Privacy

Last updated 11 Sep 2026. GDPR (EU 2016/679) and Greek Law 4624/2019. Controller contact: market@koglabs.com.

Who is the controller

The operator of Crete Market is the data controller for personal data processed on this site. Write to market@koglabs.com. The site is aimed at people in the European Union, with a focus on Crete, Greece. Data is hosted in the European Union.

What is stored

• Account. Email, name, password hash (argon2id), role, optional phone and photo, last login time. Email confirmation tokens and password-reset tokens are stored as SHA-256 hashes, not the raw token.
• Bookings. Listing, dates, guest count, extras, quoted totals in euro cents, driver details you type (name, age, licence country, phone, flight number) and notes. Status history is kept as booking events.
• Messages. Conversations tied to a listing or a booking, and the message body.
• Reviews, favourites, notifications. Ratings and review text, saved listings, in-app notices.
• Vendor pages. Business name, public contact details, location, fleet, photos. Claimed businesses also have an owner account.
• Technical. Session cookie after login. Server logs (IP, user agent) for a short period to run rate limits and to investigate abuse. Audit rows for admin actions.

Payment card numbers are not stored on this site in v1. Hire is paid at pickup. If a card deposit feature is later switched on, card data is handled by Stripe, not by this database.

Why it is stored

• Contract: creating an account, sending and answering booking requests, delivering messages (GDPR Art. 6(1)(b)).
• Legitimate interest: preventing abuse, keeping unclaimed public-info pages accurate enough to route a request, security logs (Art. 6(1)(f)).
• Legal obligation: invoices or tax records if they arise later; responding to a lawful request (Art. 6(1)(c)).
• Consent: optional marketing email, if you tick it. None is sent today beyond transactional mail (confirm email, reset password, booking notices).

Who sees it

The rental business sees the booking, the driver details you typed and the messages in that conversation. Admins see bookings, including those on unclaimed businesses, to pass a request on. Hosting and database run on servers in the EU. Email may be handed to an SMTP provider to deliver a message; if SMTP is not configured the mail stays in an outbox table and is not sent. There is no sale of personal data.

How long

The account stays until you ask for deletion. Booking and message rows stay for as long as the related hire may be disputed, then at least as long as Greek bookkeeping rules require if a paid invoice exists (none in v1). Unused confirmation and reset tokens expire (24 hours and 1 hour). Server logs are rotated. You can ask for erasure; legal holds can delay it.

Cookies

A session cookie is set when you log in (Auth.js JWT, 30 days). It is necessary to keep you signed in. There is no advertising cookie and no third-party analytics cookie on the pages this notice covers.

Your rights

You can access, correct, delete, restrict or port personal data, and object to processing based on legitimate interest. Write to market@koglabs.com. You can complain to the Hellenic Data Protection Authority (www.dpa.gr) or to the supervisory authority in your EU country of residence.

Children

The site is not for children under 16. A rental also has a minimum driver age set by the business, often 18 or 21.

Changes

Material changes are posted here with a new date. If a change needs consent, you are asked before it applies to you.

Related: Terms.