This Privacy Policy applies to the website chalet1932.gr and to direct communications relating to Chalet 1932. It should be read together with our Cookies Policy.
1. Data controller
The controller responsible for the processing described in this policy is:
- Chalet 1932 – Boutique Mountain Chalet
- Location: Kertezi, Kalavryta, Greece
- Email: chalet1932@gmail.com
- Telephone: +30 697 241 5986
2. Personal data we may collect
Information you provide directly
- Name and surname.
- Email address and telephone number.
- Requested arrival and departure dates.
- Number of guests and information included in your message.
- Communications sent by email, telephone, WhatsApp or the website form.
- For the statutory Short-Term Stay Declaration and booking administration: the Greek Tax Identification Number (AFM) for a Greek tax resident, or the full name and passport or identity-document number for a foreign guest, where applicable.
Chalet 1932 does not request or retain photographs or photocopies of identity cards, passports or other identification documents. Where reasonably necessary, the original document may be viewed solely to verify the accuracy of the details provided.
Technical and usage information
- IP address, date and time of access, requested pages and server logs.
- Browser, device, operating system and approximate location information.
- Website interaction and aggregated traffic information through Google Analytics, only where the required consent has been given.
- Cookie and preference choices stored in your browser.
Information from third-party booking platforms
Where you contact or book Chalet 1932 through a third-party platform such as Airbnb or Booking.com, that platform processes your data under its own privacy policy. We may receive the information necessary to communicate with you, administer the reservation and provide the accommodation.
Video-surveillance data
Images of persons entering, leaving or moving within the exterior entrances and the limited parts of the outdoor areas covered by the two external TP-Link Tapo security cameras. No indoor area of the property is recorded.
3. Why we process personal data and our legal bases
| Purpose | Typical data | Legal basis |
|---|---|---|
| Responding to availability and booking enquiries. | Contact details, requested dates, guest number and message. | Taking steps at your request before entering into a contract. |
| Managing and providing a confirmed stay. | Guest, booking, communication and payment-related information. | Performance of a contract and steps connected with that contract. |
| Submitting the statutory Short-Term Stay Declaration, issuing documents and meeting tax, accounting or other legal requirements. | Identification details required by the applicable declaration, booking, invoicing and transaction records. | Compliance with a legal obligation. |
| Protecting the website, detecting misuse and maintaining technical security. | IP address, technical logs and security events. | Legitimate interests in operating a secure and reliable website. |
| Measuring and improving website use through optional analytics. | Device, browser, interaction and approximate location information. | Your consent, which may be withdrawn at any time. |
| Establishing, exercising or defending legal claims. | Relevant communications, booking records and supporting information. | Legitimate interests and, where applicable, legal obligations. |
| Protecting persons, entrances and property through exterior video surveillance. | Images from the exterior entrances and parts of the outdoor areas. | Legitimate interests in protecting persons and property, preventing incidents and investigating security events. |
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
4. Whether you must provide the data
You are not legally required to browse the public pages of the website or to submit an enquiry. However, we need the fields identified as required in the availability form in order to review and answer your request. Additional information may be needed later to complete and administer a confirmed booking or meet legal obligations.
5. Who may receive personal data
We do not sell personal data. Access may be provided only where necessary to:
- The Independent Authority for Public Revenue (AADE), where identification and stay details must be submitted through the statutory Short-Term Stay Declaration.
- Website hosting, technical support and security providers.
- Email, communications and form-delivery providers.
- Availability, calendar synchronisation or booking-management services.
- Google Analytics and embedded-content providers, only where the relevant optional service has been activated in accordance with your cookie choice.
- Accountants, legal advisers, insurers or professional advisers where required.
- Competent public, tax, judicial or law-enforcement authorities where disclosure is required by law.
Service providers acting on our behalf may process information only for the agreed purposes and subject to applicable confidentiality and data-protection obligations.
6. International data transfers
Some technology providers may process information outside the European Economic Area. Where this occurs, the transfer should be supported by a lawful mechanism recognised under the GDPR, such as an adequacy decision or approved contractual safeguards, as applicable to the provider and service.
