As a hotel guest or visitor of our website you are entitled to the protection of your Personal Data. The Hotel respects your privacy and personal data, and always complies with the Personal Data Protection Legislation. The Hotel also undertakes to act in a transparent manner, regarding the collection and use of data in the course of fulfilling its obligations.
The term “Personal Data Protection Legislation” (hereinafter “Legislation”) implies all Greek or European laws, regulations, directives, etc., regarding the processing of Personal Data, their privacy and security.
Basic, but not exclusive statutes are the General Data Protection Regulation (GDPR), the ePrivacy Directive for the protection of privacy in electronic communications, and any other Opinion or Guideline issued by the Hellenic Data Protection Authority (DPA).
It is important that you read carefully and keep this policy, which explicitly explains how and why we collect your Personal Data, what do we do with them, how long do we maintain them, with whom we are sharing them, how we protect them, and your rights regarding them. This way you will always be fully aware of the ways and reasons why we use your personal data and your rights in accordance with the Legislation.
The Hotel, in accordance with the General Data Protection Regulation, acts as “Data Controller”. This means that the Hotel is responsible for deciding on the ways and purposes for which it collects and uses (hereinafter “processes”) your personal data.
Our contact details are:
IOANNIS HATZILAZAROU S.A.
Mayia Exclusive Resort & Spa
Kiotari – Southern Rhodes, Rhodes 85109, Greece
Tel.: +30 22444 40100
Fax: +30 22440 40101
In the context of complying with the Data Protection Legislation, we make every possible effort to:
Legal Basis for Personal Data Processing
We process your Personal Data according to at least one of the legal bases specifically listed below:
Personal Data we Collect and Process
Personal Data include any information related to you as a recognizable individual. More specially, the Personal Data we collect, and process are described below:
When you use our website, we also automatically collect information, some of which may be personal data. These include details, such as language settings, IP address, location, device settings, device OS, time of use, redirection URL, etc. We may also collect data through cookies. Cookies are small files stored by a website on a visitor’s PC and to which the website has access to analyze user behavior. In detail, both the types of Cookies that exist and the type of processing that is carried out are described in the Cookies Policy.
We also use Google Analytics to analyze the use of our website. Google Analytics generates statistics and other site usage information that is used to create reports. More specifically, the types of processing that takes place through Google Analytics are described in the Cookies Policy.
In case of registration and/or access via third-party systems (Social Media Login), we may collect and access specific information about the user’s profile from the corresponding social network, only for internal administrative purposes and/or for the purposes mentioned above.
We do not process minors’ data without the consent of their parent or guardian.
Processing of Special Categories of Personal Data
The General Data Protection Regulation specifies special data categories that need to be processed according to stricter procedures, such as health-related data. The processing of such data is only possible when provided to us through a request on your part (e.g. stating your allergies) or if required by applicable laws or regulations.
Personal Data Sources and Collection Method
Usually you are the ones providing your own personal data, however this may also be carried out by other sources:
Personal Data Processing and Collection Purpose
We process and use your personal data for one or more of the following purposes:
Some of the above processing cases overlap to some extent and all constitute legal bases and legitimate purposes, within the framework of which we process your personal data.
Your personal data will be used solely for the purposes for which they have been collected or for other purposes compatible with the initial ones. If it is necessary to use your personal data for any other purpose, you will be informed accordingly and notified of the legal basis of the processing or even to request your consent.
In any case, your personal data processing takes place in accordance with the principles hereof and the rules of the Personal Data Protection Legislation.
Automated Decision-Making, including Profiling
We do not make any decisions that may significantly affect you, including profiling, in an automated way (decision-making solely with the use of a computerized system).
When and How do we Share or Disclose any Personal Data Collected in Other Ways
The transmission of data shall take place by ensuring (whenever feasible) that these third parties are processing your data with absolute confidentiality, taking all appropriate security measures for their protection, according to our policies, and do not use your personal data for their own purposes or any other purpose except those agreed upon.
