ZasTours: Excursions in Greece > Privacy & Cookie Policy

Privacy & Cookie Policy

Privacy policy statement

Last updated: 23 June 2026

This Privacy & Cookie Policy applies to the website zastours.com and the Zas Tours Android mobile application ("Zas Tours - Greek Excursions").

The website and mobile application are operated by ZAS TRAVEL O.E.

Zas Tours is a brand of ZAS TRAVEL O.E. and is not a separate legal entity.

In this Privacy & Cookie Policy, "Zas Tours", "we", "us" and "our" mean ZAS TRAVEL O.E., operating under the Zas Tours brand.

Our legal and contact details are:

Legal name: ZAS TRAVEL O.E.
Brand: Zas Tours
Registered address: Paraliaki 0, Chora Naxos, 84300 Naxos, Greece
Greek tax registration number (AFM): 081364955
Email: support@zastours.com

ZAS TRAVEL O.E. is the data controller responsible for the personal information processed through Zas Tours, except where another party is identified as an independent data controller.

Zas Tours processes personal information in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Greek Law 4624/2019, Greek Law 3471/2006 concerning electronic communications, and other applicable Greek and European data-protection legislation.

This policy explains how we collect, use, share, store and protect personal information when you:

- Visit zastours.com
- Use the Zas Tours Android mobile application
- Create or use a Zas Tours account
- Make or request a booking
- Contact Zas Tours
- Subscribe to marketing communications
- Submit a review, survey response or other content
- Otherwise interact with Zas Tours

Bookings are also subject to our General Booking Terms and Conditions and the conditions shown for the individual activity.

The activity Supplier's role

Zas Tours facilitates bookings for independent excursion, activity, transport and experience providers. These businesses are referred to in this policy as "Suppliers".

When you make a booking, Zas Tours may share the personal information needed to confirm and operate the activity with the relevant Supplier.

The Supplier may process that information as an independent data controller for purposes including:

- Managing your reservation
- Providing the activity
- Contacting you about meeting or pickup arrangements
- Complying with safety and legal obligations
- Handling an incident, complaint or insurance matter

A Supplier may have its own privacy policy explaining how it processes personal information.

Personal information we collect

The personal information collected depends on how you use Zas Tours.

Identity and contact information

This may include:

- Your name
- Email address
- Telephone number
- Country of residence
- Billing address
- Account username or identifier
- Preferred language

Booking and participant information

This may include:

- The activity booked or requested
- The booking date and activity date
- The number and type of participants
- Participant names and ages
- Pickup location
- Accommodation information where pickup is requested
- Booking preferences
- Luggage information
- Special requests
- Information needed to determine whether participants meet the activity requirements

Health, dietary and accessibility information

For some activities, you may choose or be required to provide information about:

- Allergies or dietary requirements
- Mobility or accessibility needs
- Pregnancy
- Medical conditions
- Swimming ability
- Fitness or other safety-related requirements

Zas Tours collects this information only where it is relevant to your request or reasonably necessary for the Supplier to assess or safely provide the activity.

Providing this information is normally optional. However, some information may be necessary for the Supplier to determine whether an activity can be safely provided. If necessary information is not provided, Zas Tours or the Supplier may be unable to accept or fulfil the booking.

Where this information qualifies as special-category personal data, it will be processed only with your explicit consent or where another lawful condition applies.

Where explicit consent is required, we will ask for it when the information is collected.

You may withdraw your consent. However, this may mean that Zas Tours or the Supplier can no longer provide the requested activity or arrangement.

You should provide sensitive information only where it is reasonably necessary.

Payment and transaction information

This may include:

- The amount paid
- Payment method
- Currency
- Transaction reference
- Payment status
- Billing information
- Refund and chargeback information
- Limited payment-card information provided by the payment processor, such as the card type and last four digits
- Information used to prevent payment fraud or unauthorised transactions

Zas Tours does not normally receive or store your complete payment-card number or card security code.

Complete payment credentials are processed by authorised payment providers such as Stripe or PayPal.

Account information

If you create an account, Zas Tours may process:

- Your login details
- Saved contact information
- Booking history
- Wishlist information
- Account preferences
- Communications associated with the account

Passwords are stored in protected form and are not visible to Zas Tours staff.

