Privacy Policy
Privacy Policy
Last updated: 25 October 2026
1. Introduction
Emm. Mavrakis S.A. ("we", "us", "our") respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website, contact us, make a car rental reservation or use our services.
Our website is available at https://autopapas.com.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Greek data protection legislation.
2. Data Controller and Contact Information
The data controller responsible for processing your personal data is:
Emm. Mavrakis S.A.
Contact person: Babis Mavrakis
Address: A. Papandreou 130, Ammoudara, Heraklion, Crete, Greece
Website: https://autopapas.com
Email: [email protected]
For questions concerning the processing of your personal data or requests to exercise your data protection rights, please contact us using the email address above.
3. Personal Data We Collect
3.1 Contact Forms and Enquiries
When you contact us through our website, email or other communication channels, we may collect:
Your name and email address.
Your telephone number.
The content of your message or enquiry.
Information relating to a requested vehicle or rental.
Technical information associated with your submission, where collected.
We use this information to respond to enquiries, provide quotations and assist customers.
Our website contact forms use Brevo for email delivery. Messages are received and managed through our business email services provided by Google.
Contact form submissions are not stored in the active Elementor Submissions database. Technical processing, email delivery records, server logs and backups may nevertheless contain information associated with communications.
3.2 Car Rental Reservations
When you make a car rental reservation, we collect information necessary to process and manage your booking.
Depending on the services requested, this may include:
Full name.
Email address and telephone number.
Residential or billing address, city, postal code and country.
Rental dates and selected vehicle.
Pickup and return locations.
Arrival details, including flight number, ferry information, arrival time or hotel delivery details.
Booking reference and rental history.
Additional instructions or information provided during the reservation process.
We may also collect identification and driving licence information when necessary to complete the rental agreement or comply with applicable requirements.
Certain information is necessary to fulfil your reservation. Without it, we may be unable to provide the requested rental service.
3.3 Technical and Website Information
When you visit our website, our systems and service providers may process technical information, including:
IP address.
Browser and device information.
Date and time of requests.
Pages requested and server logs.
Session identifiers.
Cookies and browser local storage information.
Security-related information necessary to detect malicious activity.
This information may be processed to operate the website, maintain security, manage reservations, remember consent preferences and provide specific website functions.
4. Purposes and Legal Bases for Processing
We process personal data for the following purposes:
| Purpose | Legal basis |
|---|---|
| Responding to rental enquiries and providing quotations | Article 6(1)(b) GDPR – Pre-contractual measures |
| Creating and managing car rental reservations | Article 6(1)(b) – Performance of a contract |
| Providing customer support | Article 6(1)(b) or 6(1)(f), depending on the circumstances |
| Issuing invoices and complying with tax or accounting obligations | Article 6(1)(c) – Legal obligation |
| Maintaining website security and preventing spam, fraud and unauthorised access | Article 6(1)(f) – Legitimate interests |
| Displaying optional Google Maps content | Article 6(1)(a) – Consent |
| Establishing, exercising or defending legal claims | Article 6(1)(f) – Legitimate interests |
Our legitimate interests include maintaining a secure and reliable website, protecting our systems against abuse, providing customer support and protecting our legal rights.
Where applicable, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
5. Website Services and Technologies
5.1 VikRentCar – Online Reservations
We use VikRentCar to manage vehicle availability, car rental reservations and customer information.
The system uses technical identifiers and cookies, including:
PHPSESSID: Supports session management and website functionality.
vrcTFP: Stores a visitor identifier generated using session, IP address and browser information for the plugin's tracking functionality.
vrcPinData: Stores a customer identification PIN that may be used to recognise returning customers and retrieve previously saved customer information.
These technologies may involve the processing of technical information or identifiers associated with visitors.
Additional information about cookies and their storage durations is provided in our Cookie Policy.
5.2 Hetzner – Website Hosting
Our website and reservation system are hosted using infrastructure provided by Hetzner.
Personal information necessary for website operation, customer reservations, technical maintenance and security may be stored or processed through this infrastructure.
For further information, see the Hetzner Privacy Policy.
5.3 Brevo – Email Delivery
We use Brevo to send emails generated by our website contact forms.
These messages may contain personal information entered by visitors, including names, email addresses, contact details and message content.
The sender address used for website-generated messages is:
Brevo may process email delivery information, technical logs and message content as necessary to provide its email delivery service.
For further information, see the Brevo Privacy Policy.
5.4 Google – Business Email Services
We use Google's email services for business correspondence, including customer enquiries, reservation-related communication and customer support.
Correspondence received through our business email accounts may contain personal information and may be processed and stored using Google's email infrastructure.
For further information, see the Google Privacy Policy.
5.5 Cloudflare Turnstile – Spam Prevention
We use Cloudflare Turnstile to protect our contact forms against spam, bots and automated abuse.
Turnstile may process technical information concerning visitors' browsers, devices and network connections to assess whether a request is legitimate.
This processing supports the security and availability of our website.
For further information, see the Cloudflare Privacy Policy.
5.6 Google Maps
We use Google Maps to display our car rental locations.
Google Maps content is blocked until the visitor provides the required consent through our cookie consent management system.
Once activated, Google may receive technical information, including IP address and browser information.
For further information, see the Google Privacy Policy.
5.7 GTranslate – Website Translation
Our website uses GTranslate to provide multilingual website content.
The service may store language-related preferences in browser local storage.
Depending on the translation functionality used, technical information and translation requests may also be processed by external service providers.
For further information, see the GTranslate Privacy Policy.
