Privacy Policy
Last updated: September 2026
Data Controller
The controller responsible for the personal data described in this policy is:
Greek Island Platforms Single Member P.C.
GEMI 195743338000 · VAT No. 803382933
Registered office: Naxos 84300, Greece
[email protected]
1. Information We Collect
We collect information you provide directly (name, email, payment details) and automatically (usage data, device information, cookies). If you consent to analytics in our mobile apps, we also collect an app instance identifier and app usage events — see section 12. For drivers using the GIBS Driver mobile app, we also collect precise location data (GPS) during active shifts, including in the background, so passengers can see live bus position.
2. How We Use Your Information
We use your information to process ticket purchases, send booking confirmations, improve our services, and communicate with you about your account.
3. Data Sharing
We share your information with bus operators to fulfil your booking, payment processors (Stripe) to process payments, and email providers to send confirmations. Where you have consented to mobile app analytics, diagnostic and usage data is processed on our behalf by Google (Google Analytics for Firebase and Firebase Crashlytics) as described in section 12. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
4. Your Rights (GDPR)
You have the right to access, correct, delete, or export your personal data. You may also object to processing or request restriction. Contact us at [email protected].
5. Data Retention
Retention periods by category: bus location (GPS) data recorded during a driver shift is deleted after 12 months; stop arrival and departure events after 24 months; account data 30 days after an account deletion request. Ticket, payment and tax records are kept for the period required by Greek tax and accounting law, which is longer than the periods above.
6. Cookies
Please refer to our Cookie Policy for information about how we use cookies on our website. Our mobile apps do not use cookies; the equivalent app technologies are described in section 12.
7. Legal Basis for Processing (GDPR Art. 6)
We process your personal data under the following legal bases: (a) Performance of a contract (Art. 6(1)(b)) — when you purchase tickets or create an account; (b) Legitimate interests (Art. 6(1)(f)) — for fraud prevention, platform security, and service improvement; (c) Consent (Art. 6(1)(a)) — for marketing emails and optional analytics cookies, which you may withdraw at any time; (d) Legal obligation (Art. 6(1)(c)) — for tax records and regulatory compliance under Greek and EU law.
8. International Data Transfers
Your data is primarily stored within the European Economic Area (EEA). Where we transfer data outside the EEA (e.g., to cloud service providers, or to Google for the mobile app analytics described in section 12, which may be processed in the United States), we ensure adequate protection through EU Standard Contractual Clauses (SCCs), the EU-US Data Privacy Framework, or adequacy decisions by the European Commission, in accordance with GDPR Chapter V.
9. Data Protection Contact
We have not appointed a Data Protection Officer. Questions about this policy, and requests concerning your personal data, should be sent to [email protected] or by post to the registered office named at the top of this policy. They are handled by the company directly.
10. Right to Lodge a Complaint
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr, or with the supervisory authority in your EU/EEA country of residence. You also have the right to seek judicial remedy. The HDPA can be reached at Kifisias 1-3, 115 23 Athens, Greece.
11. Driver Location Data (GIBS Driver App)
When a driver uses the GIBS Driver mobile app to start a shift, the app collects precise device location (GPS) — both while the app is in the foreground and in the background — for the duration of the shift. This data is used to (a) display the live position of the bus to passengers viewing that route, (b) record the route actually driven for operational and safety review, and (c) match scanned passenger tickets to the correct trip. Location is only collected while a shift is active; it stops as soon as the driver ends the shift. Background location requires the driver's explicit Android system permission and can be revoked at any time in the device settings (which will end live tracking). We do not sell location data, do not use it for advertising, and do not share it with third parties other than our hosting and map providers acting as data processors. Location records are retained for up to 90 days for operational review, then deleted or anonymised.
12. Mobile App Analytics and Crash Reporting
Our passenger app can use Google Analytics for Firebase and Firebase Crashlytics, provided by Google Ireland Limited, to understand how the app is used and to diagnose crashes. This is strictly optional. We ask you when you first open the app, nothing is collected unless you choose to allow it, and you can change your mind at any time in Profile → Privacy. If you withdraw consent we stop collecting immediately and reset the identifiers held on your device. The legal basis is your consent (GDPR Art. 6(1)(a)). Where allowed, we collect an app instance identifier, device model, operating system version, app version, language and country, the screens you open, and in-app actions such as viewing an island, route or timetable and completing a ticket purchase, together with crash diagnostics (error type, stack trace and device state at the time of the crash). We do not collect your name, email address or precise location for analytics, we do not use advertising identifiers (IDFA/AAID), we do not track you across other companies' apps or websites, and we do not use this data for advertising. Separately, and whether or not you allow the above, we keep our own aggregate usage counters (for example, how many times a screen was opened on a given day). These carry no device, account or advertising identifier and cannot be traced back to you or your device; approximate daily visitor numbers are derived using a value that is rotated every day so it cannot follow you over time. You can switch these off in the same Profile → Privacy screen. Analytics data is retained by Google for up to 14 months and crash reports for up to 90 days.
13. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it, to request a copy of it, to request its correction or deletion, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA/CPRA — our apps use no advertising identifiers and no advertising networks. The categories of personal information we collect are identifiers (such as name and email), commercial information (ticket purchases), internet or network activity (app and website usage), and geolocation data (precise location only in the GIBS Driver app during an active shift, as described in section 11). We collect these to provide and improve the service, as set out in section 2, and we do not knowingly collect personal information from children under 16. To exercise any of these rights, email [email protected]; you may also use an authorised agent. We will verify your request using the email address associated with your account and respond within the timeframes required by law.