Privacy

When you send a booking request we receive what you typed into the form:

• Your name and email address, which we need to reply
• Your phone or WhatsApp number, only if you choose to give it
• Your message, if you write one
• The dates and number of guests you selected

When a request is submitted, the server briefly holds the IP address it came from. This is used for one purpose: to stop an automated script from flooding the form. It is kept for one hour and never linked to your enquiry.

Simply reading the site records nothing about you.

Your enquiry is used to answer you and to agree the details of a stay. The legal basis is Article 6(1)(b) of the GDPR — steps taken at your request before entering into a contract.

The short-lived IP record rests on Article 6(1)(f), our legitimate interest in keeping the form usable. We never use your data for advertising, profiling or automated decisions, and we never sell it.

Two service providers are involved in delivering your enquiry, and nobody else:

• Resend, which sends the email to our inbox, processing it within the EU
• Netlify, which hosts the site and serves the pages

An enquiry that does not lead to a stay is deleted from our inbox within twelve months. Where a booking goes ahead, we keep the records for as long as Greek tax law requires us to.

You can ask us to delete your enquiry sooner, and we will, unless we are legally required to keep it.

Under the GDPR you may ask us to do any of the following, free of charge:

• Tell you what data we hold about you, and give you a copy
• Correct anything that is wrong
• Delete your data
• Restrict how we use it, or object to our use of it
• Send your data to you or to someone else in a portable form

Write to the email address above and we will respond within one month. There is no form to fill in and no charge.

If you are not satisfied with our answer, you may complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifissias 1-3, 115 23 Athens, www.dpa.gr — or to the supervisory authority in your own country.

This site sets no cookies at all. There is no analytics, no tracking pixel, no advertising network and no social media widget. Nothing is written to your browser's storage.

The typefaces are served from this site's own server rather than from a font provider, so loading a page tells no third party that you visited.

The location map comes from OpenStreetMap. It does not load until you click it, because loading it would send your IP address to OpenStreetMap's servers. If you never click, no request is made and they learn nothing about you.

There is a link to plan a route, which opens Google Maps in a new tab. Following it is your choice, and from that point Google's own privacy policy applies.

The site is served over an encrypted connection. It has no payment function: no card number, bank detail or password is ever requested or handled here. Payment for a confirmed stay is arranged separately with us.

If this notice changes, the revision date above changes with it.