Last updated: October 7, 2026.
This Privacy Policy explains how My Greece Experience (“we”, “us” or “the website”) processes personal data when you visit mygreeceexperience.com, contact us, submit a comment or form, subscribe to a website feature, or otherwise interact with the website. It is intended to provide the information required by applicable data-protection law, including Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”) where applicable.
1. Data controller and contact details
The operator of My Greece Experience is the controller of personal data processed directly for the purposes described in this policy. The website is available at https://mygreeceexperience.com.
For privacy requests, questions about this policy or the exercise of data-protection rights, contact: mygreeceexperience@gmail.com.
Some external services used in connection with the website may act as processors on our behalf, while others may act as independent controllers for their own purposes. Their role depends on the service and the circumstances of the processing.
2. Scope of this Privacy Policy
This policy applies to personal data processed through My Greece Experience. It does not govern independent third-party websites, booking platforms, social networks, transport providers, attractions, accommodation providers or other external services reached through links from our website. Those third parties apply their own privacy notices and terms.
3. Categories of personal data we may process
Data you provide directly
- Contact data: for example your name and email address when you contact us.
- Message and correspondence data: the content of emails, correction requests, partnership enquiries, privacy requests and other communications.
- Comment data: if comments are enabled, information entered in the comment form, such as name, email address, website URL and the comment itself.
- Form and subscription data: if a contact form, newsletter or subscription function is used, the information requested by that feature, which may include an email address and the content of a submission.
Technical, device and usage data
When you visit the website, technical information may be processed automatically by the hosting environment, WordPress and enabled security, anti-spam or statistics services. This may include IP address, date and time of access, requested URL, referring URL, browser type, operating system, device information, language, country inferred from IP address, server logs, error data and information about interactions with pages or links.
Cookie and similar-technology data
Cookies, pixels, local storage or similar technologies may be used for website operation, security, preferences, comments, authentication and, where permitted, audience measurement. Details are provided in our Cookie Policy.
The website’s CMP stores a first-party consent-preference cookie named mge_consent_v1 for up to 180 days. It records the CMP version, timestamp and category choices so that the website can remember and apply the visitor’s decision. Optional categories are off by default.
Affiliate and outbound-link data
The website contains affiliate and other outbound links, including links to Booking.com. A link may contain an affiliate identifier so that a third party can attribute an eligible booking or purchase to My Greece Experience. When you follow an external link, the destination service may receive the referring page, your IP address and other technical data and may use its own cookies or identifiers under its own privacy and cookie rules.
4. Sources of personal data
We obtain personal data primarily from you when you communicate or interact with the website, and automatically from your browser or device when the website is accessed. Certain technical or security information may also be generated by our hosting, WordPress, Jetpack, Akismet or related service providers when they provide website functionality.
5. Purposes and legal bases for processing
| Purpose | Typical data | Legal basis under the GDPR, where applicable |
|---|---|---|
| Provide, maintain and secure the website | Technical data, logs, IP address, security events | Legitimate interests in operating a secure and reliable website; legal obligation where applicable |
| Respond to enquiries and correspondence | Name, email address, message content | Legitimate interests in communicating with readers; steps requested before entering into a contract where relevant |
| Manage comments and prevent spam or abuse | Comment, name, email, IP address, user agent and anti-spam signals | Legitimate interests in protecting the website and maintaining useful discussions |
| Provide subscriptions or requested communications | Email address and subscription information | Consent where required, or performance of a requested service as applicable |
| Audience measurement and website statistics | Page views, referring URL, IP address, browser/device information, country and related event data | Consent when required by ePrivacy/data-protection rules; otherwise a lawful basis available under applicable law for strictly limited measurement |
| Affiliate attribution and external booking links | Affiliate identifiers and click/referral information handled by the destination service | Our legitimate interests in funding the website; any third-party tracking requiring consent is subject to applicable consent requirements |
| Establish, exercise or defend legal claims and comply with law | Relevant records and correspondence | Legal obligation and/or legitimate interests in protecting legal rights |
Where processing relies on consent, consent may be withdrawn at any time for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
6. Whether providing data is mandatory
You can generally browse the public website without directly providing your name or email address. Information requested in a contact form, comment form or subscription field may be necessary to provide the function you choose to use. If required information is not provided, we may be unable to answer a request, publish a comment, process a privacy request or provide the requested feature.
