This Privacy Policy describes how Myrtios Traditional Taverna ("we", "us", "our") collects, uses, and protects the personal data of visitors to our website myrtios-tavern.com (the "Website"), in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Greek Law 4624/2019, Greek Law 3471/2006 (e-Privacy Directive transposition), and the guidelines of the Hellenic Data Protection Authority (HDPA). By using our Website, you acknowledge that you have read and understood this Privacy Policy. We encourage you to read it carefully before using our services.
1. Data Controller
The Data Controller for the personal data collected through this Website is:
Business name: ΛΑΣΗΘΙΩΤΑΚΗΣ ΓΕΩΡΓΙΟΣ
Trade name: Myrtios Traditional Taverna
Tax ID (ΑΦΜ): 054458653
Registered address: ΑΝΩ ΧΕΡΣΟΝΗΣΟ 0, ΤΚ 70014, ΛΙΜΕΝΑΣ ΧΕΡΣ, Crete, Greece
Email: myrtiosrestaurant@gmail.com
Phone: +30 6938177720
For any questions regarding this Privacy Policy or the processing of your personal data, you may contact us at the above details.
2. Personal Data We Collect
We collect personal data in the following ways:
2.1 Data You Provide Directly
Currently, the Website does not include contact or newsletter forms. If you contact us by phone or email using the details provided, we may process the following data:
- Name: Georgios Lasithiotakis
- Phone number: +30 6938177720
- Email address: myrtiosrestaurant@gmail.com
- Content of your communication
2.2 Data Collected Automatically
When you visit our Website, certain data is collected automatically through technical means:
- IP address (anonymized where possible)
- Browser type and version
- Operating system
- Date and time of visit
- Pages visited and time spent on each page
- Referring website (where you came from)
- Device information (desktop/mobile, screen resolution)
- Interaction data (clicks, scroll behavior)
2.3 Data Collected via Third-Party Booking Service
Our Website provides a link to multiapp.gr, an independent reservation platform. When you click the booking link, you are redirected to that platform, which operates under its own Privacy Policy. We do not collect or process the data you submit on multiapp.gr; however, we may receive aggregated, anonymized booking statistics.
3. Purposes of Processing and Legal Basis
We process your personal data for the following purposes, based on the corresponding legal bases under Article 6 GDPR:
3.1 Website Operation and Security
Purpose: Ensuring proper functioning of the Website, preventing fraud and security incidents, logging technical errors.
Legal basis: Article 6(1)(f) GDPR — legitimate interest of the Data Controller.
3.2 Communication and Customer Service
Purpose: Responding to inquiries, providing information about our services, managing reservations made through telephone.
Legal basis: Article 6(1)(b) GDPR — performance of a contract or pre-contractual measures at your request.
3.3 Analytics and Performance Measurement
Purpose: Understanding how visitors use the Website, improving user experience, measuring effectiveness of content.
Legal basis: Article 6(1)(a) GDPR — your explicit consent through the cookie consent banner.
3.4 Marketing and Advertising
Purpose: Delivering relevant advertisements on Meta platforms (Facebook, Instagram) and Google platforms, measuring advertising effectiveness, building custom and lookalike audiences for advertising campaigns.
Legal basis: Article 6(1)(a) GDPR - your explicit consent through the cookie consent banner.
4. Third-Party Services and Data Recipients
To operate and improve our Website, we use the following third-party services, which may receive your personal data as independent or joint Data Controllers:
4.1 Meta Platforms Ireland Limited (Meta Pixel)
Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, D02 X525, Ireland.
Purpose: Conversion tracking, audience building for advertising campaigns, advertising performance measurement.
Data collected: IP address, browser information, page interactions, click events, custom events (telephone clicks, booking link clicks, location requests). Where consent is provided for advanced matching: hashed identifiers (email, phone) for user matching with Meta accounts.
Data transfer: Data is transferred to the United States. Meta participates in the EU-U.S. Data Privacy Framework, providing an adequate level of protection. Additionally, Standard Contractual Clauses (SCCs) are in place.
More info: https://www.facebook.com/privacy/policy/
4.2 Google Ireland Limited (Google Analytics, Google Ads, Google Tag Manager)
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Purpose: Website traffic analysis, user behavior measurement, advertising campaign tracking and optimization, conversion measurement.
Data collected: IP address (anonymized via IP-anonymization), browser type, device information, pages visited, session duration, geographic location (country/city level), event interactions.
Data transfer: Data may be transferred to the United States. Google participates in the EU-U.S. Data Privacy Framework. Additionally, Standard Contractual Clauses (SCCs) are in place.
More info: https://policies.google.com/privacy
4.3 multiapp.gr (Reservation Platform)
Provider: multiapp.gr - independent reservation platform.
Purpose: Processing of reservations made through our Website.
Data flow: When you click on the booking link, you are redirected to multiapp.gr where you complete the reservation directly. Data submitted on multiapp.gr is processed under their own Privacy Policy.
4.4 Hosting Provider
Our Website is hosted on servers located within the European Union. The hosting provider processes personal data (server logs, IP addresses) solely for the purpose of providing the hosting service, as a Data Processor on our behalf, under appropriate contractual safeguards.