Communications and customer support information

When you contact Zas Tours, we may process:

- Your message
- Email and chat correspondence
- Telephone or messaging details
- Attachments and photographs
- Complaint information
- Records of assistance provided
- Communications with the Supplier concerning your booking

This may include communications sent through email, telephone, WhatsApp, Viber or another communication service you choose to use.

Reviews, surveys and customer content

If you leave a review, respond to a survey or submit other content, Zas Tours may collect:

- Your rating
- Written comments
- Photographs or other submitted content
- Information confirming that the review relates to a booking
- Your consent and publication preferences, where applicable
- Information used to identify fraudulent, duplicate or inappropriate reviews

Marketing information

This may include:

- Whether you subscribed to marketing communications
- Your marketing preferences
- The date and method of consent
- Whether you opened or interacted with a marketing message
- Your unsubscribe status

Website, application and device information

When you use the website or Android mobile application, Zas Tours may collect:

- Your IP address
- Device and browser type
- Operating system
- Application version
- Referring website
- Pages viewed
- Buttons or links used
- Approximate location derived from your IP address
- Dates and times of visits
- Session and cookie identifiers
- Booking attribution and advertising identifiers
- Technical error, performance and security information
- Your cookie and privacy choices

Some of this information is collected using cookies, pixels, software development kits and similar technologies.

Information provided about other participants

If another person makes a booking on your behalf, Zas Tours may receive information about you from that person, including your name, age, contact details and information relevant to the activity.

The person making the booking must be authorised to provide this information and should make this Privacy & Cookie Policy available to you.

Where Zas Tours contacts you directly using information received from another person or from a Supplier, we will provide or link to this policy no later than our first communication with you, unless an exception permitted by law applies.

If you provide information about another participant, you must be authorised to do so and should make this policy available to that person.

How personal information is collected

Zas Tours may collect personal information:

- Directly from you
- From another person making a booking on your behalf
- From the Supplier
- From payment providers
- From booking and technology providers
- Automatically through the website or Android mobile application
- From advertising, analytics and referral services
- From communication and customer-support providers

Information you must provide

Fields marked as required during booking, account registration or payment are necessary to enter into or perform the relevant contract.

If you do not provide required information, Zas Tours may be unable to:

- Process or confirm your booking
- Create or maintain your account
- Take or verify payment
- Provide your confirmation or voucher
- Arrange pickup or meeting information
- Provide customer support
- Process a cancellation or refund
- Meet a legal obligation

Other information is optional unless we explain that it is necessary for safety, legal compliance or the operation of a particular activity.

Why we use personal information

Zas Tours processes personal information only where there is a lawful basis for doing so.

To perform a contract or take steps before entering into a contract

Zas Tours may use personal information to:

- Process a booking request
- Confirm and manage a booking
- Collect or process payment
- Send booking confirmations and vouchers
- Arrange pickup or meeting information
- Communicate changes or cancellations
- Provide customer support
- Process cancellations and refunds
- Communicate with the Supplier
- Manage your account
- Respond to a request made before booking

Without the necessary information, Zas Tours may be unable to process or fulfil a booking.

To comply with legal obligations

Zas Tours may use and retain information to:

- Maintain accounting and tax records
- Respond to lawful requests from authorities
- Comply with consumer-protection obligations
- Prevent and report fraud or unlawful activity
- Maintain records required by tourism, company or payment regulations
- Respond to legal proceedings
- Meet data-protection and security obligations

For legitimate business interests

Where these interests are not overridden by your rights, Zas Tours may process information to:

- Operate and improve the website and Android mobile application
- Provide and improve customer support
- Understand how customers use Zas Tours
- Maintain website, account and payment security
- Prevent fraud, misuse and unauthorised bookings
- Manage disputes, complaints, chargebacks and legal claims
- Protect Zas Tours, its customers and Suppliers
- Maintain internal business records
- Invite customers to provide feedback or a review
- Verify that reviews relate to genuine bookings
- Measure the effectiveness of business operations
- Communicate with existing customers about their bookings

You may object to processing based on legitimate interests in the circumstances described below.

With your consent

Zas Tours relies on consent where required to:

- Send promotional email marketing
- Use optional analytics cookies
- Use advertising and remarketing cookies
- Process certain health, dietary or accessibility information
- Use customer photographs or content in ways that require separate permission

You may withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing that took place before consent was withdrawn.

To protect vital interests

In rare circumstances, Zas Tours may process or disclose information where reasonably necessary to protect the life, health or safety of you or another person.

