Legal

Privacy Policy

In short: we only collect what your account and the community need to work. We do not sell your data and we do not use advertising cookies. With your consent, we count visits with PostHog. Below we explain it all in detail.

Last updated: October 10, 2026

Contents

Who is responsible for your data

The controller of the personal data described here is the operator of Next Adventure at nextadventure.gr.

We process your data in line with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the related Greek legislation (Law 4624/2019).

For anything about your data, get in touch with us.

What data we collect

  • Optional statistics: once you accept, the pages you visit, visitor and session identifiers, and basic details of your browser and device. We do not send account details, or URL parameters and fragments that contain invitation keys. The provider receives your IP address when your browser contacts it.
  • Account: email, username, display name and password (we only store it as a one-way hash, never in readable form), your language for the site (the one you signed up in, until you choose another), and the date the account was created.
  • Sign in with Google: if you choose to sign in with Google, we receive your email, your name and the unique identifier of your Google account. We do not receive your password or your contacts.
  • Profile: a photo, a short bio and a city, if you add them. They are optional.
  • Content and activity: the events you publish (title, description, place, date, images), your attendance answers, likes, comments, and the members you follow or who follow you.
  • Invitations: when an organizer invites an email address to an invite-only event, we store the address with the invitation, and the account that accepted it. If you have no account, the address is all we know about you. If you ask not to receive invitations, we keep the address on a stop list so your request is respected. So that nobody can send too many messages to the same address, for every invitation sent we keep, for two days, a code derived from the address (not the address itself).
  • Inquiries about experiences: if you send one from the form on an experience’s page, what you write in it and where you came from. See Inquiries about experiences.
  • Bookings of experiences: if you book a place on an experience’s page, your booking details, which go to the operator of that experience. See Bookings.
  • Technical data: IP address, browser and device type, and the time and kind of each request. Our servers log these for security, to prevent abuse (such as limiting repeated sign-in attempts) and to fix errors.
  • Push notifications: if you turn them on for a device, we keep the address your browser gives its notification service and the keys that encrypt what we send you there. We delete them when you turn them off, when you choose “Sign out” on that device and when you delete your account. When you change your password we delete them from all devices, and your own devices send them again as soon as you open the app on them.
  • On your device: a sign-in key, so you don’t have to sign in on every visit, and your choice of language. See the Cookie Policy.

When you upload a photo, we resize it and remove its metadata, such as where it was taken.

We do not ask for sensitive data, such as health details, religious beliefs or sexual orientation. Don’t write it in your profile, your events or your comments, because they are public.

What is public

For the platform to work as a community, some details are visible to everyone, even without an account:

  • your profile: username, display name, photo, bio, city, the date you joined and the events you have published,
  • your events, and the fact that you organize them,
  • your name and photo in the list of people who say they are going to an event,
  • your comments.

Likes are only shown as a number. Your email is not shown to other members. Only the platform’s administrators see it, to manage accounts.

Private and invite-only events do not appear in the lists or on your public profile. The organizer of an invite-only event sees the addresses they invited and, for each accepted invitation, the name of the member who accepted it.

Inquiries about experiences

The pages of experiences have a form for asking about them. You don’t need an account to send one. When you send an inquiry, we keep:

  • your name, email address and message, and your telephone number, the number of guests and when you would like to go, if you give them,
  • which experience, and which language of the page, you sent it from, and where you came from: the website you followed a link from (only its domain, such as google.com, not the page you were on) and the campaign tags in the link, if it had any (such as utm_source),
  • the time you ticked the box to agree.

The Next Adventure team reads your inquiry, to answer it at the email address you gave. If it is needed to answer you, we may share it with whoever offers the experience, for that purpose only.

Legal basis: your consent, which you give by ticking the box on the form (GDPR Article 6(1)(a)). You can withdraw it at any time.

We keep an inquiry until the team has answered it and for as long as needed to follow up, for 24 months at most. You can ask us to delete it sooner at any time: get in touch with us.

Bookings

Some experiences can be booked on their page. You don’t need an account to book. When you book, we keep:

  • your name and email address, and your telephone number and a note, if you give them,
  • the day and time you booked, how many places, which experience, and which language of the page you booked from,
  • where you came from: the website you followed a link from (only its domain) and the campaign tags in the link, if it had any (such as utm_source),
  • the time you ticked the box to agree, and, if you are signed in, your account.

Unlike an inquiry, a booking goes to the operator of the experience: the organization that runs it and manages its page on Next Adventure. The operator sees your details to run the booking (to confirm, decline or change it and to welcome you), and for that purpose only. The Next Adventure team can also see it, to look after the site.

We send emails about the status of your booking (confirmed, declined, cancelled or expired) to the address you gave.

Legal basis: taking the steps you ask for to make and run the booking (GDPR Article 6(1)(b)). The box on the form confirms that you know your details go to the operator.

We keep a booking for 24 months after its date. After that we blank your name, email, telephone number and note, and only the count of the booking stays. If you have an account and delete it, your bookings are blanked the same way.

Every booking has its own link, which is how you see it or cancel it. Anyone who has the link can do the same, so keep it private.

