Privacy policy

Your privacy matters throughout your journey, from browsing our website to arranging your stay. This notice explains what we use, why we use it and the choices available to you.

Who is responsible for your information

For privacy questions or requests, use the email above with the subject “Personal data”. Please do not send an identity document with your first message. If verification is necessary, we will request only the additional information needed.

Reservations and enquiries

We use your name, email address, telephone number, dates, room category, guest count, amounts, payment status and booking reference to process your request. If you provide an optional WhatsApp/Viber number or notes, we use them for that enquiry. Do not include card numbers, passwords or sensitive personal information in the notes.

Processing necessary to respond to your request and provide accommodation is based on steps at your request before a contract and performance of that contract (GDPR Article 6(1)(b)). Statutory accounting and record-keeping are based on legal obligations (Article 6(1)(c)). Necessary security and abuse prevention rely on our legitimate interest in protecting the site and transactions (Article 6(1)(f)). Required fields are identified in the form; we cannot process an online reservation without them.

Acceptance of booking terms is recorded with the date, language and document version. Providing a privacy notice is separate from obtaining consent to marketing.

Payments and notifications

For bank transfers, we use the transaction information needed to match and verify your deposit. When card payments are enabled, you are redirected to Stripe Checkout. Full card details and security codes are not stored in the property’s booking form. Payment identifiers, amount, currency and status are returned to the reservation system. See Stripe’s privacy notice for the provider’s processing.

Reservation emails and operational notifications serve your transaction. If SMS notifications are enabled by the property, limited booking details are sent through the configured Twilio service to authorised property recipients. This does not subscribe you to a marketing list.

Newsletter and offers

Subscribing is optional and does not affect your booking or its price. We ask for a separate affirmative choice and send a confirmation email. News and offers start only after confirmation. This processing relies on your consent (GDPR Article 6(1)(a)). We record the email address, source of signup, consent wording and request and confirmation times.

Withdraw consent free of charge using the unsubscribe link in any newsletter or by contacting us. Withdrawal does not affect the lawfulness of earlier processing. Making a reservation or accepting booking terms does not subscribe you.

Cookies, maps, video and social networks

Embedded maps, external video/reels and the live Google rating have separate choices in Cookie settings. When enabled, providers may receive your IP address, browser information, referring URL and interaction data. Social media links lead to another service, whose own privacy terms also apply when you follow them.

Who receives information

Authorised property staff and, as necessary, hosting, maintenance and email providers, payment or notification services, accounting advisers and competent authorities may receive relevant information. We do not publish reservation details or sell the newsletter list. Social platforms and payment providers may also act as independent controllers for their own operations.

Some international providers may process information outside the European Economic Area. Transfers must rely on an appropriate GDPR mechanism, such as an adequacy decision or standard contractual clauses, where applicable. Contact us for details of the specific safeguards for services we use.

Retention

Reservation and accounting records are kept to provide your stay, meet legal accounting/tax duties and for the time necessary to establish, exercise or defend claims. Ordinary enquiries are retained to resolve the request and any related outstanding matter. Retention is reviewed according to its purpose, completion date and applicable legal periods; information is not kept indefinitely for future marketing.

Cookie choices remain on your device for 180 days. Newsletter confirmation links expire after 48 hours and unconfirmed requests are cleared after 30 days. Active subscriptions remain until you unsubscribe; limited consent and removal evidence may be retained for compliance and related claims. Backups follow the provider’s replacement cycle and are not used for new marketing campaigns.

Your rights

Subject to the GDPR, you can request access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. You may always object to direct marketing. We normally respond within one month; if a lawful extension is necessary because of complexity, we will tell you within the first month. Erasure does not remove statutory record-keeping obligations.

You can complain to the Hellenic Data Protection Authority or the competent authority where you habitually live or work. The system does not use automated profiling for decisions producing legal or similarly significant effects; price and availability calculations respond to your request.

Changes

Please review this page for changes to our services and policies. Material new purposes requiring consent are not activated merely by changing this text.

Last updated: 20 October 2026.