Privacy Policy

1. Who we are (Data Controller)

The data controller for the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Greek Law 4624/2019 is Aegean Lane Media Ltd., Company No. 14872306, registered office 42 Voukourestiou Street, Kolonaki, Athens 106 71, Greece. We publish the website curiouslanebrowsng.lifestyle ("the Site"). Throughout this policy, "we", "us" and "our" refer to Aegean Lane Media Ltd.

General privacy enquiries: [email protected]. Postal enquiries should be addressed to the Data Protection Officer at the registered office above and marked "Data Protection".

2. The personal data we collect

We deliberately operate a low-data website. We do not sell personal data, we do not operate advertising networks, and we do not build advertising profiles. The categories of data we may process are:

• Contact form data. Your full name, email address, optional telephone number, enquiry type, hotel of interest, travel dates and the free-text content of your message, together with the consent flags you set.
• Newsletter data. If you opt in, your email address and the date, time and source of the opt-in.
• Correspondence. Emails you send to any of our published addresses, including headers and attachments.
• Technical and server data. IP address (truncated where analytics are enabled), user-agent string, referring URL, requested pages, response codes and timestamps, recorded in standard web server logs for security and diagnostics.
• Consent and preference data. Your cookie consent choice, stored locally in your browser via the localStorage keys cookieConsent, cookieConsentChoice, cookieConsentPrefs and cookieConsentDate.

We do not knowingly collect special category data (health, religion, biometrics, political opinions, sexual orientation) and ask that you do not include such information in free-text messages. If accessibility requirements make some health information necessary to answer your question, we process it only with your explicit consent and delete it once the enquiry is closed.

3. Lawful bases for processing

We rely on the following lawful bases under Article 6 GDPR:

• Consent (Art. 6(1)(a)): newsletter subscription, optional analytics and functional cookies, and any processing of special category data you volunteer.
• Legitimate interests (Art. 6(1)(f)): responding to editorial enquiries, maintaining the security and integrity of the Site, preventing abuse and spam, and producing aggregate readership statistics. We have assessed that these interests are not overridden by your rights and freedoms, particularly because the processing is minimal and non-intrusive.
• Legal obligation (Art. 6(1)(c)): retention of accounting and tax records, and compliance with lawful requests from competent authorities.

4. How we use your data

Data collected through the contact form is used solely to answer your enquiry, to follow up if clarification is needed, and to maintain an internal record of the question so that recurring themes can inform our editorial coverage. Newsletter data is used only to send the quarterly Athens & Riviera letter. Technical log data is used to detect and mitigate attacks, diagnose faults and understand load. Consent data is used to honour your cookie preferences on subsequent visits.

We do not use automated decision-making or profiling that produces legal or similarly significant effects, as described in Article 22 GDPR.

5. Cookies and similar technologies

The Site sets a minimal number of cookies and local storage entries. Strictly necessary items load automatically because the Site cannot function without them. Analytics and functional items load only after you grant consent through the banner, and you may withdraw or change that consent at any time by clearing your browser storage for this domain and reloading the page. Full detail, including a table of every cookie and its lifetime, is published in our Cookie Policy.

6. Third-party processors and recipients

We keep our supply chain short. The categories of recipient are:

• Hosting and content delivery. Our hosting provider stores the Site files and server logs on servers located within the European Economic Area.
• Email delivery. A transactional and newsletter email provider processes your address to deliver messages you have requested.
• Web font delivery. Typefaces are requested from Google Fonts. When your browser requests a font file, Google receives your IP address and user-agent as an inherent part of that HTTP request.
• Map display. The Contact page embeds a Google Maps frame. Loading that frame transmits your IP address to Google and may set Google cookies under Google's own policies.
• Image delivery. Photography is served from a third-party image content delivery network; requests include your IP address and user-agent.
• Optional analytics. If you consent, a privacy-oriented analytics provider processes truncated IP addresses and page-view events to produce aggregate statistics.

Each processor operates under a written data processing agreement incorporating Article 28 GDPR obligations. Where a transfer outside the EEA is unavoidable, it is made under the European Commission's Standard Contractual Clauses together with supplementary technical measures, and a transfer impact assessment is held on file.

7. Retention periods

• Contact form enquiries and related correspondence: 24 months from the date of the last exchange, then permanent deletion.
• Newsletter subscriptions: until you unsubscribe, plus 12 months in a suppression list so that we do not accidentally re-add you.
• Server access logs: 90 days, then automatic deletion.
• Aggregate analytics data: 14 months in non-identifying form.
• Accounting records: as required by Greek tax law, currently five years from the end of the relevant fiscal year.

8. Your rights under the GDPR

If you are in the EEA or the United Kingdom you have the right to: request access to the personal data we hold about you; request rectification of inaccurate data; request erasure ("the right to be forgotten"); request restriction of processing; object to processing based on legitimate interests; receive your data in a portable, machine-readable format; and withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any right, write to [email protected]. We will respond within one calendar month, extendable by two further months for complex requests, in which case we will tell you within the first month. We may ask for information to verify your identity; we will not use that information for any other purpose.

You also have the right to lodge a complaint with a supervisory authority. In Greece this is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifissias 1-3, 115 23 Athens, dpa.gr. We would, however, appreciate the chance to resolve your concern first.

9. Rights of California residents (CCPA/CPRA)

If you are a California resident you have the right to know the categories and specific pieces of personal information collected, the categories of sources,