1. Who we are

The data controller is Cycling Partners.

For any privacy question, email .

2. What we collect

• Booking details: the name of each rider, your email address and phone number, T-shirt and jersey sizes, the package you choose and anything you write in the notes field.
• Payment details: the payer’s name, the amount and the transaction reference. We never receive card numbers through this website.
• At the festival: check-in records, and the photos and video taken during the event.
• When you visit the website: your IP address and browser details, received by our hosting provider. The website itself uses no analytics and no tracking.

The booking form sends nothing by itself. It opens your own email app with the booking written out, and we receive it only when you press Send.

3. Why we use it and our legal basis

• To handle your booking, send you the payment details and your confirmation, and run the festival: performance of a contract (GDPR Art. 6(1)(b)).
• To issue receipts and keep accounting records: legal obligation (Art. 6(1)(c)).
• To keep riders safe and deal with incidents on the day: our legitimate interests and, in an emergency, your vital interests (Art. 6(1)(f) and (d)).
• To photograph and film the festival and share the coverage on our website and social media: our legitimate interests (Art. 6(1)(f)). You can object at any time, and we ask for your consent before using a close-up of you in advertising.
• To tell you about future festivals: only with your consent (Art. 6(1)(a)), which you can withdraw at any time.

4. Health information

Please do not send us health information unless it matters for your safety on the bike. If you do, we use it only for that purpose, on the basis of your explicit consent (GDPR Art. 9(2)(a)), share it only with on-site staff and first-aid personnel, and delete it within [30 days] after the festival.

5. Who we share it with

• Festival staff, presenters and the venue, the Nautical Club of Vouliagmeni, only as far as check-in and safety require.
• Service providers acting on our instructions: Google (Gmail, which receives the booking emails), our website host [hosting provider], our accountant and the event photographer [name].
• Public authorities, when the law requires it.

We do not sell your data or give it to partners or sponsors for their own marketing.

6. Transfers outside the EU

Google may process data in the United States. These transfers rely on the EU–U.S. Data Privacy Framework or on the European Commission’s Standard Contractual Clauses.

7. How long we keep it

• Booking emails and participant lists: until [12 months] after the festival.
• Payment and accounting records: for the period Greek tax law requires.
• Health information: deleted within [30 days] after the festival.
• Published photos and video: until you ask us to remove them.
• Contact details for festival news: until you unsubscribe.

8. Cookies and local storage

This website sets no cookies. It saves one item, sf-lang, in your browser’s local storage to remember whether you chose English or Greek. It is used only for that choice, is never sent to us, and you can clear it in your browser settings.

The Open in Gmail button takes you to Google’s own website, which has its own privacy policy.

9. Your rights

You can ask to access, correct or delete your data, restrict or object to how we use it, receive it in a portable format, and withdraw any consent you have given. To use these rights, email .

We reply within one month. If you are not satisfied, you can complain to the Hellenic Data Protection Authority, 1–3 Kifisias Ave., 115 23 Athens, www.dpa.gr.

10. Security and data breaches

Only the organising team can see booking data. The booking mailbox is protected with two-step verification, and we keep only the data listed in this policy.

If a data breach is likely to put your rights at risk, we report it to the Hellenic Data Protection Authority within 72 hours of becoming aware of it, and tell you without undue delay what happened and what you can do.

11. Riders under 18

Riders under 18 can take part only with the consent of a parent or guardian, who makes the booking and provides the rider’s details.

12. Changes to this policy

If we change this policy, we publish the new version on this page and update the date at the top.