7. WordPress
My Greece Experience is built with WordPress. WordPress may use technical cookies for login, administration, preferences and, where a visitor expressly chooses it, remembering comment information. Logged-in users and administrators are subject to additional authentication and preference cookies. More detail is provided in our Cookie Policy.
8. Jetpack and Automattic services
The website has Jetpack enabled, including features that may include website statistics, protection, contact forms and subscriptions. These services are provided by Automattic and may process information about visitors in order to provide the relevant functionality.
Jetpack Stats: Jetpack Stats is installed but is disabled in this database configuration so that audience-measurement tracking does not run before consent. If the feature is re-enabled in the future, it may process information such as IP address, WordPress.com user ID and username when logged in to WordPress.com, user agent, visiting URL, referring URL, event timestamp, browser language and country code. According to Jetpack’s published privacy information, Stats logs containing directly identifying information such as IP addresses may be retained by Automattic for approximately 28 days when the feature is active.
Automattic’s information for visitors to sites using Jetpack and related services is available at Automattic’s Privacy Notice for Visitors to Users’ Sites, and Jetpack-specific information is available through the Jetpack Privacy Center.
9. Akismet anti-spam
If you submit a comment, Akismet may process information needed to detect spam, typically including the commenter’s IP address, user agent, referrer, site URL and information entered in the comment form such as name, email address and comment content. Akismet states that most spam-related data is retained for relatively short periods, generally between two weeks and ninety days, depending on the data and purpose. Further information is available in the Akismet Privacy Policy.
10. Gravatar
Where WordPress comments and Gravatar integration are used, an anonymised hash derived from the email address associated with a comment may be sent to the Gravatar service to check whether a profile image is associated with that address. After a comment is approved, a Gravatar profile image may be visible publicly next to the comment. Gravatar is operated by Automattic and is covered by Automattic’s applicable privacy information.
11. Hosting, security and technical providers
The hosting provider and technical service providers may process server logs, IP addresses and other technical information as necessary to host the website, deliver content, maintain backups, diagnose errors, mitigate attacks and protect the website. Access is limited to what is necessary for the relevant service, subject to the provider’s contractual and legal obligations.
12. Affiliate links and Booking.com
My Greece Experience uses affiliate links, including Booking.com links. The presence of a normal outbound affiliate link does not by itself mean that Booking.com can place a cookie on your device before you visit Booking.com’s service. When you click the link and leave our website, Booking.com or another destination provider may process your personal data and set cookies or similar technologies according to its own policies. The affiliate identifier in the link may be used to attribute an eligible transaction to us. Please review the destination provider’s privacy and cookie information before making a booking.
13. Recipients of personal data
Depending on how you use the website, personal data may be accessible to or processed by the following categories of recipients where necessary:
- hosting, infrastructure, backup, security and technical-support providers;
- Automattic and services connected to Jetpack, Akismet, WordPress.com or Gravatar where the relevant feature is used;
- email and communications providers;
- professional advisers, insurers, courts, regulators, public authorities or law-enforcement bodies where disclosure is required or legally justified;
- external websites and affiliate partners that you independently choose to visit after clicking an outbound link.
We do not sell personal data as an independent data-broker activity.
14. International transfers
Some service providers may process information outside the European Economic Area. Where the GDPR applies and a transfer is made to a country that is not covered by an applicable adequacy decision, the transfer must rely on an available lawful safeguard or derogation, such as European Commission standard contractual clauses where appropriate. The exact transfer mechanism may depend on the provider, destination and service in use. You may contact us for available information about safeguards applicable to processing under our responsibility.
