GDPR Terms & Conditions
Last updated 24 October 2026
This policy explains how we use personal data when you visit klidonmykonos.com, contact us, subscribe to our newsletter or arrange an online reservation. We process personal data under the General Data Protection Regulation (EU) 2016/679 and applicable Greek data protection and electronic communications law.
Who is responsible for your data
The data controller is Papourtzis Emmanouil, trading as Klidon Mykonos Suites. The data controller determines why and how the personal data covered by this policy is used.
Contact address: Vrisi, Mykonos Town, 84600, Greece. Email: info@klidonmykonos.com. Telephone: +30 22890 25895. Website: https://klidonmykonos.com/.
Use these contact details for privacy questions or requests concerning your personal data. We will provide any additional privacy information needed when collecting data for a purpose outside the scope of this policy.
Personal data we collect
Enquiries and correspondence: your name, email address, telephone number if supplied, message content and the information you choose to provide when contacting us.
Reservations: guest and contact details, stay dates, suite selection, number of guests, booking references, requests and transaction or billing information needed for the reservation. Payment information requested by the booking or payment service is covered by the information shown in that service.
Newsletter subscriptions: your email address, any name you choose to provide, subscription preferences, consent records and unsubscribe requests.
Website use and security: technical information such as IP address, browser and device information, requested pages, dates and times, and information generated by cookies or similar technologies, depending on the services and choices involved.
Please provide only information relevant to your request. Do not send payment card details, identity-document copies or sensitive personal information through the general website contact form.
Where information comes from and what you need to provide
We receive information directly from you through website forms, email, telephone and the reservation process. We also receive reservation information from the booking service you use to arrange your stay. If another person makes a reservation for you, we may receive the guest and contact details they supply for that reservation. They should make this policy available to you.
Fields identified as required are needed to answer your enquiry or arrange the requested reservation. Without the necessary information, we may be unable to provide that service. Newsletter subscription and optional cookie choices are voluntary and are not conditions for submitting an enquiry or making a reservation.
Why we use data and our legal bases
Answering accommodation enquiries and arranging or managing your reservation: processing necessary to take steps at your request before entering a contract, or to perform that contract, under Article 6(1)(b) GDPR.
Answering other correspondence: our legitimate interest in communicating with people who contact the business, under Article 6(1)(f) GDPR.
Sending newsletters and promotional offers: your consent under Article 6(1)(a) GDPR and the applicable electronic marketing rules. We explain how to withdraw consent below.
Keeping the website and communications secure, preventing misuse and dealing with disputes: our legitimate interests in protecting our systems, business and legal rights, under Article 6(1)(f) GDPR, subject to your rights and interests.
Meeting applicable accounting, tax or other statutory duties: compliance with a legal obligation under Article 6(1)(c) GDPR.
Using optional cookies or similar tracking technologies: your consent where required by Greek electronic communications law and, where personal data is involved, Article 6(1)(a) GDPR.
We do not use enquiry or newsletter form information to make decisions based solely on automated processing that produce legal or similarly significant effects on you.
Who receives personal data
Access is limited to people who need the information for the purposes described in this policy. Recipients may include authorised hotel personnel; providers of website hosting, maintenance, security and email services; reservation and payment providers; and professional advisers or public authorities where disclosure is necessary and lawful.
The online reservation engine at https://klidonmykonos.reserve-online.net/ uses WebHotelier technology to process reservations on our behalf. Information about the reservation process is also available at https://klidonmykonos.reserve-online.net/privacy-policy. Contact us about our use of your reservation data.
The website includes Google Maps content and Rateparity price or review components. When these components load, the relevant provider receives technical information needed to supply the component, including your IP address and browser information. Optional tracking is subject to the choices described in the cookies section.
Providers processing data on our behalf must follow our instructions and appropriate contractual safeguards. Some recipients, such as payment providers or authorities, may act as independent controllers for their own lawful purposes. Their notices explain that processing. Links to external websites also lead to services with their own privacy information.
