1. Data Controller

• Responsible Entity: Evribia Consulting LTD
• Registration number: 60084212L
• Legal form: Private Limited Company (Ltd)
• Registered office: Efesou 9, 5310, Paralimni, Famagusta, Cyprus
• Email: [email protected]

Hereinafter referred to as the "Controller".

Evribia Consulting LTD is responsible for processing the personal data collected through the Website.

2. Applicable Regulations

Data processing is carried out in accordance with:

• Regulation (EU) 2016/679 (GDPR)
• Cypriot data protection legislation
• European regulations regarding electronic commerce

3. Purposes of Processing and Legal Basis

3.1 Management of bookings and purchases

Includes: Order management, Payment processing, Ticket issuance and delivery, After-sales customer service, Communication with tourism providers.

Legal basis: Performance of a contract (Art. 6.1.b GDPR)

3.2 Customer service and inquiries

Management of requests sent through forms or email.

Legal basis: Consent (Art. 6.1.a GDPR) or pre-contractual measures.

3.3 Fraud prevention and security

Data processing for: Detection of fraudulent transactions, Prevention of misuse, System protection.

Legal basis: Legitimate interest (Art. 6.1.f GDPR)

3.4 Sending own commercial communications

Information about similar products or services.

Legal basis: Consent (Art. 6.1.a GDPR), or Legitimate interest in the case of existing customers (Art. 6.1.f GDPR). The User may object at any time via the unsubscribe link included in each communication.

3.5 Statistical analysis and Website improvement

Use of analytics tools to improve user experience.

Legal basis: Consent (when required) or legitimate interest.

4. Categories of Data Processed

The following categories may be processed:

• Identification data: first name and last name
• Contact data: email address
• Transaction data: purchased product, amount, date
• Technical and browsing data: IP address, browser, device
• Data necessary for fraud prevention

Special categories of data are not processed (Art. 9 GDPR).

5. Obligation to Provide Data

The data requested to finalize a purchase is mandatory. Refusal to provide it will prevent the provision of the service.

6. Data Retention

Data will be retained for:

• Contractual and tax data: up to 7 years (in accordance with applicable tax and commercial regulations).
• Marketing data: until the User withdraws their consent or objects to the processing.
• Browsing data: as established in the Cookie Policy.
• Fraud-related data: as long as legal or contractual risk exists.

Subsequently, it will be blocked and deleted in accordance with current regulations.

7. Recipients and Data Sharing

Data may be communicated to:

7.1 Essential service providers: Tourism providers, Payment gateways, Technology providers, Web hosting services. They act as data processors under contract in compliance with Art. 28 GDPR.

7.2 Public authorities: When a legal obligation exists.

Personal data is not sold to third parties.

8. International Data Transfers

Some technology providers may be located outside the European Economic Area. In such cases, Standard Contractual Clauses approved by the European Commission will apply, and additional security measures will be adopted where appropriate.

9. Automated Decisions and Profiling

Evribia Consulting LTD may use automated systems for fraud detection and statistical analysis. No automated decisions are made that produce significant legal effects for the User under the terms of Article 22 GDPR.

10. Minors

The Website is not directed to individuals under 18 years of age. We do not knowingly collect data from minors without authorization from their legal representatives.

11. User Rights

The User can exercise the following rights: Access, Rectification, Erasure (Right to be forgotten), Restriction of processing, Data portability, Objection, Withdrawal of consent.

To exercise them, you can write to: [email protected]

If you consider that your rights have not been respected, you can file a complaint with the Office of the Commissioner for Personal Data Protection (Cypriot Data Protection Authority): https://www.dataprotection.gov.cy

You may also contact the data protection authority of your country of residence within the European Union.

12. Data Security

Evribia Consulting LTD applies appropriate technical and organizational measures to ensure: SSL encryption in communications, Use of secure payment gateways, Restricted access control, Protection against unauthorized access.

13. Cookie Policy

The Website uses first-party and third-party cookies. For more information on the use of cookies, configuration, and withdrawal of consent, please consult our Cookie Policy.

14. Modifications

Evribia Consulting LTD may update this Policy to adapt it to regulatory or technical changes. The current version will always be available on the Website.

15. Record of Processing Activities

Evribia Consulting LTD maintains a Record of Processing Activities in accordance with Article 30 of the GDPR, documenting the categories of data processed, purposes, recipients, international transfers, and security measures applied.

