Privacy policy.

01Data controller

The controller responsible for the processing of personal data collected on the website creative.com.cy is:

For any question concerning the protection of your personal data, you may contact the data controller directly at management@creative.com.cy.

02Data collected

We collect and process the following categories of data:

Data provided directly by you

• Identification: first name, last name, title
• Contact details: email address, phone number, postal address (where applicable)
• Travel data: number of travellers, requested dates, preferences, special requests
• Professional data (B2B): agency name, role, licence number
• Content of your messages: information transmitted via contact form, email or WhatsApp

Data collected automatically

• Technical data: IP address, browser type, operating system, screen resolution
• Browsing data: pages visited, time spent, traffic source, interactions
• Cookies: see our cookies policy

03Purposes of processing

Your personal data is processed for the following purposes:

• Responding to your requests for quotes, information or bookings
• Managing the customer relationship before, during and after your stay in Cyprus
• Sending our brochure and partner communications (B2B)
• Improving our website through anonymised statistical analysis
• Complying with our legal obligations (accounting, taxation, retention of booking data)
• Preventing fraud and ensuring website security

04Legal basis for processing

In accordance with Article 6 of the GDPR, the processing of your data is based on:

• Your consent (Art. 6.1.a) — newsletter, brochure request, non-essential cookies
• Performance of a contract (Art. 6.1.b) — quote, booking, travel services
• Compliance with a legal obligation (Art. 6.1.c) — accounting retention, taxation
• Our legitimate interest (Art. 6.1.f) — website security, service improvement, fraud prevention

05Recipients of the data

Your data may be communicated to the following recipients, exclusively for the purposes described above:

• Authorised personnel of Creative Tours Limited (sales team, operations, accounting)
• Hotel partners in Cyprus to confirm your bookings
• Airlines and transfer providers for your flights and transportation
• Technical sub-processors: website host, CRM tools (Brevo), analytics services (Google Analytics)
• Competent authorities upon legal requisition only

No data is sold, rented or exchanged with third parties for commercial purposes.

06Retention period

• Prospect data (quote, info request): 3 years from the last contact
• Customer data (confirmed booking): 10 years after the service for legal and accounting obligations
• Browsing data: maximum 13 months
• Newsletter: until you unsubscribe, then 3 years in archives
• Cookies: variable duration depending on type (see cookies policy)

07Your rights (GDPR Chapter III)

In accordance with the GDPR, you have at any time the following rights over your personal data:

• Right of access (Art. 15) — obtain a copy of your data
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure (Art. 17, "right to be forgotten") — subject to legal obligations
• Right to restriction (Art. 18) — temporarily restrict processing
• Right to data portability (Art. 20) — receive your data in a structured format
• Right to object (Art. 21) — refuse certain processing (commercial prospecting)
• Right to withdraw consent at any time (Art. 7.3)
• Right to define post-mortem directives concerning your data

08Right to complain

If, after contacting us, you believe that your rights are not respected, you may lodge a complaint with the competent supervisory authority:

For European residents, you may also contact the supervisory authority of your country of residence (CNIL in France, APD in Belgium, FDPIC in Switzerland, etc.).

09Data security

Creative Tours Limited implements appropriate technical and organisational measures to ensure the security of your data:

• HTTPS/TLS encryption for all communications
• Restricted access to authorised personnel only
• Regular backups and business continuity plan
• Continuous training of our team on data protection
• Regular audit of our technical sub-processors

10Transfers outside the EU

Your data is stored and processed primarily within the European Union. Some of our technical sub-processors (Google Analytics, CRM tools) may occasionally transfer data to third countries, always within the framework of the guarantees provided by the GDPR (Standard Contractual Clauses, adequacy decisions).

11Amendments

This privacy policy may be amended to reflect changes in regulations or our practices. Any substantial change will be notified to you by email if you are registered in our contact database. The version in force is the one published on this site at the time of your consultation.