Who receives personal information

Zas Tours may share personal information only where reasonably necessary and lawful.

Activity Suppliers

The Supplier receives the information needed to confirm, manage and operate the activity.

This may include participant names, contact details, pickup details and relevant safety, dietary or accessibility information.

Payment providers

Payment and transaction information may be processed by providers such as:

- Stripe
- PayPal
- Banks, card networks and other payment services involved in the transaction

These providers may process some information as independent data controllers under their own privacy policies.

Technology and service providers

Zas Tours may use providers that support:

- Website and application hosting
- Reservation and booking management
- Email delivery
- Customer support
- Communication services
- Cloud storage
- Security and fraud prevention
- Cookie consent management
- Analytics
- Advertising
- Review management
- Accounting and administration

Service providers acting on behalf of Zas Tours may process information only for the agreed service, subject to appropriate contractual, confidentiality and security requirements.

Some providers may also process information as independent data controllers for their own legal or operational purposes.

Professional advisers

Information may be shared with accountants, auditors, insurers, banks, legal advisers and other professional advisers where reasonably necessary.

Authorities and legal recipients

Zas Tours may disclose information where:

- Required by law
- Necessary to respond to a lawful request from an authority
- Necessary to establish, exercise or defend a legal claim
- Necessary to investigate or prevent fraud or unlawful activity
- Necessary to protect the safety, rights or property of customers, Suppliers, Zas Tours or another person

Business changes

If all or part of the business operated under the Zas Tours brand is reorganised, transferred, sold or merged, relevant information may be disclosed to advisers and prospective or actual successors, subject to confidentiality and data-protection requirements.

International data transfers

Some service providers used by Zas Tours may process personal information outside Greece or the European Economic Area.

Where personal information is transferred outside the European Economic Area, Zas Tours will use an appropriate legal safeguard where required, such as:

- A European Commission adequacy decision
- Approved standard contractual clauses
- Another transfer mechanism permitted by data-protection law

You may contact Zas Tours for further information about the safeguards used for a particular transfer.

Payment security

Payments are processed using specialist payment providers.

When you enter payment-card information, it is normally transmitted directly to the payment provider rather than stored by Zas Tours.

Payment providers maintain their own security, regulatory and fraud-prevention procedures.

Although Zas Tours takes reasonable security measures, no website, application or electronic transmission can be guaranteed to be completely secure.

Cookies and similar technologies

Cookies are small text files stored by a website on your browser or device.

Zas Tours and its service providers may also use pixels, tags, local storage, application identifiers, software development kits and similar technologies.

These technologies may be used to:

- Keep the website and application functioning
- Remember your preferences
- Maintain your session and shopping basket
- Protect forms and payment processes
- Record your privacy choices
- Measure website and application performance
- Understand how visitors use Zas Tours
- Attribute bookings to advertising or referral sources
- Show relevant advertising
- Prevent fraud and abuse

Strictly necessary cookies

Strictly necessary cookies are required to:

- Provide core website functions
- Maintain security
- Remember privacy choices
- Manage sessions and shopping baskets
- Process bookings and payments
- Prevent fraud

These cookies do not require consent where they are strictly necessary to provide the service requested by you.

Disabling them through your browser may prevent parts of the website from working correctly.

Preference cookies

Preference cookies may remember choices such as:

- Language
- Display settings
- Previous selections
- Other website preferences

Where consent is legally required, these cookies are used only after consent has been given.

Analytics cookies

Analytics tools help Zas Tours understand matters such as:

- How visitors find the website
- Which pages they visit
- How long they remain on the website
- How they interact with features
- Whether technical problems occur
- How the website and application can be improved

Analytics information may include cookie, advertising or device identifiers and should not automatically be treated as anonymous.

Optional analytics cookies are used only after the required consent has been obtained.

Advertising and remarketing cookies

With your consent, Zas Tours and its advertising partners may use cookies or similar technologies to:

- Measure advertising performance
- Connect a booking to an advertisement
- Limit how often an advertisement is shown
- Create advertising audiences
- Show advertising based on previous interactions with Zas Tours
- Understand which advertisements, campaigns or referral sources resulted in bookings

Advertising partners may include services provided by Google, Meta and similar platforms.

These providers may process information under their own privacy policies.