Specific data may be forwarded to your relatives upon your prior consent or in case of emergency.
In addition to the above, the Hotel shall not transfer your personal data to any third party, unless it is legally obliged to do so or when it has to comply with its contractual and legal duties (tax authorities or the police, performing our audit duties).
The Hotel will not sell your personal data to third parties under any circumstances and will not allow any third parties to sell the data the Hotel has forwarded them.
We cooperate with third parties to offer you online reservation services, such as booking.com or Web Hotelier and Channel Managers. Although we provide the content to these websites and you make a reservation directly with us, reservation processing is made by third parties. The data you provide these third parties with are stored in one or more databases hosted by them. These third-party companies do not use or access your personal information for purposes other than managing reservations.
Personal Data Disclosure
We will use and disclose personal data, if we believe it is necessary or appropriate:
International Transmission of Personal Data to Third Countries
Sometimes your personal data may be transmitted to third countries outside the EU for the purposes described in this policy. The transmission of personal data to a third country or international organization may take place if the European Commission has determined that these third countries have an adequate level of protection or appropriate safeguards and guarantees (e.g. standard contractual clauses approved by the European Commission) and provided that there are enforceable rights and effective remedies for you.
For How Long Do We Maintain Your Data
The criteria used to determine our booking periods include:
If data collection was based on your consent, these data may be deleted at any time after your consent is revoked.
Your data may also be deleted in one of the following cases:
Data will be destroyed in a secure way when no longer necessary. It may be necessary for the company to retain some financial data for legitimate purposes (e.g. accounting matters).
Your Rights Regarding your Personal Data Protection
Under certain conditions set forth in the Personal Data Protection Legislation, you have the following rights regarding your personal data:
Moreover, in case we process your personal data based on a legitimate interest or for public interest purposes, you have the right to express your disagreement at any time regarding your personal data use, in accordance with applicable law.
If you have given your consent to the use of some of your data, you also have the unlimited right to revoke it at any time. Revoking your consent means that we will stop processing the data you previously allowed us to process. The Hotel reserves the right to determine what information should continue to maintain, in order to fulfill its tax and legal obligations in general. There will be no consequences for the revocation of your consent, beyond the Hotel’s inability to perform this processing.
You may exercise your rights by contacting the Hotel either by sending an email at email@example.com or by using the Data Subject Request Form. If you exercise any of your rights via a written request, we will make every possible effort to process your claim within thirty (30) days of receipt and we will inform you either of your satisfaction or of the reasons that prevent its implementation. If you do not receive a response within 30 days or are not satisfied with our response, you have the right to complain to the Data Protection Authority.
You have the right to submit a complaint to the Data Protection Authority, which enforces data protection laws, if you have concerns about how the Hotel is processing your personal data or if you are dissatisfied with our response to your complaint or request.
Data Protection Authority
1-3, Kifisias Avenue, Zip Code 115 23, Athens
Tel.: +30-210 6475600
Fax: +30-210 6475628
The Protection of your Personal Data
Data are stored in a range of different resources, including physical files, the website, the Hotel’s Property Management System, and other IT systems (including email). Data are stored as a whole, and in the format they were submitted, without compromising their content.
We have established a series of technical and organizational security measures to prevent the unauthorized or illegal use or access of/to your personal information, accidental loss or damage to their integrity, their alteration or disclosure. Moreover, access to your personal data is limited to those who need to know on a professional level. They will only process your personal data in accordance with our instructions and are subject to a confidentiality obligation. Your Personal Data will be processed by a Third Processor only if he agrees to comply with the specific technical and organizational data security measures.
In case of a breach of data security, we will notify you and the relevant regulatory bodies we are legally obliged to.
Questions, Concerns or Complaints
Links To Other Websites and Social Media
Third-party Businesses that Operate Within the Hotel Premises.
More specifically, the third-party businesses operating within the premises of the Hotel are the following:
Amendments To This Policy
Updates will be posted on the Hotel’s website at the following address and will be marked with a publication date, so you always know when the policy was last updated.