4.5 Other Recipients
Personal data may also be disclosed to:
- Tax authorities and public services (when required by law, e.g., invoice issuance through the Greek myDATA platform)
- External accountants and legal advisors (under confidentiality obligations)
- Authorities and courts (when legally required)
5. International Data Transfers
Some of our service providers (Meta, Google) are based in or transfer data to countries outside the European Economic Area (EEA), primarily the United States.
To ensure that your data receives an adequate level of protection during such transfers, we rely on the following safeguards under Articles 44–49 GDPR:
- EU-U.S. Data Privacy Framework adequacy decision (Commission Implementing Decision (EU) 2023/1795)
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Supplementary technical and organizational measures (data minimization, IP anonymization, hashed identifiers)
You should be aware that, despite these safeguards, transfers to third countries may carry certain risks. The Schrems II judgment (C-311/18) of the Court of Justice of the European Union acknowledged that U.S. authorities may have legal grounds to access transferred data under certain conditions.
6. Data Retention Periods
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, in accordance with the principle of storage limitation (Article 5(1)(e) GDPR):
Communication data (email, phone inquiries): Up to 5 years from the last interaction or until withdrawal of consent.
Technical server logs: Up to 12 months for security purposes.
Google Analytics data: 14 months (default GA4 retention setting).
Meta Pixel data: Up to 180 days for event-level data, up to 2 years for aggregated insights.
Cookie consent records: 12 months, after which we will request consent again.
Tax and accounting data: As required by Greek tax law (currently 5 years for tax records, 10 years for certain commercial records).
7. Your Rights as a Data Subject
Under the GDPR and Greek data protection law, you have the following rights regarding your personal data:
7.1 Right of Access (Article 15 GDPR)
You have the right to obtain confirmation of whether we process your personal data, and if so, to access that data and receive information about the processing.
7.2 Right to Rectification (Article 16 GDPR)
You have the right to request correction of inaccurate personal data or completion of incomplete data.
7.3 Right to Erasure / "Right to be Forgotten" (Article 17 GDPR)
You have the right to request deletion of your personal data, subject to certain legal exceptions (e.g., legal retention obligations).
7.4 Right to Restriction of Processing (Article 18 GDPR)
You have the right to request that we limit the processing of your data in certain circumstances.
7.5 Right to Data Portability (Article 20 GDPR)
You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another Data Controller.
7.6 Right to Object (Article 21 GDPR)
You have the right to object to the processing of your personal data based on legitimate interest, including profiling for direct marketing purposes.
7.7 Right to Withdraw Consent (Article 7(3) GDPR)
Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. You can withdraw consent for cookies through the cookie preference settings on our Website.
7.8 Right Not to Be Subject to Automated Decision-Making (Article 22 GDPR)
Although we use automated tools for analytics and advertising optimization, we do not make solely automated decisions that produce legal effects or similarly significantly affect you.
7.9 How to Exercise Your Rights
To exercise any of the above rights, please contact us using the details provided in Section 1 of this Privacy Policy. We will respond to your request within one (1) month from receipt, in accordance with Article 12(3) GDPR. This period may be extended by two further months when necessary, taking into account the complexity and number of requests.
We may request additional information to verify your identity before processing your request, to prevent unauthorized access to your data.
8. Right to Lodge a Complaint
If you believe that the processing of your personal data violates the GDPR or Greek data protection law, you have the right to lodge a complaint with the supervisory authority:
Hellenic Data Protection Authority (HDPA)
Address: Kifissias 1-3, 11523 Athens, Greece
Phone: +30 210 6475600
Email: contact@dpa.gr
Website: www.dpa.gr
Complaints may be submitted electronically through the HDPA portal.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, alteration, destruction, or disclosure, in accordance with Article 32 GDPR. These measures include:
- SSL/TLS encryption for data transmission (HTTPS)
- Access controls limiting data access to authorized personnel only
- Regular security updates of Website systems
- Confidentiality agreements with our processors
- Data minimization principles in our processing activities
Despite our efforts, no method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to using industry-standard practices.
10. Cookies and Similar Technologies
Our Website uses cookies and similar tracking technologies. Detailed information about the cookies we use, their purpose, and how to manage your preferences is available in our separate Cookie Policy.
You can manage your cookie preferences at any time through the cookie consent banner that appears on the Website, or by clearing your browser cookies.
11. Children and Minors
Our Website is not directed at children under 16 years of age. We do not knowingly collect personal data from minors under 16. If you are under 16, please do not provide any personal data to us. If we become aware that we have collected personal data from a child under 16 without verified parental consent, we will take steps to delete that information.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. The updated version will be published on this page with a revised "Last updated" date. We encourage you to review this Privacy Policy periodically.
For material changes, we will provide more prominent notice, including through banner notifications on the Website or, where appropriate, direct communication.
13. Applicable Law and Jurisdiction
This Privacy Policy is governed by Greek law and European Union law (in particular the GDPR). Any disputes arising in connection with this Privacy Policy shall fall under the jurisdiction of the competent courts of Heraklion, Crete, Greece.
14. Contact
For any questions, requests, or concerns regarding this Privacy Policy or the processing of your personal data, please contact us at:
Myrtios Traditional Taverna
Email: myrtiosrestaurant@gmail.com
Phone: +30 6938177720
Address: ANO CHERSONISO 0 , 70014, LIMENAS CHERSONISOU, Crete, Greece
— End of Privacy Policy —
Gabie R
Royal treatment
Véronique V
Geslaagde avond!
Cindy S
Excellent
Enrico Keller
Gemütlich, familiär,
