Privacy Policy

LocalGem is a sole proprietorship established in Athens, Greece. It is the controller responsible for the processing described in this policy, meaning that it decides why and how your data is used.

Privacy contact: hello@localgem.online.

The provider delivering your booked activity or service may separately control the data it needs to deliver that service, meet its legal obligations and manage safety. Its identity is shown with the activity or booking. Payment providers may also act as independent controllers for some of their processing. Their privacy notices explain those activities; this policy explains LocalGem's responsibilities.

The information we process depends on the features you use. We obtain it from you, from your use of the website, from someone booking on your behalf, and from the suppliers and payment or technical providers involved in your interaction with us.

Information you provide

Contact and account information: your name, email address, telephone number where needed, account identifier, authentication information and saved preferences. You can create an account with your email address or sign in with Google; when you use Google, we receive your name, email address and profile picture.

Booking information: the activity or service selected, date and time, participant numbers, required participant names or age categories, meeting or pickup details where relevant, booking reference, correspondence, and cancellation or refund requests. We request extra participant information only where necessary for the selected service and explain this when collecting it.

Billing and transaction information: payment amount and currency, transaction reference, payment status, and refund or dispute records. Payment information is also processed by Stripe as explained below.

Communications: messages, enquiries and feedback you send through our contact form or by email. Please do not send full payment card details, passwords, identity documents or unnecessary sensitive information in messages or concierge chats.

Technical information and optional features

When you access the website, our systems and service providers may process your IP address, browser and device information, requested pages, timestamps, security events and error logs to deliver and protect the service. We do not use advertising tracking.

Location. If you ask our concierge for nearby suggestions, we use your device location only after you grant permission, to return relevant results. Your approximate coordinates are sent with that single request to generate the answer and are not saved to your account. You can decline and type an area instead, and you can revoke access in your browser or device settings at any time.

AI concierge. When you use our concierge, we process the text you enter, recent conversation context and any location you choose to share to generate a response. The service is powered by an OpenAI model accessed through our technology provider, and grounded in LocalGem's own Athens guide. Your name, email and booking details are not sent with chat messages. Conversations are kept in your own browser — for the current session only if you are a guest, or on your device if you are signed in — and are not used by us to train AI models. Please do not include health information or other sensitive personal data in your chat.

Information received from other people

If another person includes you in a booking, we receive the participant details needed for that booking. Suppliers may send us confirmations, attendance or fulfilment information, changes and details needed to resolve an issue. Stripe sends payment, refund and dispute information. If you sign in with Google, Google supplies the information shown at sign-in.

If you book for someone else, provide only necessary information, make sure you are authorised to share it, and share this policy with them.

We rely on the following legal bases, according to the purpose of the processing.

Providing the services you request

We use account, contact, booking and transaction information to process and manage bookings and payments, communicate service updates, and handle changes or refunds. The legal basis is performance of a contract or pre-contractual steps under Article 6(1)(b) GDPR. Where a lead traveller supplies details of other participants, we rely on our legitimate interest in arranging their requested participation under Article 6(1)(f).

Operating and protecting LocalGem

We use necessary technical and account data to maintain the website, troubleshoot problems, prevent misuse and fraud, and protect customers and our business. We use relevant correspondence and transaction records to investigate complaints, handle payment disputes, and establish, exercise or defend legal claims. These are our legitimate interests under Article 6(1)(f). For general enquiries, our legitimate interest is responding to people who contact us.

Meeting legal obligations

We retain required accounting, tax and transaction records, respond to binding requests from competent authorities, and comply with applicable legal duties under Article 6(1)(c).

Optional uses based on consent

Access to your device location relies on your consent under Article 6(1)(a). You can withdraw consent at any time without affecting processing carried out before withdrawal. Answering your concierge questions is part of the service you request, under Article 6(1)(b).

Fields marked as required are needed to provide the requested service or meet legal requirements. Without them we may be unable to create your account, complete a booking or take payment.