Why we use it

  • Running your account and the platform (sign-up, sign-in, publishing events, attendance, comments). Legal basis: performing our contract with you, that is the Terms of Service (GDPR Article 6(1)(b)).
  • Security and moderation (preventing fraud and abuse, reviewing reports, fixing errors). Legal basis: our legitimate interest in protecting the platform and the community (GDPR Article 6(1)(f)).
  • Contacting you about your account or your requests. Legal basis: performing the contract, or legitimate interest.
  • Sending invitations: we send a message with a personal link to the address the organizer of an invite-only event gave. Legal basis: the organizer’s legitimate interest, and ours, in invitations working by email (GDPR Article 6(1)(f)). Every message has a link to stop invitations.
  • Understanding how the site is used: optional visit counting with PostHog, based on your consent. You can withdraw it from “Statistics settings” at the bottom of the page.
  • Complying with the law and answering the competent authorities. Legal basis: legal obligation (GDPR Article 6(1)(c)).

Giving an email and a password (or signing in with Google) is needed to create an account. Everything else is optional.

We make no automated decisions and no profiling that affect you significantly, and we do not use your data for advertising. If in the future we want to send you newsletters or use cookies that are not necessary, we will ask for your consent first.

Who we share data with

We do not sell or rent your personal data. We only share it with providers that help us run the platform, and only what they need:

  • Hosting and database: we use Supabase for the database (on servers in Ireland, in the EU) and a server provider to run the application and store images.
  • Google: for Sign in with Google (if you use it), the place search when you create or edit an event, the embedded maps on event and experience pages and the page’s icons from Google Fonts. When these load, Google receives your IP address and details of your browser, and processes them under its own privacy policy.
  • DeepSeek: when you create an event from a link, we send the text of the public page you gave, so the event’s details can be found. When you publish or change a public event, we send what the event itself says (the title, description, category, date, place and organizer you wrote), to derive search details such as the city, the distance of a route or the kind of music. We do not send private or invite-only events, or your account details. Don’t give pages with other people’s personal data, and don’t write it in public events.
  • Resend: to send invitations by email, and to tell our team about an inquiry sent from the form of an experience. It receives the recipient’s address and the content of the message (for an invitation, the event’s title, time and place, the organizer’s name and the invitation’s personal link; for an inquiry, the experience and what you wrote in the form).
  • Browsers’ notification services (Google’s, Mozilla’s, Apple’s and Microsoft’s, depending on your browser): only if you turn on push notifications, so they reach your device. The content of every notification (for example an event’s title and time, or a comment) is encrypted so they cannot read it; they only see the device’s address, the time and the size of the message.
  • PostHog: only if you accept usage statistics, to count visits, in the EU region. We do not turn on session recording or account identification. See the Cookie Policy for what is stored and how to withdraw.
  • The operator of an experience you book: your booking details, to run the booking. See Bookings.
  • Authorities: when the law or a valid order of an authority requires it, or to protect rights and people’s safety.

Transfers outside the European Economic Area

Google, DeepSeek and Resend may process data in countries outside the European Economic Area, such as the USA or China. For Google, transfers are covered by the safeguards it applies itself, such as the standard contractual clauses. To DeepSeek we only send text that is already public: the web pages you choose and public events, never private events or account details. Resend sends emails from Europe, but stores its account data, such as message metadata and logs, in the USA. Browsers’ notification services may also be outside the European Economic Area, but they only receive the content of notifications encrypted.

How long we keep it

  • Account and profile: for as long as you have an account.
  • After you delete your account: we delete your email, username and display name, photo, bio, city, follows and Google sign-in link, and your password no longer exists. Your events, attendance answers, likes and comments remain without anything that identifies you, as “Deleted user”. If you want those removed too, delete your comments and archive your events first, or ask us.
  • Invitations: for as long as the event exists, unless the organizer removes the invitation sooner. When you delete your account, we delete the invitations you had accepted and those about your email. The invitations you sent stay with your events. The stop list stays, because otherwise the address could be invited again.
  • Inquiries about experiences: until the team has answered and for as long as needed to follow up, up to 24 months at most. See Inquiries about experiences.
  • Bookings: 24 months after the date of the booking; then the personal details are blanked and only the count stays. See Bookings.
  • Banned accounts: we keep what is needed to enforce the ban for as long as it lasts.
  • Logs: for a limited time, as long as security and fixing errors need.
  • Backups: may hold data for a short while after it is deleted, until they are replaced.

If the law requires us to keep something for longer, we keep it only for that purpose.

Your rights

You have the right:

  • to know what data of yours we process and to get a copy (access),
  • to correct inaccurate data,
  • to ask for it to be deleted,
  • to restrict its processing,
  • to object to processing based on our legitimate interest,
  • to receive the data you gave us in a structured format (portability),
  • to withdraw your consent, where you have given it.

If you have no account and someone invited you by email, you can stop invitations from the link in the message itself, without signing in.

You can change your profile and delete your account at any time from Settings. For everything else, get in touch with us. We will answer within a month at most, free of charge. We may ask you to confirm your identity.

If you believe we are breaching your rights, you can complain to the Hellenic Data Protection Authority. We would be glad to sort it out with you first, though.

How we protect your data

Your connection to the platform is encrypted (HTTPS), passwords are only stored as a hash and access to the database is limited to what the application needs. No system is perfectly secure. If an incident affects you, we will act as the law requires, including telling you where required.

Minors

The platform is for people aged 16 and over. We do not knowingly collect data from younger children. If you learn that a child under 16 has an account, get in touch with us and we will delete it.

Changes to this policy

If we change this policy in substance, we will tell you on the platform and change the date at the top of the page.