Managing your cookie choices

When you first visit the website, the cookie banner allows you to:

- Accept optional cookies
- Reject optional cookies
- Choose which optional categories to allow

Optional cookies and similar technologies are not activated before the required consent has been obtained.

You can change or withdraw your choices at any time using the cookie settings control available on the website.

Zas Tours may retain a record of your cookie choices where necessary to demonstrate and respect your consent preferences.

You can also delete or block cookies through your browser settings. Browser-level blocking may affect website functionality and may not control all application or device technologies.

A current list of cookies and similar technologies, including their providers, purposes and storage periods, is available through the website's cookie settings tool.

Analytics and advertising

Zas Tours may use analytics and advertising services to measure use of the website and Android mobile application and understand the effectiveness of advertising campaigns.

Where these services use non-essential cookies, pixels or similar technologies, they are activated only after the required consent has been obtained.

With consent, information such as an advertising click identifier may be stored with a booking so that Zas Tours can understand which advertising resulted in a sale.

Zas Tours does not sell personal information to advertisers.

Maps, messaging and third-party content

Some pages may contain or link to:

- Maps
- Videos
- Social-sharing tools
- Reviews
- Messaging services
- Other content or services provided by third parties

When you choose to load, open or use an external service, the relevant provider may receive information such as your IP address, device information and the page you are viewing.

If you contact Zas Tours through WhatsApp, Viber or another external messaging service, that provider will process information under its own privacy policy.

If you use a map, social network, video platform or other external service, the privacy policy and terms of that provider will apply to its processing.

Marketing communications

Zas Tours sends promotional email marketing only where you have given your consent.

You may unsubscribe at any time by:

- Using the unsubscribe link in a marketing email
- Changing any available account preferences
- Contacting Zas Tours

Unsubscribing from marketing does not prevent Zas Tours from sending essential service communications relating to a booking, payment, refund, security issue or legal obligation.

Zas Tours may retain limited information on a suppression list to ensure that your marketing opt-out is respected.

Booking, service and review communications

Zas Tours may send communications necessary to:

- Acknowledge or confirm a booking
- Request information needed for the booking
- Provide a confirmation or voucher
- Communicate meeting or pickup details
- Provide updates or cancellation information
- Process a refund
- Respond to a support request
- Communicate a safety or security issue

These communications are not marketing communications and may still be sent where they are necessary to manage your booking or comply with legal obligations.

After an activity, Zas Tours may send a limited request for feedback or a review based on its legitimate interest in assessing and improving its services.

You may object to non-essential review invitations by contacting Zas Tours.

How long we keep personal information

Zas Tours keeps personal information only for as long as reasonably necessary for the purpose for which it was collected.

Retention periods depend on the type of information and may be determined by:

- The duration of the booking or customer relationship
- Legal, tax and accounting obligations
- Payment and chargeback periods
- Complaint and legal limitation periods
- Fraud-prevention and security needs
- The period for which consent remains valid
- The need to establish, exercise or defend legal claims

For example:

- Booking and transaction records may be retained for the period required by tax, accounting and consumer law
- Account information may be retained until the account is deleted, followed by limited retention where legally necessary
- Customer-support communications may be retained for as long as needed to resolve the issue and manage possible claims
- Marketing information is retained until consent is withdrawn or the information is no longer needed
- A limited suppression record may be retained after an unsubscribe
- Review content may remain published until it is removed, is no longer relevant or must legally be deleted
- Cookie durations are shown through the cookie settings tool
- Consent records may be retained for as long as reasonably necessary to demonstrate compliance

When personal information is no longer required, it will be deleted, anonymised or securely restricted.

Information deleted from active systems may remain temporarily in protected backup systems until those backups are overwritten according to the normal backup cycle. Information retained only in backups will not be used for ordinary business purposes.

Security and personal data breaches

Zas Tours uses reasonable technical and organisational measures designed to protect personal information against:

- Unauthorised access
- Loss
- Misuse
- Alteration
- Disclosure
- Destruction

Measures may include:

- Encrypted website connections
- Access controls
- Protected passwords
- Software and server security
- Backups
- Payment processing through specialist providers
- Staff access limited according to business need

No method of storing or transmitting information is completely secure. Zas Tours cannot guarantee absolute security.

If a personal data breach occurs, Zas Tours will assess the possible risks and notify the Hellenic Data Protection Authority where required.

Where a personal data breach is likely to result in a high risk to the rights and freedoms of affected individuals, Zas Tours will also inform those individuals without undue delay where required by the GDPR.