7. How long we keep personal data
- Enquiries that do not lead to a booking: normally for no longer than 12 months after the last relevant communication, unless a longer period is necessary for a dispute, security issue or legal claim.
- Confirmed bookings and financial records: for the period needed to provide the stay and for any longer period required by applicable tax, accounting or other legal obligations.
- Technical and security logs: normally for up to 12 months, unless a security incident or investigation requires longer retention.
- Analytics data: according to the configured Google Analytics retention settings and cookie duration, provided that the required consent remains valid.
- Legal claims: for as long as reasonably necessary to establish, exercise or defend the relevant claim.
- Exterior camera recordings: retained for 15 days and then deleted or automatically overwritten, unless a specific incident has been recorded. In that case, only the relevant and necessary extract may be retained for as long as required to investigate the incident, support a legal claim or cooperate with a competent authority.
Data may be deleted or anonymised earlier where it is no longer required for the purpose for which it was collected.
8. Exterior video-surveillance system
Chalet 1932 uses two external TP-Link Tapo security cameras to protect guests, the entrances and the property.
- The cameras cover the exterior entrances and parts of the outdoor areas that are necessary for monitoring access and protecting the property.
- They do not cover or record any indoor area of the property.
- The purpose of processing is to prevent and investigate security incidents, property damage, unauthorised access or other events affecting persons or property.
- The legal basis is the management’s legitimate interest in protecting persons and property.
- Access to recordings is restricted to management and specifically authorised persons, only where there is a relevant need.
- Recordings are retained for 15 days and are then deleted or automatically overwritten.
- Where a specific incident is identified, the relevant extract may be kept for longer, but only for as long as necessary to investigate the incident, establish or defend a legal claim, or provide it to the police, judicial authorities or another competent authority.
- Requests concerning access, objection or another data-protection right may be submitted using the contact details in this policy. Requests are assessed in accordance with applicable law and the rights of any third parties appearing in the footage.
9. Your data-protection rights
Depending on the circumstances and the legal basis used, you may exercise the following rights:
Right to information and access
Ask whether we process your data and request access to relevant information and copies.
Right to rectification
Request correction of inaccurate data and completion of incomplete data.
Right to erasure
Request deletion where the legal conditions are met and no overriding obligation requires retention.
Right to restriction
Request that processing be limited in circumstances provided by the GDPR.
Right to data portability
Receive eligible data in a structured, commonly used and machine-readable format.
Right to object
Object to processing based on legitimate interests, subject to the applicable legal conditions.
Withdrawal of consent
Withdraw consent for analytics or other optional processing at any time.
Automated decisions
We do not make decisions producing legal or similarly significant effects based solely on automated processing.
To exercise a right, contact us at chalet1932@gmail.com. We may request information necessary to verify your identity and protect your data. Requests are normally answered within one month. Where permitted by law, this period may be extended by up to two additional months for complex or numerous requests, and you will be informed of the reason.
10. Right to lodge a complaint
You also have the right to lodge a complaint with the Hellenic Data Protection Authority, particularly if you believe that the processing of your personal data infringes applicable data-protection law.
- Address: Kifissias 1–3, 115 23 Athens, Greece
- Telephone: +30 210 6475600
- Complaint information: Hellenic DPA complaint page
11. Security
We apply reasonable technical and organisational measures appropriate to the nature of the website and the information processed. These may include access controls, secure hosting practices, software maintenance, restricted access and encrypted transmission where supported.
No internet transmission or storage method can be guaranteed to be completely secure. If you believe information sent to us has been compromised, contact us promptly.
12. Children
The website and availability form are intended for adults arranging accommodation. We do not knowingly request personal data directly from children through the website. A parent, guardian or other responsible adult should provide any information necessary for a family booking.
13. External websites and platforms
The website may link to third-party websites and platforms, including social media, maps, video services and booking platforms. Their processing activities are governed by their own privacy notices, and Chalet 1932 does not control their independent practices.
14. Changes to this policy
We may update this policy when our website, services, providers or legal obligations change. The latest revision date appears at the top of the page.
15. Contact us
Questions, requests or concerns about personal data may be sent to:
- Email: chalet1932@gmail.com
- Telephone: +30 697 241 5986
- Location: Kertezi, Kalavryta, Greece