Last updated:
In short
- We collect only what we need to run a free directory that connects riders with mountain bike guides.
- We never sell your data and we do not show third-party advertising.
- Analytics cookies are used only if you accept them.
- Guides can download their data or delete their account at any time from their dashboard.
- You have strong rights under the EU General Data Protection Regulation (GDPR) and you can contact us about them at any time.
1. Who we are
Mountain Bike Guides (mtb-guides.com, “we”, “us”) is an online directory that helps mountain bikers find local, certified mountain bike guides. The website is run by a private individual based in Greece, who is the data controller responsible for your personal data under the GDPR and Greek data protection law (Law 4624/2019).
You can reach us about anything in this policy using the contact details in section 13.
2. What data we collect
When you visit the website
- Technical data: your IP address, browser type, device and the pages you request. Our web server, our security tools and our content delivery network process this automatically to deliver and protect the website.
- Usage data (only with your consent): which pages you view and how you use the site, collected through Google Analytics.
- Searches: the places and filters you search for. If you use the Near me button and allow your browser to share your location, we receive only a rounded position (about 1 km accuracy) to find guides near you. We do not store it.
When you contact a guide
The enquiry form asks for your name, email address, your preferred dates, group size and your message. We send this to the guide you chose and keep a copy (see section 6).
When you write a review
Your name, email address, rating, review text and IP address. Your name, rating and review are shown publicly; your email address is never published.
When you create a guide account
- Account data: your name and email address, and either a password (stored only in encrypted, hashed form) or, if you sign in with Google or Facebook, your name, email address and an account identifier received from that service.
- Listing data: your business name, description, contact details, location, photos, video and social media links. This information is published on your public listing, except your enquiry email address.
- Certification documents: if you upload proof of your guiding qualification, it is visible only to us and is used only to verify your listing.
- Claims: if you claim an existing listing, the message and any proof you send us.
When you use the contact form or email us
Your name, email address and the content of your message.
When you report a listing
Your name, email address, the listing you report, the reason you choose, your message and the date. To stop spam we also check your IP address and use Cloudflare Turnstile. Reports go to the MTB Guides team only: we do not share your name or email with the business you report, unless the law requires it.
3. Why we use it and our legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Running and securing the website, preventing spam and abuse | Technical data, IP address | Our legitimate interest in a safe and working service (Art. 6(1)(f)) |
| Passing your enquiry to a guide | Enquiry data | Taking steps at your request (Art. 6(1)(b)) |
| Publishing reviews | Review data | Our legitimate interest in helpful, trustworthy reviews (Art. 6(1)(f)) |
| Providing guide accounts and listings | Account and listing data, certification documents, claims | Our agreement with you, the Terms of Service (Art. 6(1)(b)) |
| Sign-in with Google or Facebook | Data received from that service | Your choice to use it and our agreement with you (Art. 6(1)(b)) |
| Analytics to improve the website | Usage data, cookies | Your consent, which you can withdraw at any time (Art. 6(1)(a)) |
| Answering your messages and requests | Contact data, message | Our legitimate interest in replying to you (Art. 6(1)(f)) |
| Keeping records we must keep by law | As required | Legal obligation (Art. 6(1)(c)) |
| Checking and acting on reports about listings | Report data | Our legitimate interest in keeping listings accurate, lawful and safe (Art. 6(1)(f)) |
We do not use your data for automated decision-making or profiling that has legal or similarly significant effects on you.
4. Who we share it with
We do not sell or rent your personal data. We share it only as described here:
- The guide you contact receives your enquiry so they can reply to you directly. Guides are independent businesses and handle your data under their own responsibility.
- Service providers who help us run the website, under contracts that require them to protect your data:
| Provider | What they do |
|---|---|
| Our hosting provider (European Union) | Hosts the website, its database and email sending |
| Cloudflare, Inc. | Content delivery and protection against attacks |
| Google Ireland Ltd / Google LLC | Google Analytics (only with your consent) and “Continue with Google” sign-in |
| Meta Platforms Ireland Ltd | “Continue with Facebook” sign-in, only if you use it |
| OpenStreetMap Foundation and OpenTopoMap | Map images and place look-ups for search (your browser loads map images directly from their servers) |
| Defiant Inc. (Wordfence) | Website security and blocking malicious traffic |
We may also disclose data if required by law, or to protect our rights, our users or the public, for example to investigate fraud or abuse.
5. Transfers outside the EU
Some providers above are based in, or may process data in, countries outside the European Economic Area, such as the United States or the United Kingdom. In those cases the transfer is protected by an adequacy decision of the European Commission (for example the EU–US Data Privacy Framework or the decision for the United Kingdom) or by the European Commission’s Standard Contractual Clauses.
6. How long we keep it
| Data | How long |
|---|---|
| Enquiries sent to guides | 12 months, then deleted automatically |
| Reports about listings | As long as we need to deal with the report, and no longer than 24 months after it is closed |
| Guide accounts and listings | Until you delete your account, or until we close an inactive or rule-breaking account |
| Certification documents and claim proofs | While the related listing exists, or until you ask us to delete them |
| Reviews | While the listing they belong to exists, or until you ask us to delete them |
| Analytics data | Up to 14 months |
| Security and server logs | A short period, normally no longer than 90 days |
| Emails and contact form messages | As long as needed to deal with your request, normally up to 2 years |
Backups of the website are kept for a limited time and are then overwritten, so deleted data may remain in a backup for a short period.
7. Cookies and similar technologies
Cookies are small files stored on your device. We use as few as possible:
| Type | What it is for | Needs your consent? |
|---|---|---|
| Essential | Keeping you logged in (WordPress login cookies), remembering your cookie choice, security checks | No, the website cannot work without them |
| Preferences | Remembering the map style you picked (stored in your browser, not sent to us) | No |
| Analytics | Google Analytics cookies (_ga, _ga_*), which last up to 2 years and help us understand how the site is used |
Yes, only set after you accept |
You can change your choice at any time through the cookie banner, or delete cookies in your browser settings. Signing in with Google or Facebook may also set cookies from those services under their own policies.
8. Your rights
Under the GDPR you have the following rights:
To use any of these rights, contact us (see section 13). We reply within one month. We may ask you to confirm your identity first, to protect your data.
In Greece, the supervisory authority is the Hellenic Data Protection Authority, Kifisias 1–3, 115 23 Athens, www.dpa.gr. You can also contact the authority in the EU country where you live or work.
9. Guide accounts: your data, your control
If you have a guide account, you can do the following yourself, at any time, from your dashboard (My listing):
- Edit your listings and contact details.
- Download my data: a file with everything we hold about your account, your listings, the enquiries you received, your claims and your reviews.
- Delete my account: after you confirm by email, we permanently delete your account and everything linked to it, including your listings, photos, documents and enquiries. This cannot be undone.
10. Security
We protect your data with encrypted connections (HTTPS), hashed passwords, restricted access to certification documents, regular updates and security monitoring. No method of transmission or storage is completely secure, but we work to protect your data and will inform you and the authorities of a data breach where the law requires it.
11. Age limits
You must be at least 18 years old to create a guide account. The website is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, please contact us and we will delete it.
12. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version. If the changes are significant, we will tell registered guides by email or on the website.
13. Contact us
For questions about this policy or your personal data, write to us:
