Last updated: November 2026
BenLeToni Tours works mainly with travel agencies, tour operators and corporate clients. This policy explains which personal data we process when you visit this website, send us an enquiry or book a programme with us, why we do it, and which rights you have under the EU General Data Protection Regulation (GDPR).
MPENLETONI TOURS GENIKOS TOURISMOS E.P.E. (Greek limited liability company), trading as BenLeToni Tours
7-9 Tideos str., 11635 Athens, Greece
Tel. +30 210 7010 629
Email: contact@benletoni-tours.gr
Licensed tour operator, registry no. (ΜΗΤΕ) 0206E600005968Y0 · IATA no. 2721221-6
For any question about your data, write to us at the address above with the subject “Data protection”.
This website is hosted by Top.Host (Enartia Single Member S.A., 66 Ionias Avenue, 71305 Heraklion, Crete, Greece), on servers in the European Union (Belgium). Our web agency, VELA digital, maintains the website and manages the hosting account on our behalf. Each time a page is opened, the server automatically records the data your browser sends: IP address, date and time, the page requested, the referring page, browser type and operating system. We need this data to deliver the website and keep it secure. The legal basis is our legitimate interest in a stable and secure website (Art. 6(1)(f) GDPR). The log files are deleted regularly and are not combined with other data. We have data processing agreements with our hosting provider and our web agency (Art. 28 GDPR).
All connections to this website are encrypted (SSL/TLS).
We do not use analytics, tracking, advertising or social media plugins on this website.
We only use cookies that are strictly necessary for the website to work, for example a cookie that remembers the language you chose (wp-wpml_current_language, stored for one day). These cookies do not require your consent (Art. 4(5) of Greek Law 3471/2006, which implements Art. 5(3) of the ePrivacy Directive; legal basis Art. 6(1)(f) GDPR). You can delete cookies at any time in your browser settings.
When you send us an enquiry, we process the details you give us: the name of your travel company, website, address, city and country, your first and last name, email address, phone number, subject and message. We use them to answer your enquiry and to prepare an offer. Enquiries from the contact form are sent to our email inbox (Google Workspace, see section 8) and stored in the website database.
The legal basis is Art. 6(1)(b) GDPR, because the enquiry is the first step towards a contract. For other enquiries, the legal basis is our legitimate interest in answering you (Art. 6(1)(f) GDPR). Fields marked as required are needed so that we can reply.
If no business results from an enquiry, we delete it no later than 24 months after our last contact.
When a programme is booked, we process the data of your contact persons and the passenger list. Depending on the services, this includes names and, where hotels, ferries, airlines or archaeological sites require it, date of birth, nationality, passport or ID details and room allocation. The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR where the law requires it, for example hotel guest registration.
Dietary, medical or mobility requirements are health data. We process them only if they are provided to us, and only to arrange the services concerned (Art. 9(2)(a) GDPR).
The booking agency is responsible for informing its travellers that their data is passed on to us and for having a legal basis to do so.
The maps on this website are images stored on our own server. No data is sent to Google when a page loads. If you click on a map, Google Maps opens in a new tab and the privacy policy of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland applies.
The same applies to the links to our Facebook and LinkedIn pages and to the brochure download (Google Drive): data is only transferred to these providers once you click the link.
The fonts used on this website are stored on our own server. No connection is made to Google Fonts or any other external font service when a page loads.
We pass on personal data only where this is necessary:
We do not sell personal data. The website itself is hosted in the European Union. Our email is provided by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); Google may also process data in the USA. Such transfers are covered by the EU–US Data Privacy Framework and the EU standard contractual clauses (Art. 45 and 46 GDPR). If a booked programme includes services outside the EEA, we transfer only the data needed for those services (Art. 49(1)(b) GDPR).
After these periods, the data is deleted.
You have the right to:
Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interest, you can object at any time on grounds relating to your particular situation.
To exercise your rights, simply write to contact@benletoni-tours.gr.
Right to lodge a complaint: you can complain to a data protection supervisory authority. Our lead authority is the Hellenic Data Protection Authority, Kifisias 1-3, 11523 Athens, Greece, www.dpa.gr. You can also contact the authority in the country where you live or work.
We do not use automated decision-making or profiling (Art. 22 GDPR). We update this policy whenever our website or the law changes. The current version is always available on this page.