16. Detailed Legal Basis by Type of Processing

For each processing purpose described in Section 3, Evribia Consulting LTD has identified and documented the applicable legal basis pursuant to Article 6 of the GDPR, as detailed in that section.

17. Blocking and Erasure of Data

When erasure is applicable, data will be blocked and kept exclusively at the disposal of competent authorities during the applicable legal statute of limitations, after which it will be permanently deleted.

18. Profiling

Evribia Consulting LTD does not carry out intrusive commercial profiling or automated decisions with legal effects based on the User's personal preferences.

The automated systems used are limited to:

• Fraud detection
• Aggregated statistics
• Technical service optimization

19. Exercise of Rights

Requests must be sent to: [email protected]

The request must include:

• Full name
• Copy of identification document (when necessary for verification)
• The specific right you wish to exercise

The Controller will respond within a maximum period of one month, in compliance with Art. 12 GDPR.

20. Out-of-Court Dispute Resolution

Without prejudice to the right to appeal to the competent supervisory authority, the User may use alternative dispute resolution mechanisms available within the European Union when applicable.

21. Applicable Legislation

This Policy shall be governed by the laws of the Republic of Cyprus and by Regulation (EU) 2016/679 (GDPR).

22. Legitimate Interest and Right to Object

Where data processing is based on the legitimate interest of Evribia Consulting LTD (e.g., fraud prevention, system security, or sending communications to existing customers), a corresponding balancing test has been conducted, ensuring that such interests do not override the fundamental rights and freedoms of the User.

The User may object at any time to processing based on legitimate interest by sending a request to [email protected].

23. Data Protection Officer

Evribia Consulting LTD is not required to appoint a Data Protection Officer under Article 37 of the GDPR, as it does not conduct processing activities that require it due to their nature, scope, or purpose.

24. Accuracy and Updating of Data

The User guarantees that the personal data provided is true, accurate, and up to date. The User undertakes to communicate any modifications to it.

Evribia Consulting LTD shall not be held liable for any damages resulting from inaccuracies or the lack of updating of the data provided.

25. Retention for Defense Against Claims

Regardless of the ordinary retention periods indicated above, Evribia Consulting LTD may retain certain personal data duly blocked when necessary for:

• The formulation, exercise, or defense of claims.
• Compliance with legal obligations.
• Addressing requirements from competent authorities.

This data will remain blocked during the applicable legal statute of limitations and will be permanently deleted once those periods have expired.

26. Communications in the Event of Corporate Operations

In the event of a merger, acquisition, corporate restructuring, asset transfer, or any corporate operation involving the transmission of the business or part thereof, personal data may be communicated to the resulting or acquiring entity, always ensuring:

• Continuity in the application of this Privacy Policy.
• Compliance with the GDPR.
• The adoption of appropriate security measures.

The User will be informed if such communication significantly affects their rights.

27. Limitation of Liability in Technological Environments

Evribia Consulting LTD adopts appropriate technical and organizational measures to protect personal data. However, it cannot guarantee the absolute invulnerability of technological systems against unlawful access, cyberattacks, or other acts carried out by third parties outside its reasonable control.

In the event of a security breach involving a risk to the User's rights and freedoms, action will be taken in accordance with the provisions of Articles 33 and 34 of the GDPR.

28. Contractual Consistency

This Privacy Policy must be interpreted together with the Terms and Conditions of the Website. Evribia Consulting LTD acts as an intermediary in the commercialization of tourism activities, without prejudice to its status as a Data Controller regarding the personal data collected through the Website.

29. Data Obtained from Third Parties

In certain cases, Evribia Consulting LTD may receive personal data from third-party providers linked to the provision of the contracted service (for example, tourism providers or payment platforms).

In such instances, this data will be processed exclusively for the proper execution of the contract and in accordance with this Privacy Policy.

30. Processing by Tourism Providers

The tourism providers who ultimately deliver the contracted activity may process certain personal data of the User as independent data controllers, in accordance with their own privacy policies.

Evribia Consulting LTD shall not be held liable for the processing carried out directly by said providers once the data has been communicated for the proper provision of the service.

31. Transactional Communications

Certain communications related to purchase management, confirmations, modifications, incidents, or relevant information about the contracted activity are mandatory and cannot be canceled while an active contractual relationship exists.