Your privacy matters.

Who handles your information?

Elafonisi Tours is operated by Way to Crete, owned by Ernest. Way to Crete is the operator contact for personal information you send in connection with your tour. Its published contact details appear below; see the legal notice for the relationship between the brands.

What this website collects

Browsing does not require an account. There is no newsletter subscription, AI chat, payment checkout on this website. Optional Google Analytics measures visits only after you accept it. Page requests can disclose your IP address, browser information, requested URL and request time to the website host for delivery and security.

The tour form asks for your name, email, optional phone number, travel date, departure area, group size, accommodation, selected experience and any message you choose to add. Please avoid card details, identity documents and detailed medical information.

Submitting the enquiry form sends your details to info@waytocrete.com and a service confirmation to the email address you provide. Resend processes these emails for us. The website does not maintain a customer account or enquiry database. An enquiry does not create a confirmed booking.

Purpose and legal basis

• Answering a request and arranging a tour: steps at your request before a contract, or performance of that contract (GDPR Article 6(1)(b)).
• Records that the operator must retain by law: legal obligation (Article 6(1)(c)).
• Technical security and abuse prevention: legitimate interests in protecting the service (Article 6(1)(f)), balanced against your rights.
• Optional Google Analytics: your consent (Article 6(1)(a)), which you can withdraw through Cookie settings in the footer. Reading this notice or browsing is not consent to analytics or marketing.

Recipients and international transfers

Relevant operator staff handle direct correspondence. Hosting and communication providers may process technical requests or messages; providers needed to fulfil a confirmed tour receive only relevant details. The site does not sell enquiry information or send it to advertising platforms. Links to WhatsApp, review platforms and the parent websites lead to services with their own privacy notices.

You may ask Way to Crete which providers receive your correspondence, their processing locations and any applicable safeguards for transfers outside the EEA. When email delivery is enabled, Resend processes enquiry and confirmation messages. Its infrastructure and subprocessors may process information outside the EEA under the safeguards in its data processing agreement.

Read Resend’s privacy policy and data processing agreement. We do not subscribe enquirers to marketing emails. Email acceptance by the sending service does not guarantee inbox delivery.

Optional Google Analytics

When accepted, Google Analytics receives information about page visits, referrals, device/browser characteristics and engagement. Google receives network information needed to handle those requests. We do not send the name, email, phone, accommodation or message entered in the enquiry form as Analytics event parameters. Google advertising signals and ad personalization are disabled.

Your choice is stored locally for 180 days. Analytics cookies are configured for up to 180 days; the property’s event-data retention is a separate setting managed by the operator. Google may process data outside the EEA under the safeguards described in its terms. See Google’s partner-site information and Google’s privacy policy. Contact Way to Crete for the applicable property retention setting and transfer information.

Withdrawing permission stops future collection and clears accessible Analytics cookies; it does not automatically delete data already collected. You can make a separate privacy request to the operator.

How long information is kept

Local draft files remain until you delete them. Operator correspondence is retained while needed to address your request or deliver your trip, and afterwards where tax, accounting or legal-claim obligations require it. A deletion request will be assessed against those obligations. Hosting log retention depends on the hosting service. Ask the operator for the retention period applicable to your records.

Cookies, children and your rights

Google Analytics cookies are enabled only after you accept analytics. Advertising consent remains denied. Read the cookie policy for the current storage inventory. A parent or guardian should arrange enquiries involving children and provide only information needed for the trip.

You can request access, correction, erasure, restriction or portability where applicable, object to processing, and withdraw any consent you have given. There are no automated decisions with legal or similarly significant effects on this site. The GDPR rights page explains requests and complaints.

Adapted for this website from Way to Crete’s privacy notice and Rethymno Tours’ privacy notice.