15. Data retention
We retain personal data only for as long as necessary for the purpose for which it was collected, taking account of legal obligations, security requirements and the need to establish or defend legal claims. Retention may differ by category:
- Jetpack Stats: currently disabled in this database configuration. If re-enabled, Automattic states that Stats logs containing visitor IP addresses and WordPress.com usernames, where available, may be retained for approximately 28 days for this feature.
- Akismet: Akismet states that most spam-related data is retained for short periods generally ranging from two weeks to ninety days.
- Comments: approved comments and related metadata may be retained while the comment remains published and for moderation, security and record-keeping purposes, unless deletion is required or appropriate.
- Contact correspondence: retained for the time necessary to deal with the request and, where reasonably necessary, for follow-up, records and legal-protection purposes.
- Server/security logs: retained for the period reasonably required for security, troubleshooting and abuse prevention, subject to the hosting provider’s settings and legal requirements.
- Consent records: where consent management is used, a record of the choice may be retained for the period needed to demonstrate compliance and respect the user’s preferences.
16. Your rights under the GDPR
Where the GDPR applies, and subject to the legal conditions and exceptions for each right, you may have the right to:
- receive information about how your personal data is processed;
- request access to your personal data and obtain a copy;
- request correction of inaccurate or incomplete personal data;
- request erasure of personal data in the circumstances provided by law;
- request restriction of processing;
- receive personal data in a structured, commonly used and machine-readable format and transmit it to another controller where the right to portability applies;
- object, on grounds relating to your particular situation, to processing based on legitimate interests;
- object at any time to direct marketing, if any;
- withdraw consent at any time where processing is based on consent, without affecting prior lawful processing;
- not be subject, in the circumstances established by law, to a decision based solely on automated processing that produces legal or similarly significant effects.
Requests can be sent to mygreeceexperience@gmail.com. We may need reasonable information to verify identity before disclosing or deleting personal data. GDPR requests are normally answered without undue delay and, in principle, within one month; the period may be extended where permitted by law for complex or numerous requests.
17. Right to lodge a complaint
If you believe that personal data has been processed unlawfully, you may lodge a complaint with the competent data-protection supervisory authority. In Italy, the supervisory authority is the Garante per la protezione dei dati personali. Under the GDPR, you may also be entitled to complain to the authority in the Member State of your habitual residence, place of work or place of the alleged infringement.
18. Automated decision-making
My Greece Experience does not use personal data under its direct control to make decisions based solely on automated processing that produce legal effects or similarly significant effects on ordinary website visitors. Automated anti-spam and security systems may classify activity or comments in order to protect the website; such technical filtering is not intended to make a legally significant decision about a visitor.
19. Children’s privacy
My Greece Experience is a general travel-information website and is not directed at collecting personal data from children. If you believe a child has submitted personal data in circumstances in which parental or guardian authorisation is required, please contact us so that the matter can be reviewed and appropriate action taken.
20. Security
We take reasonable technical and organisational measures appropriate to the nature of the website and the personal data processed, including measures intended to protect against unauthorised access, alteration, disclosure, loss or abuse. No internet service can guarantee absolute security.
21. External websites
Links to accommodation platforms, airlines, ferry companies, attractions, official tourism bodies and other third-party websites are provided for travel planning. Once you leave My Greece Experience, the external provider is responsible for explaining its own processing. We encourage you to read the relevant privacy notice before submitting personal data or completing a transaction.
22. Changes to this Privacy Policy
We may update this policy when website functionality, service providers or legal requirements change. The current version will be published on this page and the “Last updated” date will be revised when appropriate.
23. Further information
For general information about rights under the GDPR, you may consult the European Commission’s information for individuals and the official text of Regulation (EU) 2016/679.