Last updated: 14 September 2026
This policy explains what personal data Aces Transfers & Tours collects when you book a transfer or tour or contact us, why we collect it, who we share it with, how long we keep it, and what rights you have.
1. Who we are
The controller of your personal data is:
| Company | ACES Transfers & Services P.C. (Ι.Κ.Ε.), trading as Aces Transfers & Tours |
| Address | 16 Syggrou Avenue, 117 42 Athens, Greece |
| Company registration (Γ.Ε.ΜΗ.) | 130057501000 |
| VAT number (Α.Φ.Μ.) | 800573916 |
| [email protected] | |
| Telephone | +30 697 889 2938 |
We are not required to appoint a Data Protection Officer. Privacy enquiries are handled directly at the address above.
2. What we collect
When you book a transfer or tour
- your name, email address and telephone number
- pick-up and drop-off addresses
- date and time of travel
- flight or ferry number, arrival and departure times
- number of passengers, and the ages of any children travelling, so that the correct child seat is fitted
- luggage details
- any special requirements you tell us about, such as accessibility needs
- the names of fellow travellers, where you give them to us, or where we are required by law to register them, as for minivan services
- the gender and nationality of each passenger, where required for the service
- your billing address, where required for the payment
When you contact us — your name, contact details and the content of your message.
When you visit our website — technical data recorded in our server logs, including IP address, browser type, device type, pages visited and time of visit, and data collected through cookies and similar technologies as described in section 7.
We do not collect your date of birth or the details of your identity card or passport, and we do not ask for them. We do not receive or store card details at any point.
If you tell us about a health condition, mobility requirement or dietary need so that we can accommodate it, that information may be special category data under Article 9 GDPR. We use it only to deliver the service you asked for, we share it only with the driver or partner who needs it, and we delete it once your journey is complete.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
| Preparing a quotation, confirming and delivering your booking, and communicating with you about it | Performance of a contract, or steps taken at your request before entering one — Article 6(1)(b) |
| Assigning a driver or partner operator and giving them the details needed to collect you | Performance of a contract — Article 6(1)(b) |
| Processing payment and issuing invoices and receipts | Performance of a contract, and legal obligation — Articles 6(1)(b) and 6(1)(c) |
| Keeping accounting and tax records | Legal obligation — Article 6(1)(c) |
| Answering enquiries that do not result in a booking | Legitimate interests: responding to people who contact us — Article 6(1)(f) |
| Keeping our website secure and preventing fraud | Legitimate interests: security of our systems and business — Article 6(1)(f) |
| Handling complaints and defending legal claims | Legitimate interests: establishing and defending our legal position — Article 6(1)(f) |
| Measuring how the website is used, through analytics cookies | Your consent — Article 6(1)(a) |
| Measuring the performance of our advertising, and showing you our ads on other platforms | Your consent — Article 6(1)(a) |
| Sending occasional service or offer emails, where you have asked to receive them | Your consent — Article 6(1)(a) |
| Accommodating a health, mobility or dietary requirement you have disclosed | Your explicit consent — Article 9(2)(a) |
Where we rely on your consent, you can withdraw it at any time. Withdrawal does not affect anything done before you withdrew it.
4. Who we share it with
We share your data only where it is necessary, and only to the extent necessary:
- the driver assigned to your journey, who receives your name, contact number, pick-up details and flight or ferry information
- partner operators, where your journey is carried out by a vehicle from one of the companies we work with; they receive the same limited set of details and are contractually required to use it only for your journey
- licensed tourist guides, where you have booked a guide, limited to your name, itinerary and any special requirements
- Alpha Bank, which processes your card payment through its Alpha e-Commerce platform; we never see your card details
- our website and email hosting provider, which stores our systems on our behalf
- our accountant, for invoices and statutory accounting records
- Google Ireland Limited, which provides the analytics and tag management tools used on our website (Google Analytics 4 and Google Tag Manager), where you have consented to analytics cookies
- Meta Platforms Ireland Limited, which provides the Meta pixel used to measure the performance of our advertising, where you have consented to marketing cookies
- our legal advisers, and public authorities, where we are required by law to disclose information or need to establish or defend a legal claim
We do not sell your data. We do not share it with anyone for their own marketing purposes.
