1. Who is responsible for your data
Dimitrios Matziaris, Dim. Gounari 19, Drama 661 31, Greece, is the controller of personal data processed on greobg.com (“we”, “us”). For any privacy question or request, write to contact@greobg.com.
greobg.com is an advertising platform for holiday properties in northern Greece. Owners and agencies publish listings, and guests contact them directly. We do not take bookings or payments for stays.
2. What data we collect and why
We collect only the data listed below, and only for the purpose named next to it.
| When you… | Data | Why we use it |
|---|---|---|
| Visit the site | IP address, browser and device type, pages requested, date and time; a cookie that remembers your language | Show the site correctly and keep it secure |
| Register an account | Username, email address, password; Google reCAPTCHA receives your IP address and browser data to detect bots | Create and manage your account, send account emails, block automated abuse |
| Publish a listing (owners and agencies) | Property text, photos, location, prices, availability; the contact details you choose to show (phone, Viber, email, website); proof of your right to advertise the property or its registration number, where we ask for it | Show your property to guests and check listings before they go live |
| Have your listing translated | Title, description and short description of the listing, sent to DeepL | Create the Bulgarian, English and Greek versions automatically |
| Send a message or write a review | Your message or review, and the name and email of your account | Pass your message to the owner and publish your review |
| Write a comment on a blog post | Your name, email address, optional website, the comment text, your IP address and browser data | Publish your comment, keep discussions orderly and block spam |
| Use the search assistant | The text you type and the page language; technical data such as your IP address | Find matching listings and limit abuse |
| Receive emails from the site | Your email address and the content of the email | Registration, password reset and message notifications |
| Accept optional cookies | Google Maps: IP address and browser data. Google Analytics: pages viewed, device, approximate location. YouTube: viewing data | Show maps and videos, count visits |
Listing text, photos, location and the contact details an owner chooses to show are public. Owners must not publish other people’s personal data.
We do not sell your data and we do not make automated decisions that have legal effects on you.
Payments. Vendors pay an annual fee for their listings. Card payments are processed by Stripe on Stripe’s own secure payment page; we never see or store your card number. Stripe acts as an independent payment processor and handles your payment data under its own privacy policy . We receive from Stripe only the confirmation of the payment. We keep a record of each payment (the listing, the vendor, the amount, the date, the payment method, the payment reference and whether a receipt has been issued). Payments made by bank transfer are recorded in the same way from the details of the transfer. We use this data to provide the paid service, to show the paid period of your listing and to meet our accounting and tax obligations. We keep payment records for as long as the law requires us to keep accounting records. When you pay, Stripe may set its own cookies on its payment page; see Stripe’s cookie information. Our own site does not set additional cookies for payments.
3. Legal bases
We process your data only when the law allows it. Each purpose rests on one of the bases below (Article 6 of the GDPR).
| Purpose | Legal basis |
|---|---|
| Your account, your listing, translation of your listing, messages between users | Contract: we need the data to provide the service you asked for (Art. 6(1)(b)) |
| Security, protection against spam and bots, the search assistant, review and comment moderation, keeping the site running | Our legitimate interest in a safe and working site (Art. 6(1)(f)) |
| Google Maps, Google Analytics, YouTube | Your consent, given in the cookie banner (Art. 6(1)(a)). You can withdraw it at any time in the cookie settings |
| Answering legal requests and keeping records the law requires | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have weighed them against your rights. You may object at any time (see section 7).
