Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. What data we collect

We collect personal data only when you interact with us directly:

• Booking enquiries — name, email address, phone number, arrival and departure dates, and party size when you send us a message or enquire about availability.
• Contact form submissions — any information you choose to share in a message sent via our website or email.
• Booking.com reservations — when you book through Booking.com, they share your name, email, phone number, and booking details with us as necessary to fulfil your reservation.

We do not use tracking cookies, analytics services, or advertising networks on this website.

3. How we use your data

We process your personal data on the following legal bases under GDPR Article 6:

• Performance of a contract (Art. 6(1)(b)) — to handle your booking, answer questions about your stay, and provide the accommodation you reserved.
• Legitimate interest (Art. 6(1)(f)) — to respond to general enquiries and maintain records of guest communications for the purpose of managing our business.
• Legal obligation (Art. 6(1)(c)) — to comply with Greek tax and accommodation registration requirements.

4. Retention periods

• Booking and contact data — retained for 3 years after your last contact with us, then securely deleted.
• Financial and tax records — retained for 10 years as required by Greek tax law.

5. Third-party processors

We share data with the following third parties only to the extent necessary:

• Booking.com B.V. (Amsterdam, Netherlands) — acts as an independent data controller for reservations made through their platform. Their privacy policy governs data collected during the booking process.
• Google LLC — we use Gmail (Google Workspace) to send and receive email. Messages you send us are processed on Google's servers. Google's privacy policy applies to this processing.

We do not sell, rent, or otherwise share your personal data with any other third parties.

6. Your rights under GDPR

As a data subject you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your data where there is no overriding legal basis for us to keep it.
• Restriction — ask us to limit how we use your data while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.

To exercise any of these rights, contact us at levanda.rooms@gmail.com. We will respond within 30 days.

7. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the supervisory authority in Greece: