 “Something wrong? Tell us” (error reports)

On listings you can report an error. The form asks what is wrong (closed, wrong phone, wrong hours, something else), optional details, and optionally your email address if you want a reply. We do not store your IP address or browser details with the report.

• Purpose: to correct the guide and, if you gave an email, to answer you.
• Legal basis: legitimate interest in keeping the guide accurate (Art. 6(1)(f)). Giving your email is up to you.
• Retention: your email address is deleted 90 days after we close the report. The whole report is deleted 12 months after we close it, and in any case 24 months after you sent it. This runs automatically every day.

3.6 Contact form

Our contact form asks for your name, your email, an optional subject and your message. We also record which page and language you used. We do not store your IP address with the message.

The message is stored on our server, and a copy is sent by email to our mailbox (see 3.7), so that we can answer you quickly.

• Purpose: to answer you.
• Legal basis: legitimate interest in answering messages (Art. 6(1)(f)), or steps you ask us to take before an agreement, for example about listing your business (Art. 6(1)(b)).
• Retention on our server: we delete a message 12 months after we archive it, and in any case 24 months after you sent it. This runs automatically every day. The copy in our mailbox follows 3.7.

3.7 Email

If you email us, reply to an email from the site, or use the contact form, your message reaches our mailbox igoumenitsastay@gmail.com, which is hosted by Google (Gmail). We keep correspondence in that mailbox only as long as needed to answer you, and for at most 24 months.

Emails that the site sends (for example the confirmation of a newsletter signup or a contact form notification) go out through Mailgun, in its EU region. Mailgun keeps delivery logs for a limited period. Open tracking and click tracking are switched off. Our server keeps a copy of sent emails in a log for 14 days for troubleshooting, and then deletes it automatically.

• Legal basis: the same as the reason you wrote to us, usually legitimate interest (Art. 6(1)(f)).

3.8 Newsletter

If you sign up, we store your email address, the language of the signup, where on the site you signed up, and the dates of signup and confirmation. We use double opt-in: you are subscribed only after you click the link in the confirmation email.

• Purpose: to send you our newsletter about Igoumenitsa, Sivota and Thesprotia.
• Legal basis: your consent (Art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every email, or by writing to us.
• We do not track whether you open our emails or which links you click, and we do not store your IP address.
• Retention: until you unsubscribe. Signups that are never confirmed are deleted automatically after 30 days. After you unsubscribe, we keep your entry (email address, language, where you signed up and the dates) marked as unsubscribed, so that we never email you again by mistake. If you want it deleted completely, write to us.
• Processors: our hosting (the list is stored on our own server) and Mailgun (EU region) for sending.

3.9 Content from other websites (maps, videos, posts, widgets)

Some pages include content from other companies: Google Maps, Google Calendar, YouTube, Instagram, Airbnb, Wikiloc, BeachRadar, FuelGR, weatherwidget.io, and the OpenStreetMap map on listing pages. We do not load any of this when the page opens. Instead you see a box with a button, for example “Show map” or “Play the video”, and a note naming the company. Nothing is sent to that company until you click.

If you switch on “External media” in “Cookie settings”, this content loads automatically on every page, without the button, until you switch it off again.

When the content loads, your browser connects to that company, which receives your IP address and browser details, may set cookies or store data in your browser, and may link the visit to your account if you are logged in there. Some of them load further services inside their content (for example the Wikiloc map loads Google Tag Manager and Facebook, the FuelGR widget loads OpenStreetMap and Cloudflare). The full measured list is in our Cookie Policy.

• Legal basis: your consent, given by clicking the button for that specific content, or by switching on “External media” (Art. 6(1)(a) GDPR and Art. 4(5) of Greek Law 3471/2006). Each company is responsible for its own processing under its own privacy policy.
• You can always use the plain link under each box (“Open on Instagram”, “Open on Wikiloc”) instead.

3.10 Links to businesses and affiliate links

Listings link to businesses’ phones, websites, WhatsApp, maps and booking pages. When you follow a link you leave our site, and the other site’s own privacy policy applies.

Some links may be affiliate links, marked with a “Partner” label: if you book through them we may earn a commission. We do not pass any personal data to the partner. The partner may use its own cookies on its own site to know that you came from us.

3.11 Backups

We back up the whole site every day. Backups are kept for 30 days and stored with our hosting provider in Germany. Before technical changes we also keep a working copy of the database and of the files involved on the same server, so that a change can be undone. Data you asked us to delete may remain in a backup or working copy until it is removed; we do not restore it from there except to repair the site.

3.12 Accounts for editors

Only our editors and our technical team have accounts. For them we process username, email address, password (stored only as a hash), login sessions (which record IP address and browser), and a log of the changes they make (with the IP address), to run and secure the site. The login page uses Cloudflare Turnstile to block automated login attempts.