4. Who receives your data
We share data only with the providers below, and only as far as their service needs it.
| Recipient | What it does for us | Data it receives |
|---|---|---|
| Hosting provider (within the EU) | Hosts the site, stores backups, runs the mailbox contact@greobg.com | All data on the site, and the emails we send and receive |
| Maps on listings and in the address picker, Analytics statistics, YouTube videos (all only after your consent); reCAPTCHA on registration; the search assistant (Gemini) | IP address and browser data; the text you type in the search assistant | |
| DeepL SE, Cologne, Germany | Translates listing texts | Title and descriptions of listings |
| Stripe | Processes card payments of the annual vendor fee on Stripe’s own payment page. | Stripe receives the payment details you enter there and tells us whether the payment succeeded. |
| Listing owners | Answer your messages and enquiries | The message you send and the name and email of your account |
| Authorities and courts | Only where the law requires it | Only what the request legally covers |
Listing text, photos and the contact details an owner chooses to show can be seen by every visitor of the site. Your name and comment on a blog post are public too; your email address is not shown.
5. Transfers outside the EU/EEA
Some of our providers process data outside the European Economic Area, so your data may leave it.
- Google may process data in any country where it or its agents operate facilities, including the United States. Google LLC is certified under the EU-US Data Privacy Framework and also uses standard contractual clauses.
- Stripe, which processes card payments, may process payment data in countries outside the EEA, including the United States, under the safeguards described in Stripe’s privacy policy
- Our hosting provider hosts greobg.com on servers in Frankfurt, Germany, and keeps backups in France. Both are in the EU.
Where data leaves the EEA, we rely on safeguards recognised by the European Commission, such as an adequacy decision or standard contractual clauses. You can ask us for details at contact@greobg.com.
6. How long we keep data
We keep data only as long as we need it for the purpose it was collected for.
| Data | How long |
|---|---|
| Account, listings, messages and reviews | While your account exists. We delete the account and its listings within 30 days after you ask us to |
| Blog comments | Until you ask us to remove your comment or the post is deleted |
| Google Analytics statistics | 14 months |
| Search assistant | We do not keep the text you type. Technical data used to limit abuse is kept for a short time. Google handles the text under its own terms |
| Technical and security logs | For a limited period set by our hosting and security tools |
| Records the law requires us to keep, such as accounting records once paid subscriptions begin | For the period the law sets |
| Payment records | Kept for the period the law requires for accounting and tax records. |
| Backups | Deleted data may stay in routine backups until the provider’s backup cycle overwrites them |
7. Your rights and how to use them
You can use the rights below at any time by writing to contact@greobg.com. We answer within one month, free of charge.
- Access: ask what data we hold about you and get a copy.
- Correction: have wrong or incomplete data corrected. After logging in, you can change your account details yourself.
- Erasure: ask us to delete your data, unless the law requires us to keep it.
- Restriction: ask us to pause the use of your data while a dispute is checked.
- Portability: receive the data you gave us in a common, machine-readable format.
- Objection: object to processing based on our legitimate interests.
- Withdrawing consent: change your choice in the cookie settings at any time. This does not affect earlier processing.
We may ask you to prove who you are before we act on a request.
8. Complaints
If you think we handle your data unlawfully, please write to us first at contact@greobg.com. You also have the right to complain to a data protection authority.
- Hellenic Data Protection Authority, the authority of the country where we are established: Kifissias 1-3, 115 23 Athens, Greece, www.dpa.gr. Complaints can be filed online at eservices.dpa.gr or, where that is not possible, by email to complaints@dpa.gr.
- The authority of your own EU country, for example the Commission for Personal Data Protection in Bulgaria (www.cpdp.bg).
9. Cookies and consent
We use necessary cookies to run the site, and optional cookies only after you agree. Necessary cookies keep the site working, for example your language and your login. Optional cookies serve Google Maps, Google Analytics and YouTube, and nothing from these services loads until you accept.
The full list of cookies, what each one does and how to change your choice is in our Cookie Policy, linked in the footer of every page.
10. Children
greobg.com is not meant for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, write to contact@greobg.com and we will delete it.
11. Security
We use appropriate technical and organisational measures to protect your data, including an encrypted connection (HTTPS). No system is completely safe. If a breach puts your rights at risk, we will tell you and the authority as the law requires.
12. Changes to this policy
We update this policy when the site or the law changes. Registered owners get an email about important changes.
Last updated: 24 October 2026.