This Privacy Policy explains how ZanteWeb It & Development P.C. (registered office: Floka Gaitani, Zakynthos 29100, Greece; GEMH 146006224000; contact email info@zanteweb.com; phone +30 26950 27447; hereinafter "ZanteWeb", "we", "us") collects, stores, uses, and otherwise processes the personal data of visitors and users of https://www.zanteweb.com and the products and services we operate.

ZanteWeb It & Development P.C. is a Greek IT & e-marketing company with 24+ years of experience in tourism and leisure services. We design, develop, host, and operate online platforms used by hundreds of businesses, primarily in the tourism, transportation, and rental sectors.

1. What is personal data?

"Personal data" refers to any information about identified or identifiable natural persons, such as name, postal address, email address, telephone number, etc., that identifies or can identify you (hereinafter "Personal Data" or "Data").

2. What is processing of personal data?

Any operation or set of operations performed on personal data, with or without automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

3. ZanteWeb products and services

ZanteWeb operates several distinct online products and services. This privacy policy is the corporate policy applicable to all of them. Each product also publishes its own dedicated, product-specific notice with additional detail.

4. What data do we collect, and for what purpose?

4.1 Data collected as Data Controller (corporate website)

On www.zanteweb.com we collect, as Data Controller, the name and email address of users who contact us through the contact form on this site, for the purpose of replying to their inquiry.

4.2 Data we process as Data Processor (on behalf of customers)

For client websites we have built and host on behalf of our customers (Account Holders), we may have access to data submitted through contact forms on those sites — in those cases, we act as a Data Processor and our customer is the Data Controller.

4.3 Data processed via EzCar (car rental SaaS)

For rental agencies and end customers using EzCar, we process booking data, contact information, and rental records on behalf of the agency (Account Holder). The Account Holder is the Data Controller of its own customer data; ZanteWeb acts as the Data Processor. For details, see the EzCar privacy notice at www.ezcar.gr/gr-privacy.php.

4.4 Data processed via CloudBoat (boat/tour rental SaaS)

Equivalent to 4.3, for the boat rental and tour booking platform. Additionally, if an Account Holder activates the optional Google Calendar Integration, we process OAuth 2.0 tokens issued by Google for that operator (see Section 14).

4.5 Cookies

For data collected via cookies on this website, please see our Cookie Policy.

5. Lawful basis for processing

We collect personal data only when there is a lawful basis for processing it. Processing will be based on one of the following grounds:

• Performance of a contract between you and us, or pre-contractual measures;
• Your consent, where required (you may withdraw your consent at any time);
• Compliance with our legal obligations;
• Our legitimate interests, where these are not overridden by your fundamental rights and freedoms.

For Google Calendar Integration through CloudBoat (Section 14), the lawful basis is the explicit consent that the Account Holder provides through Google's OAuth 2.0 consent screen. Consent may be withdrawn at any time via Google Account Permissions.

6. Recipients of your data

Access to your data is granted only to the strictly necessary personnel of the Company, who are bound by confidentiality obligations.

Your data is not transferred to third parties except to the customers of ZanteWeb (Account Holders) you contact, or to our payment / hosting / technical-support partners who are also bound by appropriate confidentiality and data-protection terms.

Google API data: Information received from Google APIs (in the context of the CloudBoat Google Calendar Integration) is never sold, never used for advertising, and never transferred to third parties except as strictly required to provide the integration or to comply with applicable law. See Section 14 below for the full Limited Use disclosure.

7. How do we ensure that our partners respect your data?

ZanteWeb's partners have agreed and committed to:

• Maintain confidentiality;
• Not transmit ZanteWeb customer data to third parties without permission;
• Take appropriate technical and organisational security measures;
• Comply with applicable data protection law, including Regulation (EU) 2016/679 (GDPR).

8. Does ZanteWeb send data outside the EU?

Your data is not sent outside the EU, as it is processed only within Greece, with the possible exception of hosting service providers operating from countries with an adequacy decision of the European Commission. In all cases, transfers comply with EU law (Standard Contractual Clauses, adequacy decisions, etc.).

9. When do we delete your data?

Data is retained for as long as necessary to fulfil the purpose for which it was collected, unless a longer period is required due to legal claims or legal obligations of ZanteWeb. Each product (ezcar, CloudBoat) defines specific retention periods for its own data — see the relevant product-specific privacy notice.

For OAuth tokens issued in the context of Google Calendar Integration via CloudBoat, tokens are deleted from our database within 24 hours after revocation by the Account Holder via Google Account Permissions or upon explicit request.

