Privacy policy

Last updated: 28 September 2026

This site collects as little as it can. There is no analytics, no advertising and no tracking of any kind. What follows is the full account of what does happen.

Who is responsible

The controller of any personal data collected through this website is Konstantinos Fessaras, trading as Mastichari Massage, Mastichari, Kos, Greece.

You can reach me at kosfess@hotmail.com or on +30 6977784790 for anything in this policy, including a request to delete your data.

What I receive when you get in touch

There is no booking form on this site: bookings are arranged by WhatsApp, phone or email. When you contact me, I receive what you send: usually your name, your phone number or email address, which massage you are interested in, when you would like it, and anything else you choose to write.

This is used for one thing only: to answer you and arrange the appointment. It is not used for marketing, is not shared with anyone, and is not sold.

Health information

Before a massage I need to know about pain, injuries, recent surgery or pregnancy, so I will ask you about them. Under the GDPR that is health data, which gets stronger protection.

Please tell me only as much as I need in order to work safely, not your medical history. I process it on the basis of your explicit consent, given by choosing to tell me, and only in order to give the massage safely. It is deleted with the rest of our conversation.

Legal basis

Answering your message and arranging the appointment: steps taken at your request before entering into a contract, GDPR Article 6(1)(b).

Any health details you choose to give: your explicit consent, Article 9(2)(a).

Keeping this website secure and protecting it from automated abuse: legitimate interests, Article 6(1)(f).

Where it goes and how long it is kept

This website does not collect or store anything you send me. Your messages stay where you sent them: in WhatsApp, on my phone or in my mailbox.

I delete booking conversations once the season they relate to is over, and at the latest twelve months after your last message to me. If you ask me to delete yours sooner, I will do it and confirm.

Who else is involved

The website is hosted by Railway, in a European region. WhatsApp messages are handled by WhatsApp (Meta), and my mailbox is a Microsoft Outlook/Hotmail account, so Microsoft processes email as my provider. Both may involve transfer outside the EEA under their own safeguards.

None of these companies is given your data for their own purposes. There are no advertising, analytics or profiling services on this site at all.

Server logs and abuse protection

The server records the pages that are requested. To stop the site being flooded by automated requests, repeated requests for pages that do not exist are counted against a one-way salted hash of the IP address, which is kept in memory for one minute only.

The plain IP address is not written to the logs, the hash cannot be reversed back into an address, and these records are deleted after 30 days.

Cookies

This site sets no analytics or advertising cookies, and there is nothing here from any advertising network.

One cookie is strictly necessary: once you answer the cookie notice, it remembers whether you chose "Accept all" or "Necessary only". A second cookie, which remembers the language you chose so you are not sent back to English on the next visit, is set only if you accept it. You are asked on your first visit and can change your answer at any time from "Cookie settings" in the footer. The full list, with how long each one lasts, is in the cookie policy.

You can also delete any of them in your browser at any time. The site will keep working - it will simply forget your language and ask again.

The home and Location pages also embed a live Google Map so you can see exactly where the studio is. That map is loaded directly from Google, not from this site, so once that part of the page loads, Google may set its own cookies and see your IP address under its own privacy policy - this site does not control that. If you would rather not load it, the "View on Google Maps" and "Get directions" links open Google Maps in a new tab instead, and load nothing unless you click them.

Links to other services

The WhatsApp and phone buttons hand you over to the app on your device. If you use the WhatsApp button, your message and number are then handled by WhatsApp under Meta's own privacy policy, not this one.

The same applies to the links to Facebook and X in the footer. Nothing on this site loads content from them in the background - the links do nothing until you click them.

Photographs on this site

The portrait of Konstantinos and the scanned certificates are genuine photographs and documents.

No photograph of a client appears anywhere on this site.

Your rights

Under the GDPR you can ask me for a copy of the data I hold about you, ask me to correct it, ask me to delete it, ask me to restrict or stop using it, object to my using it, and ask for it in a portable form. You can withdraw your consent at any time - that does not affect anything done before you withdrew it.

Email kosfess@hotmail.com and I will deal with it within one month. There is no charge.

If you are not satisfied with how I have handled it, you can complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifissias 1-3, 115 23 Athens, www.dpa.gr, or to the supervisory authority in your own country.

Children

This site is not aimed at children, and bookings should be made by an adult. Massage for a minor is arranged with a parent or guardian, who must be present.

Automated decisions

There are none. No profiling, no automated decision-making. Every booking request is read by me personally.

Changes

If this policy changes, the date at the top changes with it. The version in force when you contacted me is the one that applies to that booking.