Privacy Policy

1. Data Controller

The data controller for your personal data is:

• Name: Barko Tavern
• Address: Adamas, Milos 84800, Greece
• Email: barkotavernmilos@gmail.com
• Phone: +30 22870 22660

2. Data That May Be Collected

Depending on how you use the website, the following data may be collected:

• Browsing data (anonymous): device/browser type, country at a general level, visit duration, pages viewed — via analytics tools.
• Contact details: email or phone number, only if you choose to contact us directly.
• Cookie preference: your choice on the cookie banner is stored locally in your browser.

We do not collect or process special categories of personal data.

3. Third-Party Tools & Services

Google Analytics 4 — ID: G-W5LVLHN94F
Provided by Google LLC (USA). Collects anonymous browsing statistics. It is activated only after explicit acceptance of cookies; without acceptance it remains fully disabled. Google Privacy Policy →

Umami Analytics
Provided by Umami Software Inc. (USA). A privacy-first analytics tool: no cookies are used, no personal data is stored, and IP addresses are fully anonymised. Statistics are aggregated and do not allow identification. Umami Privacy Policy →

Google Maps (Embed)
An embedded Google Maps iframe is used on the home page and reservations page. When the map loads, Google LLC (USA) may receive your IP address and set cookies. Use is subject to Google's privacy policy. Google Privacy Policy →

TripAdvisor
The website contains only a link to TripAdvisor — there is no widget embedded. No data is sent to TripAdvisor while you browse our site.

4. Cookies

Cookies are small files stored on your device when you visit a website, so it can remember your preferences. They do not have access to files or documents on your device.

This website uses the following cookies:

• cookie_consent (Necessary) — Stores your cookie choice. Duration: 1 year.
• _ga, _ga_* (Analytics — Google Analytics) — Distinguishes anonymous users for statistics. Duration: up to 2 years. Activated only after acceptance.
• Google Maps cookies (Third-party — e.g. NID, SIDCC) — Set automatically by the Google Maps iframe on the home page and reservations page when the page loads. Duration: as per Google's policy.

Umami does not use cookies.

5. Purpose & Legal Basis for Processing

• Google Analytics: Improving the website through anonymous statistics. Legal basis: Consent (Article 6(1)(a) GDPR).
• Umami Analytics: Anonymous aggregated statistics without cookies and without the ability to identify individuals. Legal basis: Legitimate interest (Article 6(1)(f) GDPR).
• Google Maps (Embed): Displaying the location for visitors' convenience. Google may process your IP address when the map loads. Legal basis: Legitimate interest (Article 6(1)(f) GDPR) — finding directions to the tavern is a reasonable interest of both visitor and business.
• Contact (email/phone): Responding to your enquiries. Legal basis: Legitimate interest (Article 6(1)(f) GDPR).

We do not carry out automated decision-making or profiling (Article 22 GDPR).

6. Data Retention Period

• Google Analytics statistics: up to 14 months (GA4 setting).
• Umami statistics: as per Umami Software Inc.'s policy.
• Google Maps: as per Google LLC's retention policy.
• Contact details: for as long as needed to respond, then deleted.
• Cookie consent: 1 year.

7. Transfers Outside the EU/EEA

Google LLC is based in the USA and participates in the EU–US Data Privacy Framework (DPF), which constitutes an adequate safeguard under Article 45 GDPR.

Umami Software Inc. is also based in the USA. The data transferred is anonymised and does not allow identification of any natural person.

8. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Access (Article 15): to find out what data we process about you.
• Rectification (Article 16): correction of inaccurate data.
• Erasure (Article 17): the "right to be forgotten".
• Restriction of processing (Article 18).
• Objection (Article 21): to processing based on legitimate interest.
• Portability (Article 20): to receive your data in a structured format.
• Withdrawal of consent: at any time via cookie settings or by contacting us.

To exercise any right, please send a request to barkotavernmilos@gmail.com. We respond within 1 month of receipt (Article 12 GDPR).

9. Data Breach

We take all appropriate technical and organisational measures to protect your data. In the event of a breach that may endanger your rights, we will notify the HDPA within 72 hours (Article 33 GDPR) and, where required, inform you directly (Article 34 GDPR).

10. Minors

This website is not directed at minors under the age of 15 (the threshold set by Greek Law 4624/2019). If you are under 15, please use this website only with the consent of a parent or guardian.

11. Complaint to the DPA

If you believe that the processing of your data violates applicable law, you have the right to lodge a complaint with:

Hellenic Data Protection Authority (HDPA)
1–3 Kifissias Ave., 115 23 Athens, Greece
www.dpa.gr

12. Policy Updates

This policy is updated when legislation or the tools we use change. Each new version is published on this page with an updated date.