Privacy Statement

Last updated: [29 June 2026]

Master Holiday Kalamata ("MHK", "we", "our" or "us") respects your privacy and is committed to protecting your personal data. This Privacy Statement explains how we collect, use, store and protect your personal data when you visit our website, contact us or use our vehicle rental services.

This Privacy Statement has been prepared in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Greek data protection legislation.

1. Data controller

The data controller responsible for the processing of your personal data is:

Master Holiday Kalamata

5o χλμ

Kalamata 241 00

Greece

Email:
mhk@mhkrental.gr

Telephone:
+30 697 475 7397

2. What personal data we collect

Depending on how you interact with us, we may collect and process the following categories of personal data.

Identification information

We may collect:

• First and last name

• Date of birth

• Nationality

• Driver's licence information

• A copy of your driver's licence

• Passport or identity card information where required by applicable legislation

Contact information

We may collect:

• Email address

• Telephone number

• Residential address

Booking information

We collect information necessary to manage your reservation, including:

• Vehicle selection

• Pick-up and return locations

• Rental dates

• Reservation details

• Additional booking preferences or requests

Booking information is processed through our reservation management system VikRentWP for the purpose of managing reservations, vehicle availability and rental administration.

Payment information

We collect information required for billing and payment administration, including:

• Billing information

• Payment status

• Invoice details

Payments made through our website are securely processed by Stripe. Master Holiday Kalamata does not store complete payment card details.

Communication information

We collect information that you voluntarily provide when:

• submitting our contact form;

• requesting a quotation;

• contacting us by email;

• contacting us by telephone;

• communicating through messaging applications.

Technical information

When you visit our website, we may automatically collect certain technical information, including:

• IP address;

• Browser type;

• Operating system;

• Device information;

• Pages visited;

• Date and time of your visit.

Technical information is processed in accordance with your cookie preferences where required by law.

3. Why we process your personal data

We only process personal data where there is a lawful basis under the GDPR.

Performance of the rental agreement

We process your personal data to:

• process reservations;

• prepare rental agreements;

• verify your eligibility to rent a vehicle;

• verify your driver's licence;

• manage your booking;

• deliver our vehicle rental services;

• provide customer support;

• communicate regarding your reservation before, during and after your rental.

Legal basis: Performance of a contract.

Compliance with legal obligations

We process personal data where required to comply with applicable legislation, including tax, accounting, insurance and regulatory obligations.

Driver's licence information may also be processed where necessary to comply with legal requirements or cooperate with competent authorities.

Legal basis: Legal obligation.

Fraud prevention and protection of our business

We may process personal data to:

• prevent fraud;

• protect our vehicles and business;

• investigate incidents;

• process damages;

• handle insurance claims;

• establish, exercise or defend legal claims.

Legal basis: Legitimate interest.

Customer communication

We process personal data to:

• respond to enquiries;

• answer questions;

• provide quotations;

• communicate with customers before, during and after a rental.

Legal basis: Legitimate interest and, where applicable, taking steps prior to entering into a contract.

Administration

We process personal data for:

• invoicing;

• bookkeeping;

• payment administration;

• financial reporting;

• complying with our legal and financial obligations.

Legal basis: Performance of a contract and legal obligation.

Improving our services

We analyse customer feedback and website usage to improve our services, website performance and customer experience.

Website analytics are only processed where legally permitted and in accordance with your cookie preferences.

Legal basis: Legitimate interest and, where applicable, your consent.

4. How long we keep your personal data

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Statement or as required by applicable legislation.

Once the applicable retention period has expired, personal data will be securely deleted or anonymised.

5. Sharing personal data

We may share personal data with carefully selected third parties where this is necessary to provide our services or comply with legal obligations.

These parties may include:

• Website hosting providers;

• Website maintenance providers;

• VikRentWP reservation management software;

• Stripe for secure payment processing;

• Google for Google Analytics, Google Ads and Google Maps functionality;

• Accountants;

• Insurance companies;

• Legal advisers;

• Government authorities where disclosure is required by law.

Where third-party providers process personal data on our behalf, appropriate contractual arrangements are in place to ensure that your personal data is processed securely and in accordance with applicable data protection legislation.

Copies of driver's licences are not shared with third parties, unless disclosure is required by law, necessary for insurance purposes or required for the handling of accidents, damages or legal claims.

We never sell your personal data.

6. International transfers

Some of our service providers, including Google and Stripe, may process or access personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are implemented in accordance with the GDPR. These safeguards may include:

• an adequacy decision adopted by the European Commission;

• the EU-U.S. Data Privacy Framework, where applicable;

• the European Commission's Standard Contractual Clauses (SCCs).

We only work with service providers that implement appropriate technical and organisational measures to protect personal data.

7. Security

We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, misuse, disclosure and alteration.

Access to personal data is restricted to authorised personnel who require access to perform their duties.

Copies of driver's licences are stored securely on internal local systems and are not stored in cloud-based storage environments. Driver's licence copies are retained for a maximum of 12 months after completion of the rental agreement and are then permanently deleted, unless a longer retention period is required by law or is necessary for insurance matters, dispute resolution or legal claims.

Although no method of transmission or storage can guarantee absolute security, we continuously review and improve our security measures.

8. Your rights

Under the GDPR, you have the right to:

• request access to your personal data;

• request correction of inaccurate or incomplete personal data;

• request deletion of your personal data where applicable;

• request restriction of processing;

• object to processing based on legitimate interests;

• request data portability where applicable;

• withdraw your consent where processing is based on consent.

If you wish to exercise any of these rights, please contact us using the contact details provided below.

9. Complaints

If you believe that your personal data has not been processed in accordance with applicable privacy legislation, you have the right to lodge a complaint with the competent supervisory authority.

For Greece, this is:

Hellenic Data Protection Authority (HDPA)

Website: https://www.dpa.gr

10. Third-party websites

Our website may contain links to third-party websites or services.

We are not responsible for the privacy practices or content of external websites. We encourage you to review the privacy policies of those websites before providing any personal information.

11. Cookies

Our website uses cookies and similar technologies to ensure the website functions properly, analyse website traffic and improve user experience.

Certain website features, including Google Analytics and Google Maps, may place cookies or process technical information after you have provided the required consent where applicable.

For detailed information about the cookies we use and how you can manage your preferences, please refer to our separate Cookie Policy.

12. Changes to this privacy statement

We may update this Privacy Statement from time to time to reflect changes in our services, legal obligations or data processing activities.

The most recent version will always be published on our website.

13. Contact

If you have any questions regarding this Privacy Statement or the processing of your personal data, please contact:

Master Holiday Kalamata

5o χλμ

Kalamata 241 00

Greece

Email:
mhk@mhkrental.gr

Telephone:
+30 697 475 7397