Privacy notice

Who is the controller

The controller of the personal data described in this notice is the operator of this website. Name, registered address, VAT number and company register number are given in the imprint and identification page, and are repeated in the footer of every page on this site.

In the current build those identification fields are still marked as pending. That is deliberate and visible: a privacy notice that names a controller nobody can identify is worse than one that admits the field is not filled in yet. They are completed before launch.

No data protection officer is appointed. The project is small and its processing is limited to the purposes below. The contact address on the imprint page acts as the privacy contact and is the address to use for every request in this notice: hello@cycladesgo.com. In the current build that address is a placeholder; the real one is published on the imprint page before launch.

What this site does not do

There are no cookies. There is no consent banner, because there is nothing to consent to. There is no advertising network, no analytics script running in your browser, no advertising identifier, no cross-site tracking, and no fingerprinting of any kind. Nothing about you is attached to the sponsored content on this site, and no sponsor can see who read it.

The single value stored in your browser is your light or dark theme choice, under the key cg-theme, in local storage. It never leaves your device and it is deleted when you clear site data. The cookies page sets out the whole position.

Purposes and lawful bases

We process personal data for three purposes, and only these three. The lawful basis is given for each, under Article 6(1) GDPR.

Measuring how many people read a page, in aggregate

Lawful basis: Article 6(1)(f) GDPR — legitimate interests

Data: Server request logs: IP address, user agent, requested URL, timestamp. Shortened or anonymised at the edge before storage.

Why: To know which pages are useful and which are not. A page nobody opens cannot be improved, and a bus timetable nobody reads is worse than useless.

Not done: No cross-page tracking, no advertising identifiers, no profiles, no sharing with advertising networks.

Answering a report or an e-mail about the timetable or the data

Lawful basis: Article 6(1)(b) GDPR — steps taken at your request prior to entering into a contract

Data: The e-mail address you used, the contents of your message, and anything you attach.

Why: To be able to check a report against the operator, and to reply to you.

Not done: Your message is not used for marketing, is not added to a mailing list, and is not shared with anyone except the operator we need to check with.

Running the site, and keeping it available

Lawful basis: Article 6(1)(f) GDPR — legitimate interests

Data: The same request logs, plus any error output from the build and the host.

Why: To keep the site up and to fix what breaks.

Not done: No cookies, no local storage beyond your own theme preference, no fingerprinting.

We do not rely on consent as a lawful basis for anything. There is no consent to withdraw, because no consent is collected.

Categories of data

Network and log data: your IP address at the time of the request, your browser and device identifiers as sent in the request, the page requested, and the timestamp. Content data: the text of any e-mail you send us and anything you attach to it, which may include your name and details about a journey you took.

We do not collect or hold special categories of data under Article 9. If your message happens to include information about your health, your religion or your political opinions, please do not send it, and tell us so that we can delete it.

Recipients and processors

The site is hosted on Vercel. Vercel processes the request data on our behalf as a processor, under a data processing agreement. It is the only processor that handles personal data from this site.

Email is handled through a mail provider, also as a processor. The domain and DNS are handled by a registrar and a DNS provider, both as processors.

Where a report requires it, we may contact the operator concerned — for example KTEL Naxos when a Naxos time is reported wrong — in order to check it. That disclosure is limited to the fact in question. We do not sell data, share it for advertising, or make it available to any sponsor.

International transfers

Vercel is a company established in the United States, and its infrastructure is in the United States. Transferring the request data there is a transfer to a third country for the purposes of Chapter V GDPR.

TODO before launch: the transfer mechanism relied on is not yet confirmed and is not stated here. On our present understanding it will be the EU-US Data Privacy Framework for certified US recipients, backed by standard contractual clauses for anything outside it, with a transfer impact assessment on file. This paragraph will state the mechanism, the recipient and the assessment date. It is not written in the meantime because a notice that names a safeguard we have not verified is worse than one that admits the gap.

No other transfer outside the European Economic Area takes place. The planners themselves are static applications with no backend: once the code and timetable are downloaded, nothing you do in them is sent anywhere.

How long we keep it

When a period ends, the data is deleted or irreversibly anonymised. The planners hold no user data at all, because they have no accounts and no server-side component.

Your rights

You have the following rights under the GDPR. Write to the contact address on the imprint page and we will answer within one month.

Article 15

Right of access. You can ask what personal data we hold about you. We answer within one month, free of charge.

Article 16

Right to rectification. You can ask us to correct data that is wrong. We correct it.

Article 17

Right to erasure. You can ask us to delete data. We delete it, unless we are required to keep it.

Article 18

Right to restriction of processing. You can ask us to pause what we do with your data while a question is resolved.

Article 19

Right to notification. You can ask us to tell anyone we gave your data to that we have erased or corrected it.

Article 20

Right to data portability. You can ask for the data we hold about you in a structured, machine-readable file.

Article 21

Right to object. You can object to processing based on legitimate interests. We stop unless we can show a compelling reason.

Article 22

Rights relating to automated decision-making. Nothing on this site makes a decision about you by automated means, and nothing will without telling you first.

Right to object, in particular

Article 21 gives you the right to object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or 6(1)(f) — which is what both measurement and the running of the site rest on. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.

We do not use profiling, automated decision-making or targeted advertising, so there is no separate right to object to profiling here. That is a deliberate design decision, not an oversight, and it is why this notice can be this short.

Right to complain

You may complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Προδοσιακών Δεδομένων) at dpa.gr. We would rather you wrote to us first, but that is your choice and not a condition of it.

Changes to this notice

If this notice changes, the date at the top of the page changes with it. The most likely reason for a change is the pending transfer mechanism, which will be replaced by a specific named safeguard rather than left as a gap.

Date last updated: 2026-09-28