This policy explains what personal data we collect when you book a stay or visit this website, why we collect it, and what we do with it. We are required to provide this information under the EU General Data Protection Regulation (GDPR) and Greek Law 4624/2019.
Who we are
The data controller for this website is Pleiades Apartments, operating short-term rentals in Chania, Crete, Greece. Short-Term Rental Registration Number: 1302398.
Contact us at: pleiadesapts@gmail.com
What data we collect and why
When you make a booking, we collect:
- Name and contact details (email, phone number) — to confirm your reservation and communicate about your stay
- Identity document information (ID or passport details, nationality) — required by Greek law (Law 4276/2014 and AADE short-term rental regulations) for tax reporting
- Payment information — card payments are processed entirely by Stripe; we never store card numbers on our servers
- Booking details (dates, apartment, number of guests) — to fulfil your reservation
When you visit this website, standard server logs may record your IP address, browser type, and pages visited. This is used solely for security and performance monitoring and is not linked to individual guest records.
Legal basis for processing
- Contractual necessity — name, email, phone, and booking details are needed to fulfil your reservation (GDPR Art. 6(1)(b))
- Legal obligation — identity document data is required by Greek short-term rental law (GDPR Art. 6(1)(c))
- Legitimate interests — security logging and fraud prevention (GDPR Art. 6(1)(f))
How long we keep your data
- Booking records and identity information: 5 years, as required by Greek tax law
- Payment records: retained by Stripe per its own legal retention obligations
- Server logs: 90 days, then automatically deleted
Third-party processors
We share limited data with the following parties, solely to operate our booking system:
- Stripe, Inc. — payment processing (Stripe Privacy Policy)
- Hostinger International Ltd. — website hosting; data stored on EU-based servers
We do not sell, rent, or share your personal data with any third parties for marketing purposes.
Cookies
This website uses only cookies that are strictly necessary for the booking system to function (session management, security tokens). We do not use tracking, analytics, or advertising cookies.
Your rights
Under GDPR you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data where we are not legally required to retain it
- Restriction — ask us to limit processing in certain circumstances
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interests
To exercise any of these rights, email pleiadesapts@gmail.com. We will respond within 30 days.
If you are unsatisfied with how we handle your data, you may lodge a complaint with the Hellenic Data Protection Authority (HDPA): www.dpa.gr
Changes to this policy
If we make material changes, we will update the date shown at the top of this page. We recommend reviewing it periodically.