3.13 What we do not do

• No comments and no public user registration.
• No advertising and no advertising cookies. Google Analytics runs only with your consent (3.4), with its advertising features off.
• No selling or renting of personal data.
• No automated decision-making or profiling that affects you.

If we ever add advertising, we will ask for your consent first and update this page.

4. Who receives your data

We use these providers to run the site. Where a provider works on our behalf, it may use the data only on our instructions:

• Wideview Entertainment (TSOKAS G. WIDEVIEW ENTERTAINMENT Ε.Ε.): builds, hosts and maintains the site. Greece, servers in Germany.
• Hetzner Online GmbH: server and backup storage. Falkenstein, Germany.
• Mailgun Technologies, Inc.: sending the site’s emails. EU region.
• Google (Gmail): our mailbox. See section 5.
• Google Ireland Limited: Google Analytics, only if you accept it (3.4). Ireland; see section 5.
• Cloudflare, Inc.: DNS for our domain, and the anti-bot check on the login page. See section 5.
• Imunify360 (CloudLinux): server security software. See section 5.

The companies in 3.9 (Google, Meta for Instagram, Airbnb, Wikiloc, the OpenStreetMap Foundation and the others) receive data only when their content loads, and they act as independent controllers.

We may also disclose data if the law requires it, for example to a court or public authority.

5. Transfers outside the European Economic Area

Our server, our database and our backups are in Germany. Some providers are based in the USA or may access data from there: Google (our Gmail mailbox, Google Analytics if you accept it, and Maps, Calendar and YouTube when that content loads), Cloudflare and Mailgun (support access), Meta (Instagram) and Airbnb when their content loads. The OpenStreetMap Foundation is in the United Kingdom, which has an adequacy decision of the European Commission. Where a US provider is certified under the EU-US Data Privacy Framework, the transfer relies on the European Commission’s adequacy decision of 10 July 2023; otherwise on the Standard Contractual Clauses of the provider. You can ask us for more information at igoumenitsastay@gmail.com.

6. Cookies

Without your consent, the public site sets no cookies. When you make a choice in the bar or in “Cookie settings”, we store it in your browser (the key igs_consent, for 12 months). If you accept “Statistics”, Google Analytics sets the cookies _ga and _ga_VWQSRRPWNH. Other cookies are set only by the external content that loads, and on the login page for editors. Details, with every cookie we measured, are in our Cookie Policy.

Record of your choices. Each time you save a choice in the bar or in “Cookie settings”, your browser keeps a random consent ID with it and sends the choice to our server, which records it to be able to show that consent was given.

• What is stored: the random consent ID, the date and time (UTC), the version of the settings, your choices (“Statistics” and “External media”, on or off), the kind of action (accept, reject, your own choices, or withdrawal) and the language of the page. No IP address, no browser details, no referring or visited page, no cookie. Like every request, the sending of your choice appears in the server log of 3.1, but without the consent ID or your choices.
• Legal basis: our legal obligation to be able to demonstrate consent (GDPR Art. 6(1)(c) with Art. 7(1) and 5(2)).
• Retention: 12 months after your choice expires, so at most 24 months after you made it, then deleted automatically every day.
• Only the site’s administrators can see the record. You can see your consent ID in “Cookie settings”.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• rectification of inaccurate data;
• erasure (“right to be forgotten”);
• restriction of processing;
• data portability, for data you gave us on the basis of consent or a contract;
• object at any time to processing based on our legitimate interest;
• withdraw your consent at any time, without affecting what was done before (for example unsubscribe from the newsletter, or switch off “Statistics” or “External media” in “Cookie settings”);
• complain to a supervisory authority (section 8).

To use your rights, write to igoumenitsastay@gmail.com. We answer within one month. We may ask for information to confirm it is you, for example a message from the email address you used. Because we do not store IP addresses or cookies with your messages, the email address you used is how we find your data. In Google Analytics we cannot find your data by name or email, only by the random identifier in the _ga cookie of your browser, if you send it to us. The same applies to the record of your cookie choices: we find it only by the consent ID shown in “Cookie settings”.

8. Complaints

If you think we process your data unlawfully, you can complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, Greece, www.dpa.gr, or to the authority of the EU country where you live or work. We would appreciate the chance to fix the problem first.

9. Security

The site runs only over HTTPS. Access to the administration is limited to named accounts with strong passwords and an anti-bot check. Messages and reports are stored in private areas of our database that only administrators can open. We keep software up to date and back up daily.

10. Children

The guide is written for adults planning a trip. We do not knowingly collect data from children. Under Greek law (Law 4624/2019, Art. 21), children under 15 need a parent’s consent to sign up for the newsletter.

11. Changes

We update this page when the site changes, for example when we add a new service. The date at the top shows the latest version. For important changes we will add a notice on the site.

12. Contact

Panos Andreou, IgoumenitsaSTAY
Email (privacy and general contact): igoumenitsastay@gmail.com

See also our Cookie Policy and Terms of Use.