Contact
Regulatory Compliance

Privacy Policy & Data Protocol

Effective Date: January 1, 2026 | Document Reference: SRS-PRIV-2026-V1

1. Statutory Entity and Scope

This Privacy Statement governs the processing of personal data by Sunnyrosterscoutshelvs Travel Media Ltd. ("the Company," "we," "us," or "our"), incorporated under company registration number 13849201 in the United Kingdom with principal legal offices at 84 Charing Cross Road, Soho, London WC2H 0BF, United Kingdom, and operational station in Greece at 14 Voulis & Mitropoleos St, Syntagma, 105 57 Athens, Hellenic Republic. This document sets out the basis on which any personal data collected from you, or that you provide to us via sunnyrosterscoutshelvs.com, will be processed in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR), the UK Data Protection Act 2018, and the California Consumer Privacy Act (CCPA/CPRA).

2. Categories of Personal Data Collected

In the execution of our editorial services, field scout inquiries, and web application interactions, we collect the following classifications of personal information:

  • Directly Supplied Information: Names, electronic mail addresses, telephonic identifiers, and custom travel parameters submitted via our Syntagma Concierge dispatch interface.
  • Technical and Telemetry Identifiers: Internet Protocol (IP) addresses, browser type, operating system build, referral Uniform Resource Locators (URLs), session time stamps, and device hardware telemetry.
  • Cookie and Local Storage Metadata: Consent state markers stored via your browser's persistent client-side database (e.g., sunnyroster_cookie_consent) to enforce chosen telemetry preferences.

3. Legal Bases for Processing Under GDPR

We strictly anchor all personal data processing under one of the following recognized Article 6 GDPR legal frameworks:

  • Consent (Art. 6(1)(a)): Explicit, informed permission provided by you upon submitting inquiries or opting into analytical cookies via our banner.
  • Contractual Performance (Art. 6(1)(b)): Processing necessary to formulate bespoke travel itineraries, itineraries, or respond to editorial commissions.
  • Legitimate Interests (Art. 6(1)(f)): Protecting our digital infrastructure against distributed denial-of-service (DDoS) threats, preventing fraudulent ticket bookings, and analyzing overall site navigation trends.
  • Legal Obligation (Art. 6(1)(c)): Compliance with statutory tax, accounting, and Hellenic tourist police regulatory reporting.

4. Third-Party Processors and International Transfers

We do not sell, rent, or trade your personal information to marketing syndicates or data aggregators. Data may be securely transferred to vetted third-party subprocessors operating under strict Data Processing Agreements (DPAs) incorporating standard contractual clauses (SCCs):

  • Cloud Infrastructure: AWS European Regions (Frankfurt / Dublin) maintaining ISO 27001 and SOC 2 Type II security certifications.
  • Transactional Mail Providers: Postmark / SendGrid strictly for delivering requested itinerary PDFs and inquiry confirmations.
  • Content Delivery Networks: Cloudflare edge nodes for global asset caching, SSL/TLS handshake enforcement, and DDoS mitigation.

5. Data Retention Schedules

Personal data collected through contact inquiries is retained for a maximum duration of twenty-four (24) months from the date of final communication, after which it is irreversibly purged or anonymized. Server access telemetry logs are automatically scrubbed on a rolling ninety (90) day schedule unless actively required for security forensics.

6. Your Statutory Rights (GDPR & CCPA)

Depending on your jurisdiction, you possess unambiguous statutory rights regarding your personal data:

  • Right of Access & Portability: You may request a machine-readable export of all records we hold pertaining to your identity.
  • Right to Rectification: You may correct inaccurate or incomplete biographical details.
  • Right to Erasure ("Right to Be Forgotten"): You may mandate the deletion of your personal data where statutory retention exemptions do not apply.
  • Right to Object & Restrict: You may oppose processing founded on legitimate interest grounds at any time.
  • Non-Discrimination: Under the California Consumer Privacy Act (CCPA), you will never face degraded service quality or price alteration for exercising your privacy prerogatives.

7. Data Protection Officer & Supervisory Recourse

To invoke any statutory right or address formal privacy grievances, address correspondence directly to our Data Protection Liaison at:

Sunnyrosterscoutshelvs Data Protection Office
Attention: DPO Legal Desk
14 Voulis & Mitropoleos St, Syntagma, 105 57 Athens, Greece
Email: [email protected]

If you believe our processing violates European data protection mandates, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA / www.dpa.gr) or the UK Information Commissioner's Office (ICO / ico.org.uk).