Last updated: August 2026
Privacy Policy
Pony Club Ecotourism ("we", "us", "our") operates at Glyki, Thesprotia, Greece. This policy explains how we collect, use, and protect your personal data when you book activities through our website.
Data We Collect
When you make a booking we collect: your name, email address, phone number, and billing country (via Stripe's hosted checkout); payment metadata such as the booking package, date, guest counts, and total amount paid (stored in Stripe and our booking database); and technical data such as your IP address, which we use to rate-limit requests to our checkout endpoint and which is necessarily visible to the services that host, monitor and deliver the site (see Data Processors). If you grant measurement consent, we also collect analytics data and session replays of your site usage (with all form inputs masked to protect your privacy).
How We Use Your Data
We use your data to: process your booking and send you a confirmation email; notify our staff of new reservations; handle refunds or disputes if required; and comply with Greek tax-record retention obligations (7 years). We do not sell your data to third parties or use it for advertising without your explicit consent. If you grant measurement consent, we use product analytics and session replays to understand and improve the booking flow. If you grant marketing consent, we may use booking contact details for Google Ads conversion measurement and Enhanced Conversions so Google can match hashed customer data with ad interactions and help us measure campaign effectiveness.
Data Processors
We share your data only with the following sub-processors, each bound by their own privacy policies: Stripe, Inc. (payment processing) - stripe.com/privacy; Neon Postgres (Vercel Marketplace, EU-hosted booking database); Vercel (hosting and Speed Insights) - vercel.com/privacy; Resend, Inc. (transactional email) - resend.com/privacy; PostHog (EU-hosted product analytics and session replay, active only with consent) - posthog.com/privacy; RudderStack (EU-hosted server-side event pipeline); Sentry (error monitoring); Upstash Redis (rate limiting); Mux (video hosting and delivery for the site's background video); Mapbox (interactive map); c15t (consent management); and Google services, including Google Tag Manager, Google Analytics 4 (GA4), and Google Ads conversion measurement / Enhanced Conversions (active only with consent) - policies.google.com/privacy.
Data Retention
Booking records are retained for 7 years as required by Greek tax law. If you have not made a booking, any enquiry data is deleted within 90 days. You may request deletion of non-legally-required data at any time by contacting us.
Your Rights (GDPR)
Under GDPR you have the right to: access a copy of your personal data; correct inaccurate data; request deletion (subject to legal retention obligations); object to processing; and lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).
Contact
Data controller: Pony Club Ecotourism, Glyki, Thesprotia 46200, Greece. For privacy enquiries email info@ponyclub.gr.