A dietary, allergy or accessibility note can reveal health information. Please provide only what is necessary. Where you share such information to arrange an activity, we use it with your explicit consent under Article 9(2)(a) and pass it only to the operator of that activity. You may withdraw that consent by contacting us; this may limit our ability to arrange a particular accommodation but does not automatically cancel a booking.

Accounts and bookings are intended for adults aged 18 or over. An adult may book an activity for a child where the operator permits participation. We collect only the child's details needed for that booking, such as age category. We do not offer children independent accounts or send marketing to them.

We use Stripe to process payments through Stripe's secure hosted checkout. Your full card number and security code are entered directly with Stripe and are never stored in LocalGem's systems. We receive payment status, transaction identifiers and limited payment information such as card brand.

Stripe acts as our processor for certain payment services and as a controller for its own purposes, including fraud prevention and compliance. Stripe explains its processing at stripe.com/privacy. We use booking, communication and transaction evidence to administer refunds and respond to chargebacks, disclosing only what is relevant.

Activity and service operators: we provide the details needed to confirm and deliver your specific booking — such as participant names, contact details, date, party size, pickup details and agreed special requirements — to the operator of that experience or transfer. We do not send operators your profile or unrelated bookings.

Technical service providers: providers supporting website hosting, our database and sign-in, transactional email, maps and the AI concierge process the information necessary for their services, under appropriate processing terms.

Payment providers: Stripe and the financial institutions involved in the transaction.

Professional advisers and authorities: accountants, legal advisers, insurers where relevant to a claim, courts and competent public authorities, where necessary.

Business transfers: if a business sale or reorganisation occurs, relevant data may be disclosed subject to confidentiality and a lawful basis. We will provide any notice required.

We do not sell your personal data or share it with other businesses for their marketing.

We use only storage that is strictly necessary for the website to work — for example, keeping you signed in, remembering your concierge conversation and protecting checkout. We do not use advertising cookies or third-party analytics tracking, so no cookie banner is required.

Our interactive maps load map tiles from OpenStreetMap, which receives your IP address when tiles load. Links that open Google Maps, Stripe or social platforms take you to those providers, which process data under their own privacy terms. Website fonts are loaded from Google Fonts.

Some of our providers — including those for hosting, email, payments and the AI concierge — may process information outside the European Economic Area, including in the United States. Where there is no adequacy decision, such as the EU–US Data Privacy Framework for certified recipients, we rely on the European Commission's Standard Contractual Clauses together with additional measures where necessary.

You can contact us for information about the safeguards applying to your data.

We keep personal data only for as long as needed for the purpose for which it was collected, unless a legal requirement or a specific dispute justifies longer retention.

Booking, payment and invoice records are kept for the periods required by Greek tax and accounting law. Account information is kept while your account remains active and is deleted or anonymised after closure once outstanding bookings and legal requirements are settled. General enquiries are kept until resolved and for a reasonable follow-up period. Security logs are kept for a limited period.

Special requirements are removed once no longer needed to deliver the activity. Location is not stored. Concierge conversations stay in your browser and can be cleared at any time.

You can request access to your personal data and a copy, correction, erasure, restriction of processing, and portability of data you provided. You may withdraw consent at any time, and object to processing based on legitimate interests for reasons relating to your situation.

Contact hello@localgem.online to exercise your rights. We may ask for proportionate information to verify your identity. We normally respond free of charge within one month, extendable by up to two further months for complex requests, in which case we will tell you why.

You may complain to the Hellenic Data Protection Authority or to the supervisory authority in the country where you live or work. You do not have to contact us first.

LocalGem does not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Concierge suggestions do not approve or refuse a booking. Payment providers and banks may use automated fraud checks under their own notices; if a payment is blocked, contact us and we will help where we can.

We protect information with encrypted connections, access limited to people who need it, and access controls on our database. No system is completely secure; if a personal data breach occurs, we will notify the authority and affected people where the law requires.

We update this policy when our services or processing change, and provide additional notice of material changes where required.