How long we keep personal data
We apply the following retention rules. Records needed for a legal obligation, an unresolved complaint, a security investigation or a legal claim may be kept longer where justified. We limit longer retention to the relevant information and restrict its use.
| Information | Retention rule |
| Enquiries that do not become reservations | Up to 12 months after the last substantive correspondence, to complete the enquiry and allow related follow-up. |
| Operational reservation records | Up to 24 months after checkout or cancellation, unless the information forms part of a record subject to a longer legal retention requirement. |
| Invoices and statutory records | For the period required by applicable Greek tax and accounting legislation, including any lawful extension for an audit or dispute. This applies to the records required by law, rather than all guest information. |
| Newsletter details and preferences | Until you unsubscribe or the subscription is otherwise ended. We periodically review inactive subscriptions. Minimum consent and opt-out records are kept for as long as needed to demonstrate compliance and respect your choices. |
| Routine website security logs | Up to 30 days, unless specific records are needed to investigate an incident, prevent continuing misuse or deal with a related claim. |
When retention ends, we delete the information or anonymise it so it no longer identifies you. Residual backup copies expire through the backup rotation cycle and remain protected and unavailable for ordinary business use until overwritten.
Transfers outside the European Economic Area
Service providers may process information outside the European Economic Area, including in the United States. For transfers we arrange, we require a valid Chapter V GDPR transfer mechanism: an applicable European Commission adequacy decision, or appropriate safeguards such as the Commission’s Standard Contractual Clauses, with supplementary measures where needed.
Contact info@klidonmykonos.com for information about the recipient countries and the safeguards applicable to your data, or to request a copy of the relevant safeguards, subject to necessary redactions.
Cookies and embedded services
Cookies and similar technologies can store or access information on your device. Technologies strictly necessary to transmit a communication or provide an online service you expressly request may operate without consent. Optional analytics, advertising or other non-essential tracking technologies require your prior consent where applicable.
The cookie information provided with the website’s consent controls identifies the technologies in use, their providers, purposes and durations. You can accept or reject optional categories and later change or withdraw your choices through those controls. Rejecting optional tracking does not prevent you from contacting us or arranging accommodation, although an optional embedded feature may remain unavailable.
Browser settings can also delete or block cookies, but may affect some features. Browser settings are additional controls and do not replace our obligation to obtain consent where required.
Your rights and how to exercise them
Depending on the circumstances and the applicable GDPR conditions, you may request access to and a copy of your data, correction of inaccurate data, erasure, restriction of processing and portability of data processed by automated means on the basis of consent or a contract.
You may object to processing based on legitimate interests on grounds relating to your situation. You have an unconditional right to object to use of your personal data for direct marketing. You may also withdraw consent at any time without affecting the lawfulness of earlier processing.
Send requests to info@klidonmykonos.com or the postal address above. We may request proportionate information to verify your identity. We respond without undue delay and normally within one month of receiving a request. Where GDPR permits an extension because of complexity or the number of requests, we may take up to two additional months and will explain the extension within the first month.
Ordinary rights requests and the first copy of your personal data are free. A reasonable administrative fee or refusal is permitted only in the limited circumstances allowed by GDPR, such as manifestly unfounded or excessive requests. A reasonable fee may also apply to additional copies.
You may lodge a complaint with a competent supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement. In Greece, this is the Hellenic Data Protection Authority: https://www.dpa.gr/. Its complaint guidance is available at https://www.dpa.gr/el/polites/katagelia_stin_arxi.
Security
We use technical and organisational measures appropriate to the nature of the data and the risks, including access restrictions and safeguards for transmission and storage. No online system can eliminate every security risk. Contact us promptly if you believe information you have provided to us has been compromised.
Changes to this policy
We review this policy when our services, processing activities or legal obligations change. The date at the top identifies the latest version. We will provide further information before using personal data for a new purpose and obtain fresh consent where required.
English 
Greek