1. Who We Are
| Data Controller | SPYROS MORAITIS AXTEE — trading as ‘Contessina Hotel’ |
| Registered office | Planos, 29100 Zakynthos, Greece |
| Tax ID (AFM) / GEMI No. | 094376304 · 122759724000 |
| Telephone | 2695 022508 |
| Contact e-mail | manager@contessinasuitesnspa.com |
| Website | https://contessinacollection.com |
| DPO | Not appointed — the conditions of Art. 37(1) GDPR are not met. |
2. What Data We Collect & Why
| Activity | Data | Legal Basis | Retention |
| Technical operation of the website | IP address, browser type, time of request, pages requested, response code | Art. 6(1)(f) — legitimate interest (security & proper operation) | Up to 12 months in the log files |
| Contact form / information request | Full name, e-mail, telephone, message content | Art. 6(1)(b) — pre-contractual measures at your request | 12 months from the last communication |
| Online booking | Full name, contact details, dates, payment details | Art. 6(1)(b) — performance of a contract | 5 years (tax obligation) |
| Newsletter | E-mail, full name | Art. 6(1)(a) — EXPLICIT CONSENT (opt-in) | Until withdrawal |
| Statistics / marketing cookies | Device identifiers, browsing behaviour | Art. 6(1)(a) — CONSENT via the banner | See Cookies Policy |
3. Cookies
| Category | Purpose | Consent |
| Strictly necessary | Operation of the website, security, session maintenance, booking basket. | NOT required — without these the website does not work. |
| Functional | Remembering preferences (language, currency). | REQUIRED |
| Statistics / Analytics | Traffic measurement, analysis of user behaviour. | REQUIRED |
| Marketing / Targeting | Personalised advertising, retargeting. | REQUIRED |
You may withdraw or modify your consent AT ANY TIME, as easily as you gave it, via the relevant link that is permanently available on the website.
Legal basis: Article 4(5) of Law 3471/2006 (cookies — consent after being informed is required) · Article 7 GDPR · Recital 32 GDPR (silence and pre-ticked boxes do not constitute consent) · HDPA Directive 2/2020 on cookies and other trackers.
4. Who Receives Your Data
| Website hosting provider | Processor — bound by an Art. 28 GDPR contract. |
| Reservation system / PMS | Processor — bound by an Art. 28 GDPR contract. |
| Payment services provider | For the execution of the transaction. The hotel does NOT store card numbers. |
| Accountant, tax authorities | As required by law. |
| Booking platforms (OTAs) | If you booked through them — they act as independent data controllers. |
| WHAT WE DO NOT DO
We do not sell or rent your data. We do not transfer them outside the EU/EEA, unless the provider is located in a country covered by an adequacy decision or the Commission’s Standard Contractual Clauses apply (Art. 46 GDPR). We do not take decisions concerning you based solely on automated processing. |
5. Your Rights
| Right | What it means |
| Access (Art. 15) | To learn which of your data we process and to receive a copy. |
| Rectification (Art. 16) | To have inaccurate data corrected or incomplete data completed. |
| Erasure (Art. 17) | To have data erased, where there is no lawful ground for retention. |
| Restriction (Art. 18) | To have processing ‘frozen’. |
| Portability (Art. 20) | To receive your data in a structured, machine-readable format. |
| Objection (Art. 21) | To object to processing based on our legitimate interest. |
| Withdrawal (Art. 7(3)) | To withdraw your consent, as easily as you gave it. Withdrawal does not affect the lawfulness of prior processing. |
Exercise: via the ‘Data Subject Rights Request’ form or by a simple message to [E-MAIL]. FREE OF CHARGE. Response within one (1) month.
| RIGHT TO LODGE A COMPLAINT
If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the Hellenic Data Protection Authority: 1-3 Kifisias Ave., 115 23 Athens · tel. 210 6475600 · www.dpa.gr. You also have the right to a judicial remedy. |
6. Security & Minors
- The website operates exclusively over an encrypted connection (SSL/TLS) on all pages.
- The website is not directed at minors under 15 years of age and we do not knowingly collect their data.
- Photographs depicting guests are published only with their consent.
7. Changes
This Policy is reviewed at least annually. Any material change is posted on the website with a new version date.
Legal basis: Articles 12, 13, 14 GDPR (transparency & information) · Articles 15-22 GDPR (rights) · Article 7 GDPR (consent) · Article 32 GDPR (security) · Article 46 GDPR (transfers) · Law 3471/2006 (electronic communications & cookies) · Law 4624/2019 · HDPA Directive 2/2020.