Privacy
Last updated 11 Oct 2026. GDPR (EU 2016/679) and Greek Law 4624/2019. Controller contact: market@koglabs.com.
Who is the controller
The Crete Activities site operator controls how your personal information is used. You can write to market@koglabs.com about your information. The service is for people in the European Union, with a focus on Crete, Greece. Your information is hosted in the European Union.
What information is kept
- Your account. Your name, email, protected password, account type, optional phone and photo, and last login time. Short-lived confirmation and password reset details are also kept.
- Your requests. Your activity, session or requested date and time, participant counts, child ages, extras, total price and request history. Your lead traveller name, phone and participant notes are also kept.
- Your payment. Payment is due on arrival. No card or bank details are collected or stored.
- Your messages. Messages that you send about a activity or trip.
- Your activity. Ratings, review text, saved activities and notices shown in your account.
- Business pages. Business name, public contact details, location, activities and photos. A claimed business page is connected to its owner's account.
- Security information. A login cookie, your internet address, browser details and records of important site-team actions. This information helps keep the service secure and investigate misuse.
Why your information is used
- Your account, requests and messages are needed to provide the service you ask for. This use is necessary for your contract (GDPR Article 6(1)(b)).
- Security records and public business details help prevent misuse and deliver requests. This use supports a legitimate interest in a safe, accurate service (Article 6(1)(f)).
- Some records may be kept or shared when Greek or EU law requires it (Article 6(1)(c)).
No marketing email is sent. Account and booking emails are service messages.
Where the information comes from
Most information comes from you when you create an account, send a request or use the site. Providers provide their activity and contact details. An unclaimed business page uses information already available to the public and shows that status on the page.
Who sees it
The provider sees your request, your participant notes and, after confirmation, your lead traveller details and your messages to that business. The site team can see requests when support or safety work requires it. This includes requests for unclaimed businesses. The EU hosting provider keeps the service online. The email delivery provider receives only the information needed to send service messages. If email delivery is unavailable, no email is sent. Your personal information is not sold.
How long information is kept
Your account stays until you ask for deletion. Request and message details stay while the activity can be disputed. Required financial records stay for the period set by Greek law. An unused email confirmation expires after 24 hours. An unused password reset link expires after one hour. Security logs are removed on a rotating schedule. A legal duty or active dispute can delay deletion.
Cookies
A necessary login cookie keeps you signed in for up to 30 days. The pages covered by this notice do not use advertising cookies or third-party analytics cookies.
Your rights
You can ask to access, correct, delete, restrict or receive a copy of your personal information. You can object when legitimate interest is the reason for its use. Write to market@koglabs.com. You can complain to the Hellenic Data Protection Authority at www.dpa.gr or to the privacy authority in your EU country.
Children
You must be at least 16 to use the site. You must follow the minimum participant age on each activity.
Changes
Important changes appear here with a new date. If a change needs your consent, you are asked before it applies to you.
Related: Terms.