5.8 Elementor – Website Content
We use Elementor to create website pages and interactive elements, including popups.
Certain Elementor functionality may use browser local storage to record information such as page views, sessions or actions associated with popup display conditions.
Our contact forms are configured to deliver messages by email without saving new submissions to the active Elementor Submissions database.
5.9 Complianz – Cookie Consent Management
We use Complianz to manage and record visitors' cookie consent preferences.
Complianz stores information about consent choices so that the website can remember whether visitors have accepted or rejected optional categories of cookies and services.
5.10 Wordfence – Website Security
We use Wordfence to help protect our website against unauthorised access, malicious requests and other security threats.
Technical information may be processed for security monitoring, access protection and fraud prevention.
For further information, see the Wordfence Privacy Policy.
5.11 Locally Hosted Fonts
The fonts used by our website are hosted locally on our own server.
Normal website font loading does not require requests to the external Google Fonts service.
6. Cookies and Local Storage
Our website uses cookies and similar browser storage technologies for purposes including:
Session management.
Website and reservation functionality.
Customer recognition.
Website security.
Language preferences.
Popup functionality.
Cookie consent management.
Optional third-party content.
Certain technologies operate as part of the website's functionality, while others may require consent under applicable law.
Google Maps is blocked until the required consent has been provided.
Visitors may manage their optional cookie preferences through the consent management system available on our website.
For detailed information about the cookies and storage technologies used, their purposes and durations, please read our:
7. Payments
We do not accept or process online payments through our website.
Customers pay for their car rental at our premises using cash or a payment card.
We do not collect payment card numbers through our online reservation system.
When customers pay by card at our premises, the relevant payment service provider processes the information necessary to complete the transaction.
We retain the financial and accounting records required by applicable law.
8. Sharing of Personal Data
We do not sell personal data to advertisers.
Personal data may be accessed by authorised company personnel and by service providers where necessary for the operation of our business and the provision of our services.
Depending on the relevant activity, these may include:
Hetzner: Website hosting and infrastructure.
Brevo: Email delivery.
Google: Business email services and optional Google Maps content.
Cloudflare: Spam prevention and security.
Technical service providers: Website maintenance and support.
Payment service providers: In-person card transactions.
Accountants and professional advisers: Accounting, tax and legal matters.
Public authorities: Where disclosure is required or permitted by applicable law.
Other service providers: Where necessary for specific website functions requested or activated by visitors.
We limit access and disclosure to what is necessary for the relevant purpose.
Where third parties process personal data on our behalf, appropriate data protection arrangements must be in place.
9. International Data Transfers
Some service providers may process personal data outside the European Economic Area (EEA), depending on their infrastructure, operational arrangements and the services used.
Where personal data is transferred outside the EEA, we seek to ensure that an appropriate legal transfer mechanism applies, as required by the GDPR.
Such mechanisms may include adequacy decisions adopted by the European Commission or appropriate contractual safeguards.
You may contact us at [email protected] for further information about the relevant providers and applicable transfer safeguards.
10. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, subject to applicable legal requirements.
10.1 Reservations and Customer Records
Our standard retention period for car rental reservation and customer records is five (5) years.
Information may be retained for a longer period where required by applicable tax, accounting or other legal obligations, or where necessary for the establishment, exercise or defence of legal claims.
10.2 Contact Enquiries and Correspondence
Contact messages are delivered through our email services and are not saved in the active Elementor Submissions database.
We retain business correspondence for as long as reasonably necessary to respond to enquiries, manage follow-up matters and address any related legal obligations or disputes.
Correspondence relating to a reservation may become part of the relevant reservation record.
10.3 Email Delivery Records
Email delivery services may retain technical logs, delivery events and, depending on their configuration, message previews.
The retention of this information depends on the applicable provider settings, operational needs and legal requirements.
10.4 Technical and Security Records
Technical and security-related records are retained according to the relevant security, troubleshooting and operational requirements.
10.5 Cookies and Local Storage
The applicable storage periods are described in our Cookie Policy.
Personal data that is no longer required is deleted or anonymised, subject to applicable legal obligations and backup retention arrangements.
11. Data Security
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration and unlawful disclosure.
These measures include access restrictions, website security controls and the maintenance of our technical infrastructure.
Access to personal information is limited to authorised persons who require it for legitimate business purposes.
Although no internet-based service can guarantee absolute security, we take reasonable steps to protect the personal information entrusted to us.
12. Your Rights Under the GDPR
Subject to the conditions and limitations established by applicable data protection law, you have the right to:
Access: Request information about the personal data we hold about you.
Rectification: Request correction of inaccurate or incomplete personal data.
Erasure: Request deletion of personal data where the legal requirements are met.
Restriction: Request restriction of processing in certain circumstances.
Data portability: Receive certain personal data in a structured, commonly used and machine-readable format, where applicable.
Objection: Object to certain processing activities based on legitimate interests.
Withdrawal of consent: Withdraw your consent at any time where processing is based on consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact:
We will respond within the time limits required by the GDPR, normally within one month, subject to any lawful extension.
13. Right to Lodge a Complaint
If you believe that your personal data has been processed in violation of applicable data protection legislation, you have the right to lodge a complaint with a competent supervisory authority.
In Greece, the competent supervisory authority is the:
Hellenic Data Protection Authority (HDPA)
Website: https://www.dpa.gr/en
You may also contact us directly at [email protected] so that we can examine your concerns.
14. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our services, technologies, legal obligations or personal data processing activities.
Any revised version will be published on this page with an updated revision date.
For questions about this Privacy Policy, please contact: