Privacy Policy

Who we are

The data controller for this website and for stays at our properties is:

For any question about your personal data, or to exercise your rights, write to us at reservations@corfucollection.com with “Privacy” in the subject line.

What we collect

• Enquiries. When you use our contact form, email or call us: your name, email address, phone number, the property and dates you ask about, and your message.
• Bookings. When you book: the names of the guests, contact details, address, dates, suite, price, special requests, and payment status. Card details are handled by the booking engine and its payment providers and are not stored on this website.
• During your stay. The identity details Greek law requires us to record for each guest (from an ID card or passport), any requests you make, and invoicing details such as a company name and VAT number.
• Website use. Our server records technical data such as your IP address, browser type and the pages you request, to keep the website secure and working. We use cookies as explained in our Cookie Policy.

We do not ask for special categories of data. If you choose to tell us about a health need or accessibility requirement, we use it only to prepare your stay.

Why we use it

We do not sell your data and we do not make decisions about you by automated means alone.

Who we share it with

We share your data only as far as needed, with:

• WebHotelier, which provides our booking engine and processes bookings and payments on our behalf.
• Banks and payment providers that process your payment.
• Service providers who host this website and our email, and our accountants, all bound by confidentiality and data protection agreements.
• Public authorities, such as the tax authorities and the police, when Greek law requires it.
• Travel agents and online travel platforms, if you booked through one. They act as separate controllers under their own privacy policies.

Content from other providers

To display this website we load some content from other providers. Your browser connects to them directly, so they receive your IP address and basic browser data:

• Google Fonts (Google Ireland Ltd) for the typefaces.
• jsDelivr for the map software.
• OpenStreetMap (OpenStreetMap Foundation) for the map tiles.

We use them because we have a legitimate interest in presenting the website and our locations properly. None of them sets cookies through our website.

Transfers outside the EEA

We keep your data within the European Economic Area where we can. If a provider transfers data outside it, we make sure the transfer is protected by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or by the European Commission’s standard contractual clauses.

How long we keep it

• Enquiries that do not lead to a booking: up to 2 years.
• Booking, invoicing and guest records: for as long as Greek tax, accounting and tourism law requires. For tax records this is generally 5 years from the end of the year in which the stay took place, and longer if a tax audit or legal claim is pending.
• Marketing emails: until you unsubscribe.
• Server logs: up to [30] days.
• Cookies: as set out in our Cookie Policy.

Your rights

Under the General Data Protection Regulation you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased, where we no longer need it or have no legal basis to keep it;
• restrict how we use your data;
• receive the data you gave us in a portable format;
• object to our use of your data based on legitimate interest, and to direct marketing at any time;
• withdraw your consent at any time, without affecting what we did before you withdrew it.

Write to us at reservations@corfucollection.com. We reply within one month. We may ask you to confirm your identity first.

You also have the right to complain to the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens, dpa.gr, or to the supervisory authority in the EU country where you live.

Security

We protect your data with appropriate technical and organisational measures, including encrypted connections (HTTPS), access controls and regular updates. Only people who need your data to do their job can access it.

Children

Bookings must be made by adults. We record the details of children staying with us only as part of their parent’s or guardian’s booking, and where the law requires it.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. If we make significant changes, we will tell you on this website or by email.