5. Transfers outside the EEA
Your booking data is stored on servers located within the European Economic Area.
Two of the tools we use on our website involve transfers of data to the United States:
- Google Analytics 4 and Google Tag Manager, provided by Google Ireland Limited, which may transfer data to Google LLC in the United States
- the Meta pixel, provided by Meta Platforms Ireland Limited, which may transfer data to Meta Platforms, Inc. in the United States
Both providers are certified under the EU–US Data Privacy Framework. The European Commission decided in July 2023 that the United States offers an adequate level of protection for personal data transferred to organisations certified under that framework, so these transfers are made on the basis of that adequacy decision under Article 45 GDPR.
Neither tool loads unless you have given consent, so no transfer takes place if you decline non-essential cookies.
6. How long we keep it
| Data | Retention period |
| Invoices and accounting records | 10 years from the end of the financial year concerned, as required by Greek tax legislation |
| Booking records and related correspondence holding your personal details | 24 months from the date of travel, after which they are deleted |
| Enquiries that did not become bookings | 12 months from our last exchange |
| Health, mobility or dietary information | Deleted once the journey is complete |
| Complaints and any related documentation | 5 years from resolution |
| Marketing consent records | Until you withdraw consent, plus 12 months as evidence that consent was given |
| Website server logs | 14 days |
Where accounting law requires us to keep a record we cannot delete, we restrict its use to that legal purpose.
7. Cookies
Our website uses cookies. Cookies are small files stored on your device that allow the site to work and help us understand how it is used.
- Essential cookies are needed for the site to function — keeping your booking session active, remembering your cookie choices, and protecting the site against abuse. These do not require your consent and remain set even if you decline others.
- Analytics cookies help us understand which pages are visited and how the site performs. We use Google Analytics 4, loaded through Google Tag Manager. These are set only with your consent.
- Marketing cookies allow our advertising to be measured and allow you to be shown our ads on other platforms. We use the Meta pixel, which is operated by Meta and covers Facebook and Instagram. These are set only with your consent.
You can accept or decline non-essential cookies through the banner shown when you first visit, and change your choice at any time through the cookie settings link in the footer of every page. You can also delete or block cookies through your browser settings, though the site may not work properly if essential cookies are blocked.
8. Security
Access to booking data is limited to the people who need it to do their work. Our website runs over an encrypted connection. Payment is handled entirely by Alpha Bank on systems certified to PCI DSS, and card details never reach our systems. Partner operators and anyone else with access to your data are bound to keep it confidential.
9. Automated decision-making
We do not make decisions about you by automated means, and we do not profile you. Bookings and itineraries are handled by people.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and receive a copy
- rectify data that is inaccurate or incomplete
- erase your data, where we no longer have a lawful reason to keep it
- restrict how we use your data while a question about it is resolved
- object to processing based on our legitimate interests, and to object at any time to direct marketing
- portability — receive the data you gave us in a machine-readable format, or have it transferred to another controller
- withdraw consent at any time, where our processing is based on consent
To exercise any of these rights, email [email protected] from the address you used to book, or include enough detail for us to identify your booking. We respond within one month. If a request is complex we may extend that by a further two months and will tell you if we do. There is no charge, unless a request is manifestly unfounded or excessive.
11. Complaints
If you are unhappy with how we have handled your data, please contact us first at [email protected].
You also have the right to complain to the Greek data protection authority:
Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα)
- 1-3 Kifissias Avenue, 115 23 Athens, Greece
- Tel: +30 210 6475600
- Email: [email protected]
- www.dpa.gr
If you live in another EU member state, you may complain to the supervisory authority there instead.
12. Children
Our services are booked by adults. We do not knowingly collect data directly from children. Where children travel with you, we collect only their ages, and only so that the correct child seat is fitted.
13. Changes to this policy
We may update this policy. The current version is always published on this page, with the date it was last updated shown at the top. Material changes will be brought to your attention where we hold your contact details.
ACES Transfers & Services P.C., trading as Aces Transfers & Tours — 16 Syggrou Avenue, 117 42 Athens, Greece — Company registration (Γ.Ε.ΜΗ.) 130057501000 — VAT (Α.Φ.Μ.) 800573916