Your privacy.

On this page

• 1. Who is responsible for your data
• 2. What we collect, why, and on what basis
• 3. Cookies and similar technologies
• 4. Who we share data with
• 5. Transfers outside Europe
• 6. How long we keep data
• 7. Your rights
• 8. Other things you should know

1. Who is responsible for your data

This policy explains how we collect and use personal data when you visit this website, contact us, book, or stay with us. The business below is the data controller, under the EU General Data Protection Regulation (GDPR) and Greek data protection law (Law 4624/2019).

We have not appointed a data protection officer, as the law does not require one for a business of our size. For anything about your data, email us at the address above.

2. What we collect, why, and on what basis

Booking on this website

What: your name, email address and mobile number; the accommodation, dates and number of guests; any discount code, special requests and messages; the price, payment plan, payments and refunds; and a record of the terms and card authorisation you accepted, with the date and time.

Why and basis: to make and manage your booking, take payments, send booking emails and look after your stay; this is needed for our contract with you (GDPR Art. 6(1)(b)). We keep booking and payment records because Greek tax and accounting law requires it (Art. 6(1)(c)).

Payments

Card details are entered directly into Stripe’s secure payment form and never reach our website. We receive only a reference to the saved card and the result of each charge. Stripe also uses payment data to prevent fraud, as its own controller (see Stripe’s privacy policy). Basis: our contract with you (Art. 6(1)(b)) and our legitimate interest in preventing fraud (Art. 6(1)(f)).

Online check-in and arrival

Before arrival we ask the lead guest to complete online check-in in Hostex, our booking management system: the names of the guests, identity document details where the law requires us to register guests, and your arrival time. Identity documents and the guest details submitted during online check-in are held in Hostex. The website’s check-in sync stores the check-in link, arrival time, completion status and document count, not identity-document images or numbers. We use them to register your stay where the law requires it (Art. 6(1)(c)) and to prepare your arrival and keep the accommodation secure (Art. 6(1)(b) and (f)).

Bookings through other platforms

If you book through Airbnb, Booking.com or another platform, we receive your booking details from that platform through Hostex: your name, the dates, the number of guests, the price and a way to contact you. The platform’s own privacy policy covers what it collects. Basis: our contract with you (Art. 6(1)(b)).

Enquiries and messages

When you use our enquiry form, email us, call us or message us on WhatsApp, we receive your name, contact details, the stay and dates you ask about, and your message. We use them to answer you and, if you book, to prepare your stay. Basis: steps you ask for before a contract (Art. 6(1)(b)) and our legitimate interest in answering questions (Art. 6(1)(f)). WhatsApp is a service of Meta, which handles messages under its own terms.

Emails we send

We send emails about your booking: confirmation, payment notices, arrival information and, after your stay, sometimes a request to review us. These are part of the service, not marketing (Art. 6(1)(b) and (f)). If you would rather not receive the review request, just tell us. We do not send newsletters or offers, and we never sell or rent your data.

Visiting this website

Our hosting provider records technical data for every visit (IP address, browser, pages requested and time) to keep the website running and secure. To stop abuse of our forms and booking system, we also keep a scrambled form of your IP address for up to an hour. Basis: our legitimate interest in a secure website (Art. 6(1)(f)). Analytics and advertising only run if you accept them: see section 3.

Reviews

We show a selection of reviews that guests published on Google, with the public display name shown there, which may include a surname. Basis: our legitimate interest in showing what guests think of us (Art. 6(1)(f)). If you wrote one of them and want it removed from our website, email us.

3. Cookies and similar technologies

Cookies and similar technologies (such as your browser’s local storage) store small pieces of information on your device. We use only what is necessary unless you agree to more. Your choice is asked for in the banner when you first visit; change it at any time with “Cookie settings” at the bottom of every page.

Necessary, always on. They make booking and payment work and remember your cookie choice; the law does not require consent for them.

• viva_consent: your cookie choice; 6 months.
• Booking in progress (viva_selection, viva_guest, viva_checkout_ref, viva_link): your selected dates and the secure link to your booking, kept in your browser until you close the tab.
• viva_purchase_…: stops one booking being counted twice; kept in your browser.
• Stripe (__stripe_mid, __stripe_sid) on the checkout and booking pages, to prevent payment fraud; up to 1 year and 30 minutes.

