Privacy and Personal Data Protection Policy
This policy covers the processing of personal data by ENALIA Katrin Serenity Hotel, Eurohotel A.E., in connection with enquiries, reservations, guest services and the Company’s wider activities. Guest and reservation data may be collected through the reservation programmes and systems operated by the Company, separately from this website. The Cookie Policy concerns browsing and storage technologies on this website.
1. Who is responsible for your data, and whom should you contact to exercise your rights?
1.1. The controller of your personal data is “ENALIA Katrin Serenity Hotel, Eurohotel A.E.”, based in Stalis, Heraklion, Crete, postcode 70007, lawfully represented, telephone +30 28970 32137 and contact email dpo@eurohotel-crete.gr (“the Company”).
1.2. The Company, as controller, has appointed a Data Protection Officer whose contact email is dpo@eurohotel-crete.gr. You may send all requests to exercise the rights described below in sections 3.1–3.7 to the Data Protection Officer at that address.
2. General principles followed by the Company regarding transparent information
2.1. All information provided in this document, and any information you may request in the future, is provided free of charge, provided that the request is not repetitive, excessive or manifestly unfounded (see section 2.3).
2.2. For each right you exercise, the Company will respond within one (1) month of receiving the request. Where there are objective difficulties, the request is complex or numerous requests have been received, the Company will respond within a total period of no more than three (3) months, either fulfilling the request or explaining a refusal on lawful grounds expressly specified in General Regulation 679/2016.
2.3. If the Company considers a request manifestly unfounded, excessive or repetitive, it may charge a reasonable fee for further information, which is otherwise provided free of charge, or refuse to act on the request.
2.4. If the Company has reasonable doubts about your identity when you request to exercise a right, it may request additional information necessary to confirm your identity before processing the request.
2.5. If the Company takes longer than justified to respond, or if you believe your rights have been infringed or the Company has not complied with its data protection obligations, you may lodge a complaint with the supervisory authority: Hellenic Data Protection Authority, 1–3 Kifisias Avenue, postcode 115 23, Athens, contact@dpa.gr, +30 210 6475600.
2.6. You may withdraw any consent you have given at any time by sending a written request to the Data Protection Officer at dpo@eurohotel-crete.gr (see section 1.2).
3. What rights do you have regarding the personal data you have provided?
3.1. Right to information. You may request information about the personal data we have received from you and retain for one or more of the purposes described below in sections A–D. This document provides basic information and an explanation of the framework governing the protection of your personal data. Updates, further information and clarification may be provided upon a request to exercise your right to information (see section 1.2).
3.2. Right of access. You may request access to the data the Company holds about you and confirmation of whether they are processed. This includes information about processing purposes, categories of personal data, recipients or categories of recipients, retention and processing periods, the right to complain to the Hellenic Data Protection Authority, any available information about the source of data not provided by you, the existence of automated decision-making, including profiling, and its methodology, safeguards applied to transfers to third countries, and a copy of the personal data retained and processed (see section 1.2).
3.3. Right to rectification. You may request correction of your data if any information we are entitled to process has changed or has been recorded incorrectly (see section 1.2).
3.4. Right to erasure. You may request full or partial deletion of data we are entitled to retain and process because they are no longer necessary for the purposes for which they were collected, because you withdraw consent, or because you consider the purpose of collection unlawful. The Company will respond within a reasonable period, no longer than one month, or, where the relevant conditions and difficulties apply, no longer than three months in total. We will confirm full or partial deletion or explain why certain data cannot be deleted where their retention is required by law, a task in the public interest, freedom of expression and information, or the establishment, exercise or defence of a legal claim. In that case, you may complain to the supervisory authority and seek a judicial remedy (see section 1.2).
3.5. Right to restriction. You may request restriction of the processing of your data in terms of scope, time or purpose: (a) where you contest their accuracy, for the time required to verify it; (b) where you consider processing unlawful but request restriction instead of deletion; (c) where the Company no longer needs the data but you require their retention for a legal claim; or (d) where you object to processing, pending verification of whether the Company's lawful grounds override your rights as a data subject (see section 1.2).
3.6. Right to portability. You may receive the personal data you have provided in a structured, commonly used and machine-readable format and transmit them to another controller without objection where processing is based on consent. You may also request that the Company transmit the data directly to another organisation without your involvement. This right is subject to the limitations relating to erasure described in section 3.4 and must not adversely affect the rights and freedoms of others (see section 1.2).
3.7. Right to object. 3.7.1. You may object to the use of your personal data for direct marketing, including profiling related to direct marketing (see section 1.2). 3.7.2. No corresponding right arises for employees, prospective employees and visitors to the Company's premises in this context, because their data are not passed to the Marketing Department or used for those purposes.
4. Can your data be disclosed elsewhere?
Your data are not intended to be transferred to any organisation outside the Company, except to the competent tax authorities in the context of mandatory compliance with tax law, to the extent and provided that this is required.
5. Safeguards
The Company will use all technical and organisational measures to protect the data and will limit their use and processing to what is appropriate, minimal and strictly necessary, as required by law, exclusively for the purpose for which you provided them.
The following specific provisions for individual categories of data subjects apply alongside the general provisions above.
A. Recipients of communications
A.1. Purpose. Data provided solely in the context of communications are collected, processed and retained exclusively to inform you about the Company's products and activities. All such data are retained only for that purpose and processed only by the Company's Marketing Department.
A.2. Legal basis. Processing is based on your consent for the purposes described above, under Article 6(1)(a) of the General Data Protection Regulation.
A.3. Retention. For the purpose of informing you about our products and activities, we consider three (3) years a reasonable and necessary retention period. The data will be deleted three years after consent was obtained unless you provide fresh consent on the terms above.
