Privacy Policy

This policy explains how 5 Hermoupolis Concept Sites handles personal data when you visit this website, write to us or book a stay. We collect only what we need to look after your enquiry and your stay. We do not sell personal data and we do not use it to build advertising profiles.

1. Who we are

The data controller is Christos Skretas, trading as 5 Hermoupolis Concept Sites, Nordestrom 10 & Korai, 841 00 Hermoupolis, Syros, Greece.

For any question about your personal data, or to use your rights, write to info@5hermoupolis.gr or call +30 2281 089001.

2. What we collect and why

When you use our contact form

We ask for your name, email address and message, and if you wish your phone number. We use them to answer you and, if you ask about a stay, to prepare it. The form sends your message to our inbox and keeps a copy in the website’s database, so that no request is lost. The legal basis is the steps you ask us to take before a booking, or our legitimate interest in answering the messages we receive (Article 6(1)(b) and (f) GDPR).

When you email or call us

We use the details you give us in the same way and on the same legal bases.

When you book

Online bookings are made in our booking engine at 5hermoupolis.reserve-online.net, which WebHotelier (Revplus Hellas S.A.) runs for us. It collects what a booking needs: your name, contact details, dates of stay, requests and payment details. We use them to confirm and manage your booking (Article 6(1)(b) GDPR). The booking engine’s privacy notice explains that part in detail.

When you stay with us

We process the details needed to host you, and those that Greek law requires accommodation providers to keep, such as the guest register and the details on invoices and receipts (Article 6(1)(b) and (c) GDPR).

When you visit the website

The server that hosts our website records technical data with every visit: IP address, browser type, date and time, and the pages requested. We use these records only to keep the website running and secure (Article 6(1)(f) GDPR).

The map on our homepage

The map in our contact section is provided by Google. It loads only after you agree to it in our cookie banner. When it loads, Google receives your IP address and may set cookies, under Google’s privacy policy. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time, as our Cookie Policy explains.

Links to social networks

Our links to Instagram and Facebook are plain links: nothing is loaded from those networks until you click one. On their sites, their own privacy policies apply.

We use no analytics and no advertising tools on this website.

3. Who receives your data

• digitall (digitall.gr), which hosts and maintains our website and our email, as our processor.
• WebHotelier (Revplus Hellas S.A., Rhodes, Greece), which runs our booking engine, as our processor.
• Cookiebot by Usercentrics A/S (Denmark), our consent tool, which keeps a record of the cookie choices made on our website, as our processor.
• Google, for the map, only if you agree to it.
• Banks and payment providers, to process payments for bookings.
• Our accountant and public authorities, when Greek law requires it.

Our processors act only on our instructions and must keep your data safe.

4. Transfers outside the European Union

If a provider processes personal data outside the European Economic Area, it does so only with the safeguards the GDPR requires, such as an adequacy decision or standard contractual clauses. Google may process the data from the map in the United States under the EU-U.S. Data Privacy Framework.

5. How long we keep it

• Messages from the contact form and emails: as long as we need them to deal with your request and any follow up, then we delete them.
• Booking and stay records: as long as Greek tax and accommodation law requires, then we delete them.
• Server records of visits: only as long as needed for security and troubleshooting.
• Your cookie choices: 12 months, after which the banner asks again.

6. Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• have it corrected if it is wrong or incomplete;
• have it deleted, unless the law requires us to keep it;
• restrict how we use it, or object to a use based on our legitimate interests;
• receive the data you gave us in a common electronic format;
• withdraw your consent at any time, without affecting what was done before.

To use any of these rights, write to info@5hermoupolis.gr. We answer within one month. If you believe we have not handled your data properly, you can complain to the Hellenic Data Protection Authority, 1-3 Kifisias Avenue, 115 23 Athens (www.dpa.gr).

7. Security

Our website uses an encrypted connection (HTTPS). Access to its administration and to our inbox is limited to the people who need it.

8. Children

Our website is not aimed at children under 16 and we do not knowingly collect their data. Details of children travelling with you are processed only as part of your booking.

9. Changes to this policy

We update this policy when our services or the law change. The date at the top of the page shows when it last changed.