Analytics, only with your consent. They show us how visitors use the website, so we can improve it.

• Google Analytics (Google): pages visited, searches and booking steps, device and approximate location; cookies _ga and _ga_…, up to 2 years.
• Microsoft Clarity (Microsoft): clicks, scrolling and anonymised recordings of visits, with text you type hidden; cookies _clck (1 year) and _clsk (1 day).

Marketing and content from other sites, only with your consent. They measure our ads and show you relevant ads on other sites, and they show maps, videos and widgets from other companies.

• Google Ads (Google) and Meta Pixel (Meta): which ad brought you here and whether you searched, started a booking or booked, with the value and a booking reference; cookies such as _gcl_au and _fbp, up to 90 days. We never send them your name, email or phone number.
• Google Maps, YouTube and Travelpayouts (car rental search): these load only when you tap “Show…” or have accepted marketing. Once loaded, the provider receives your IP address and may set its own cookies.

We use Google Tag Manager to load these tools and Google Consent Mode to tell them your choice. Until you accept, no analytics or marketing tool is loaded.

4. Who we share data with

We share personal data only when needed for the purposes above, with:

• Service providers working for us, under contracts that require them to protect it: Hostinger (website hosting), our email provider, Hostex (booking management, calendars, online check-in and guest messages), and Stripe (payments).
• Analytics and advertising companies, only with your consent: Google, Meta and Microsoft.
• Booking platforms such as Airbnb and Booking.com, for bookings made through them.
• Our accountant and the Greek tax authority (AADE), for receipts, invoices and tax returns.
• Our cleaning and maintenance staff, who receive only what they need, such as arrival and departure dates.
• Public authorities such as the police or tax authorities, when the law requires it, and professional advisers or courts if needed to establish or defend a legal claim.

5. Transfers outside Europe

Some providers (Google, Meta, Microsoft, Stripe and Hostex) may process data outside the European Economic Area, for example in the United States. Where they do, the transfer is protected by an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or by the European Commission’s Standard Contractual Clauses. You can ask us for details.

6. How long we keep data

The website’s booking system automatically anonymises guest contact details, saved-card references and stored check-in information 2 years after each stay, and enquiry details after the same period from the enquiry. Active stays and bookings requiring attention are retained until resolved. This process does not automatically erase copies in Hostex, Stripe, email accounts or backups; their retention and any erasure requests are handled separately, subject to applicable legal obligations. Booking references, dates and amounts, and accounting records that must identify the customer, are retained for the legally required period.

Cookies are kept for the periods in section 3. Technical logs are kept by our hosting provider for a short period for security. If there is a dispute or claim, we keep what we need until it is settled.

7. Your rights

You have the right to:

• ask for a copy of your personal data (access), and receive the data you gave us in a machine-readable format (portability);
• have incorrect data corrected, and have your data erased when we no longer need it or have no legal basis for it;
• ask us to restrict how we use your data, and object to uses based on our legitimate interests;
• withdraw your consent at any time, for example with “Cookie settings”, without affecting what happened before.

To use these rights, email us. We reply within one month. To protect you, we may ask you to write from the email address you booked with, or to confirm your booking reference. Some data we must keep by law (see section 6) cannot be erased before that period ends.

You can also complain to the Hellenic Data Protection Authority (Kifisias 1–3, 115 23 Athens, dpa.gr) or to the data protection authority of the EU country where you live. We would appreciate the chance to sort out any concern first.

8. Other things you should know

• Do you have to give us your data? To book, we need your name, email address and phone number, and for check-in the details the law requires; without them we cannot confirm your stay. Everything else, including cookies beyond the necessary ones, is your choice.
• Automated decisions. We do not make decisions about you by automated means alone. Stripe may automatically decline a payment it judges likely to be fraudulent; contact us if that happens to you.
• Children. Bookings must be made by an adult. We receive children’s details only from the lead guest, when the law requires us to register every guest.
• Security. The website uses an encrypted connection, card details never reach our servers, the link to your booking contains a secret code that is kept out of analytics and advertising tools, and only we can see guest details.
• Changes. We may update this policy when our services or the law change. The date at the top shows when it last changed.