1. Introduction & Data Controller
Welcome to Nefeli Hotel. We are committed to protecting your privacy and ensuring the highest standards of security for your personal data in full compliance with the European Union General Data Protection Regulation (EU GDPR 2016/679) and applicable Greek data protection legislation (Law 4624/2019).
The Data Controller responsible for the processing of your personal data is:
- Hotel Name: Nefeli Hotel (4-Star Accommodation)
- Address: 161 Mahis Kritis str., Rethymnon, 74100 Crete, Greece
- Telephone: +30 28310 55321
- Email: info@nefeli-hotel.gr
2. Personal Data We Collect
We collect only the personal information strictly necessary to provide you with seamless hospitality services, process your reservations, and meet our statutory obligations under Greek law:
- Reservation & Accommodation Details: Full name, nationality, contact phone number, email address, arrival and departure dates, number of guests, room preferences, and special stay requirements.
- Check-in & Identification Data: Government-issued ID or passport details, home address, and date of birth, as strictly required by Greek Tourism Ministry (EOT) regulations and police registration rules.
- Payment & Billing Data: Payment card details (processed securely through certified PCI-DSS compliant payment gateways), billing address, and tax invoice information.
- Direct Communications: Any inquiries, special requests, dietary preferences, or feedback submitted via our website forms, email, or telephone.
- Technical & Device Data: IP address, browser type, operating system, and anonymized interaction data collected during your website visit.
3. Purpose & Legal Basis for Processing
We process your personal information under the following legal bases:
- Performance of a Contract (GDPR Art. 6(1)(b)): To manage your room reservations, deliver accommodation, dining, and wellness services, and communicate pre-arrival instructions.
- Legal Compliance (GDPR Art. 6(1)(c)): To comply with Greek tax laws, invoice retention mandates, and official guest registry requirements.
- Legitimate Interests (GDPR Art. 6(1)(f)): To maintain safety on our premises, improve website functionality, and prevent fraudulent transactions.
- Consent (GDPR Art. 6(1)(a)): For optional promotional communications, newsletter subscriptions, or non-essential cookies, which you can withdraw at any time.
4. Cookie & Tracking Policy
Cookies are small data files placed on your browser when visiting our website. We use cookies to enhance navigation, remember your preferences, and ensure optimal performance.
Categories of Cookies We Use:
- Strictly Necessary Cookies: Essential for core website navigation, security, and reservation booking functionality. These cannot be disabled in our systems.
- Preference & Functional Cookies: Enable the site to remember your language selection (English / Greek) and cookie consent status.
- Performance & Analytical Cookies: Help us measure aggregate website traffic and visitor interactions anonymously so we can optimize our digital experience. These are activated only with your explicit consent.
You may adjust or revoke your cookie choices at any time through our interactive cookie banner or by clearing cookies in your browser settings.
5. Security & CCTV in Common Areas
To protect the safety of our guests, staff, and property, closed-circuit television (CCTV) operates in designated outdoor common areas and entrance perimeters in strict accordance with the Hellenic Data Protection Authority (HDPA) guidelines.
Please note: CCTV cameras are strictly confined to public exterior areas. No cameras are installed or operated in private guest rooms, corridors, balconies, or intimate relaxation areas.
6. Data Sharing & Third-Party Disclosure
We do not sell, rent, or lease your personal information. Your data is shared only with trusted third-party partners who are contractually bound by confidentiality and data processing agreements:
- Certified hotel booking engines, channel managers, and property management systems.
- Accredited banking institutions and PCI-compliant payment service providers.
- Professional IT, email delivery, and cloud hosting infrastructure providers within the European Union.
- Competent Greek public authorities, tax offices, or law enforcement bodies when mandated by law.
7. Data Retention
Personal data is retained only for the duration necessary to fulfill the purposes for which it was collected:
- Accounting, financial transactions, and billing records are stored for 10 years as mandated by Greek fiscal legislation.
- General contact inquiries are retained for up to 12 months after resolution.
- CCTV footage is automatically overwritten within 15 days, unless required for ongoing official investigations.
8. Your Rights Under GDPR
As a data subject, you hold the following rights under European data protection laws:
- Right of Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of any inaccurate or incomplete records.
- Right to Erasure: Request the deletion of your personal data when it is no longer required for legal or contractual purposes.
- Right to Restriction: Request limitation of processing under specific circumstances.
- Right to Data Portability: Receive your personal data in a structured, commonly used format.
- Right to Object: Object to processing based on legitimate interests or direct marketing.
- Right to Withdraw Consent: Revoke previously granted consent at any time without affecting prior lawful processing.
9. Exercising Your Rights & Supervisory Authority
To exercise any of your rights or if you have questions regarding this Privacy & Cookie Policy, please contact our management team directly:
- Email: info@nefeli-hotel.gr
- Postal Address: Nefeli Hotel, 161 Mahis Kritis str., Rethymnon 74100, Crete, Greece
- Contact Page: Visit our Contact Page
You also have the right to lodge a complaint with the national supervisory authority:
Hellenic Data Protection Authority (HDPA)
Website: www.dpa.gr | Kifissias 1-3, 115 23 Athens, Greece