B. Customers, suppliers and prospective customers and suppliers
B.1. Purpose and legal basis. (a) At the pre-contractual stage, including when you complete an online contact form, send an email, telephone us or complete a paper form, you may provide your name, email, telephone number, address, capacity or the products that interest you. The purpose is to explore a possible transaction with the Company. The legal basis is the Company's legitimate interest in pursuing its commercial purposes by responding to your requested communication about a possible transaction. (b) If you enter into a transaction with the Company, the data provided before and during that transaction will be processed to perform our contract and comply with tax law. The legal bases are performance of the contract and compliance with legal obligations under Articles 6(1)(b) and 6(1)(c) of the General Data Protection Regulation.
B.2. Retention. (a) Data described in section B.1(a) are retained for five (5) years and then deleted. (b) Data described in section B.1(b) are retained for as long as required by tax law.
B.3. Personal data collected during trade exhibitions are subject to the privacy policy forming part of the documentation of the organisation responsible for each exhibition, which interested participants are asked to complete.
C. Visitors to the Company's premises
C.1. Purpose. Data identifying you and recording the time you spend on the Company's premises are collected, processed and retained exclusively for the security and protection of people on the premises, including employees and visitors, and the Company's equipment, including its buildings and electronic equipment.
C.2. Legal basis. Processing is based on your consent for the purpose above, under Article 6(1)(a) of the General Data Protection Regulation.
C.3. Retention. For the security and protection of people on the premises and the Company's equipment, we consider fifteen (15) days a reasonable and necessary retention period. The relevant file containing your information is deleted fifteen days after you enter the premises.
D. Personal information
Personal information means information about an identifiable individual, as defined by applicable law, such as a name, email address or telephone number.
D.1. Information we may collect
D.1.1. We may collect personal information when you use our website or otherwise interact with us. The information falls into three categories: (a) information you provide; (b) information collected through automated methods; and (c) information collected from other sources.
D.1.2. We may combine information you provide with information collected through automated methods and from other sources.
D.1.3. Information you provide may include: (a) Personal details such as your name, postal and email addresses, telephone number, date of birth and other contact details when you register on our website or mobile application, connect to Wi-Fi, enter a competition or contact us by telephone or through our online services. (b) Transaction information, including services you register for, prices, payment methods and payment details. (c) Account information, such as a username, password or other identifier used to access our online services or purchase or use our products and services. (d) Profile information, including products and services you like or your preferred visiting times. (e) Other personal information you choose to provide when interacting with us.
D.1.4. Automated collection. We may use automated technology to collect information from your computer or mobile device when you visit our restaurants, use our online services or use technology within a restaurant. Such technology may include cookies, local shared objects and web beacons. Further information is available about cookies and other technologies.
D.1.5. Information we may collect includes: (a) Internet Protocol (IP) address; (b) computer or mobile operating system and browser type; (c) mobile device type and settings; (d) a unique device identifier (UDID) or mobile equipment identifier (MEID); (e) device and component serial numbers; (f) advertising identifiers, such as IDFA and IFA, or similar identifiers; (g) the website that referred you to our website or application; (h) online activity on other websites, applications or social media; (i) communications with us or about us on social media; (j) activity relating to your use of online services, such as pages visited on our websites or mobile applications.
D.1.6. Our website may collect precise location information from your mobile device or computer using geolocation technologies such as GPS, Wi-Fi, Bluetooth or proximity to a mobile network tower. On most mobile devices and computer systems, you can withdraw permission through your device or browser settings. If you have questions about preventing the collection of precise location information, contact your mobile service provider, device manufacturer or browser provider. The website may not function correctly without location information. To request deletion of information that could identify your location, contact us using the email address or telephone number in sections 1.1 and 1.2.
D.1.7. Other sources. We may collect information about you from other companies and organisations, including publicly available information, for example when you interact with us through social media.
D.2. Cookies
We may obtain information about your general internet usage through a cookie stored in your browser or on your computer's hard drive. Cookies contain information transferred to your hard drive and help improve our website and provide a more personalised service. Some cookies are necessary for the website to operate. Advertisers may also use cookies over which we have no control. For more information, see our Cookie Policy.
D.3. How we use information
D.3.1. We use the information we hold about you: (a) To present our website content effectively for you and your computer. (b) To provide the information or services you request and for internal customer management and business purposes. (c) To enable your participation in interactive website features when you choose to use them. (d) To notify you about changes to our website. (e) Where you consent to marketing, to send promotional and other materials about our hotels.
D.3.2. We may also use your data, or allow selected third parties to use them, to provide information about goods and services that may interest you and contact you about them. We do not disclose identifiable individual information to advertisers, but may provide aggregate information about users. We may use personal data collected from you to allow advertisers to display advertising to their intended audience.
D.4. Data storage
(a) Data collected from you are not transferred to and stored at a destination within the European Economic Area (EEA). (b) All information you provide is stored on our secure servers. Payment transactions are encrypted. (c) If we provide you with a password, or you choose one, to access parts of the website, you are responsible for keeping it confidential. Do not share it with anyone.
D.5. Information security
Transmission of information over the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of data transmitted to our website; transmission is at your own risk. Once received, we use strict procedures and security features to try to prevent unauthorised access.
D.6. Links to other websites and social media
(a) Our website may contain links to and from partner networks and advertisers. Those websites have their own privacy policies, for which we accept no responsibility. Check those policies before submitting personal data. (b) Providers of other applications, tools, widgets and plug-ins on our online services, such as Facebook “Like” buttons, may also use automated methods to collect information about your use of those features. These organisations may use your information under their own policies.