10. Is your data secure?

Recognising the importance of the security of your personal data, ZanteWeb has implemented all appropriate organisational and technical measures to protect your data from unauthorised access, misuse, alteration, prohibited disclosure, loss or accidental/unlawful destruction, and any other form of unlawful processing. These measures are reviewed and modified as necessary.

Communications with our servers are encrypted using SSL/TLS. OAuth tokens for the CloudBoat Google Calendar Integration are stored encrypted at rest in our secure database, with strict access controls.

11. What are your rights as a data subject?

You have the following rights:

11.1 Right of access

You have the right to be informed by ZanteWeb how and which of your data we process. You may request information about the purpose of processing, the categories of your data we hold, the recipients (if any) to whom we transfer it, the retention period, and whether automated decision-making takes place.

11.2 Right to correction

If you discover an error in your data, you may submit a request for the correction of inaccurate data and the completion of incomplete data, so that it is complete and accurate.

11.3 Right to erasure

You may request that ZanteWeb erase your data if it is no longer necessary for the above-mentioned processing purposes.

11.4 Right to data portability

You may request to receive, in a machine-readable format, the data you have provided to us, or request that ZanteWeb transfer it to another data controller.

11.5 Right to restriction of processing

You may request that ZanteWeb restrict the processing of your data while your objections to the processing are pending review.

11.6 Right to withdraw / object to processing

You may object at any time to the processing of your data, or withdraw your consent where required, and ZanteWeb will stop processing your data unless there are other overriding legitimate grounds, or it is no longer necessary for the above-mentioned processing purposes.

For Google Calendar Integration via CloudBoat, you may revoke access at any time via your Google Account Permissions.

12. How can data subjects exercise their rights?

Rights may be exercised by submitting a request either by post to Φλόκα Γαϊτανίου, 29100 Ζάκυνθος, or by email to info@zanteweb.com.

ZanteWeb will respond to requests without undue delay, and in any event within one (1) month of receipt. If, however, the request is complex or there is a large number of requests, ZanteWeb will inform the data subject within that month if an extension of another two (2) months is necessary, within which a response will be provided.

If the data subject does not receive a response within the above period, or the response is unsatisfactory or the issue has not been resolved, the data subject may contact the Greek Data Protection Authority (www.dpa.gr).

13. Do we use automated decision-making, including profiling?

ZanteWeb does not make decisions, nor engages in profiling, based on automated processing of data subjects' data.

14. CloudBoat Google Calendar Integration (auth.zanteweb.com)

ZanteWeb operates the CloudBoat SaaS platform, including its OAuth 2.0 authentication server at auth.zanteweb.com. This is the domain that users will see in the URL bar during the Google consent flow when an Account Holder connects their Google Calendar to CloudBoat. We mention this here so that visitors who arrive at this privacy policy via the Google consent screen understand who we are and how to find more information.

Note: At present, the OAuth integration is used only by CloudBoat. EzCar (our car rental SaaS) does not currently use Google Calendar Integration. If we extend OAuth to additional products in the future, this notice and the relevant product-specific notices will be updated accordingly.

14.1 Who can connect Google Calendar to CloudBoat

The CloudBoat Google Calendar Integration is available only to Account Holders (boat captains and tour operators who use CloudBoat to manage their bookings). End customers do not authorize Google Calendar access.

14.2 Limited Use Disclosure

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• Google user data is used only to provide and improve the CloudBoat Calendar Integration feature;
• We never transfer Google user data to third parties except as strictly necessary to provide or improve the integration, to comply with applicable law, or in connection with a merger/acquisition with comparable privacy protections;
• We never use or transfer Google user data for serving advertisements;
• We do not allow humans to read Google user data unless we have explicit consent, it is required for security or legal compliance, or the data is aggregated for internal operations consistent with the Limited Use requirements.

14.3 Where to find the full integration disclosure

For the comprehensive description of how CloudBoat handles Google Calendar data — including OAuth scopes requested, token storage and lifecycle, multi-domain architecture, revocation procedure, and full Limited Use disclosures — please see Sections 14 and 15 of the CloudBoat privacy policy at https://www.cloudboat.gr/privacy.php.

15. Applicable law

Greek law applies, as supplemented by Regulation (EU) 2016/679 (GDPR) and applicable national and European legislation on personal data protection. Disputes related to data subjects' data shall fall under the jurisdiction of the courts of Zakynthos.

16. How will you be informed of changes to this Policy?

This Policy is updated whenever necessary. If there are significant changes to the Policy or to the manner in which data is processed, an updated version will be published on the ZanteWeb website, where data subjects will be able to be informed of these changes. The "Last Updated" date at the top of this notice indicates when these terms were most recently revised.

Last Updated: April 25, 2026