Your rights under the GDPR

Under the GDPR, and subject to the conditions and exceptions established by law, you may have the right to:

- Request access to the personal information Zas Tours holds about you
- Request correction of inaccurate or incomplete personal information
- Request deletion of your personal information, also known as the right to erasure or the right to be forgotten
- Request restriction of the processing of your personal information
- Object to processing based on legitimate interests
- Object at any time to the use of your personal information for direct marketing
- Request transfer of certain information you provided to us in a structured, commonly used and machine-readable format
- Withdraw consent where processing is based on consent
- Receive information about safeguards used for international data transfers
- Lodge a complaint with a data-protection supervisory authority
- Not be subject to a decision based solely on automated processing where it produces legal or similarly significant effects

The right to data portability generally applies where processing is automated and is based on your consent or a contract.

These rights are not absolute and may be subject to legal conditions or exceptions.

Right to erasure or right to be forgotten

You may ask Zas Tours to delete personal information relating to you where, for example:

- The information is no longer necessary for the purpose for which it was collected
- You withdraw your consent and there is no other legal basis for continuing to process the information
- You object to the processing and there are no overriding legitimate grounds for continuing it
- The information has been processed unlawfully
- The information must be deleted to comply with a legal obligation

Zas Tours may not be able to delete all requested information where its continued retention is necessary, including:

- To comply with tax, accounting or other legal obligations
- To establish, exercise or defend a legal claim
- To manage a payment dispute, chargeback, complaint or fraud investigation
- To protect the rights of another person
- For another reason permitted by the GDPR

Where complete deletion is not legally possible, Zas Tours will retain only the information that remains reasonably necessary and will restrict its use where appropriate.

How to exercise your rights

To exercise any of your data-protection rights, you may:

- Email support@zastours.com
- Use our data removal request form

Please explain which right you wish to exercise and provide enough information for us to identify the relevant personal information.

Zas Tours may request reasonable information to verify your identity before responding to your request.

Data-protection requests are normally handled free of charge.

Where permitted by the GDPR, Zas Tours may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive.

Zas Tours will normally respond without undue delay and within one month of receiving a valid request.

Where permitted by the GDPR, this period may be extended by up to two additional months because of the complexity or number of requests. If an extension is required, you will be informed within the first month.

Where required, Zas Tours will communicate a correction, restriction or erasure to recipients to whom the personal information was disclosed.

If you are dissatisfied with our response, you may lodge a complaint with the Hellenic Data Protection Authority or another competent supervisory authority.

Automated decision-making

Zas Tours does not normally make decisions based solely on automated processing that produce legal or similarly significant effects.

Automated security and fraud-detection tools may flag a booking or transaction for review.

Payment providers and fraud-prevention providers may independently use automated systems to approve, decline or review transactions under their own privacy policies and legal responsibilities.

Children

Bookings must be made by an adult.

Zas Tours may process limited information about children where an adult includes them as participants in a booking.

The adult making the booking must be authorised to provide this information.

Zas Tours does not knowingly use children's personal information for targeted advertising.

Third-party websites and services

The Zas Tours website or Android mobile application may contain links to:

- Suppliers
- Payment providers
- Social media platforms
- Maps
- Messaging services
- External booking or travel services
- Other third-party websites

Zas Tours does not control the privacy practices of independent third parties.

You should review their privacy policies before providing personal information directly to them.

Changes to this policy

Zas Tours may update this Privacy & Cookie Policy to reflect:

- Changes in law
- Changes to the website or Android mobile application
- New providers or technologies
- Changes to booking or payment processes
- Necessary clarifications

The latest version will be published on this page with an updated revision date.

Where a change materially affects how existing personal information is used, Zas Tours will provide additional notice where required.

Complaints and the supervisory authority

Please contact Zas Tours first if you have a question or concern about the use of your personal information.

You also have the right to lodge a complaint with the data-protection supervisory authority in Greece:

Hellenic Data Protection Authority
Kifisias 1-3
115 23 Athens
Greece

Website: https://www.dpa.gr/en

You may also contact the data-protection supervisory authority in the European Union or European Economic Area country where you normally live or work.

Contacting Zas Tours

ZAS TRAVEL O.E., operating under the Zas Tours brand
Paraliaki 0
Chora Naxos
84300 Naxos
Greece

Email: support@zastours.com