We collect and process personal data from visitors, associates and staff during our business activity, in order to provide excellent services to our guests and to fulfil the obligations derived from our contracts and the law. The purpose is the process of the less possible personal data for the less possible time.

Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)

• Data Controller : The person (natural / legal) that determines the means and purpose of personal data processing.
• Data Processor : The person who processes data on behalf of a data controller. A data controller decides the manner and purpose to be followed in order to to process the data, while data processors hold and process data, without having any responsibility or control over that data.
• Data Protection Officer : The person that ensures, in an independent manner, that an organization applies the laws protecting individuals’ personal data.
• Data subject : A person whose personal data is being collected, held or processed.
• Processing Purposes : The process of a subject’s personal data in order to provide them with all the services and achieving the business purpose with security for their privacy.
• GDPR Consent : Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they signify agreement to the processing of personal data relating to them.

You can make a reservation by phone, by email, via our website or through our partner booking platforms (booking.com, Airbnb, Grecia Info). In any of these cases we collect the following data:

• Name and Surname
• Date of birth
• Arrival and departure date
• Type of accommodation
• Address, region and zip code
• Country
• E-mail address
• Credit card details
• Special requirements

Purpose : To identify our visitors, to prepare the appropriate preferences so that we are able to deliver the corresponding conveniences.

In order to collect the remuneration of the reservation, we need to collect credit or debit card details, according to the terms of the agreement in the event that our guest makes or cancels a reservation, or even does not check in. In order to inform you about booking changes or about our services, we need to use your email address. In order to provide you the comfort of our services and to justify the charge and the benefits requested, we maintain the data about your special preferences.

Legal basis : The booking agreement between us and the protection our legitimate interests, namely maintaining a high quality of service. In case of not providing all the above, we will either not be able to make your room reservation or we will not be able to provide you with the services you are requesting or we will not be able to contact you if there is an update or a problem.

We keep the registration for the name and the check – in date depending on the retention period about your stay and preferences for special services. In case you give your consent to process the address data for future communication, it is retained for as long as you have consented. You may withdraw your consent at any time, considering this will not affect the legitimacy of consent-based use before it is withdrawn.

The law requires the retention of data due to receipts and invoices issues, tax audits and municipal or police provisions, at least for 90 days. The data retention due to the legitimate interest of our business could be for 2 years.

(Articles 29, 30 2016/679)

To make a reservation, you may be asked to provide some bank, credit or debit card account details.

Purpose : To provide your reservation and charge the total amount, the advance payment or a part of it.

Legal basis: The execution of the contract concluded for your reservation. The provision of data is mandatory as well as the requirement to provide the service and the security of the payment.

Regarding your reservation, if you acknowledge your specific consent for your credit or debit card data to be retained for other transactions as well, the legal basis for our processing your data will be your consent for this processing.

You may withdraw your consent at any time, considering this will not affect the legitimacy of consent-based use before it is withdrawn. The processing period of your credit or debit card data are solely for transaction purposes and only to authorized persons. Upon your departure, these data are not disclosed, and access to these data is avoided.

Your credit or debit card data are deleted within 12 months of the transaction and if it is completed. In case of your consent, your data are retained for as long as your credit card is valid.

We keep a customer database. Each individual tab concerning a single customer. Personal data are recorded in this tab such as:

• Name, Surname
• Address, city, region and zip code
• Country
• ID or Passport Number
• Date of birth
• Phone, e mail

Purpose : The registration card serves to manage customers’ personal information, to prepare the appropriate space and preferences so that we are able to deliver the corresponding conveniences on time.

Legal basis :

• The law requires the retention of data due to receipts and invoices issues, tax audits and municipal or police provisions (at least 90 days).
• The legitimate interest of our hotel (2 years).
• Customer contracts for the provision of services to allow invoicing, bank payments and justification of charges in cases of dispute.

Customers’ data are entered on the tab in order to ease future bookings and services, without the need of data re-entrance. You may withdraw your consent at any time, considering this will not affect the legitimacy of consent-based use before it is withdrawn.

(Articles 29, 30 2016/679)