Privacy Policy

1. Introduction

This Privacy Policy explains how THE SYNTOPIA HOTEL (the “Hotel”, “we”, “us” or “our”), processes personal data in connection with reservations, accommodation, guest services, communications, payments, special requests, complaints, security, CCTV, marketing, and the operation of our website and online services.

2. Data Controller

S. GIANNIKAKIS TOURISTIKES KAI XENODOCHEIAKES EPICHEIRISEIS ANONYMOS ETAIREIA
Registered address: Adelianos Kampos, 74100, Rethymnon Crete, Greece
VAT No.: 094083440
Company Registration No.: 122177350000
Tel. No: 2810522000
Email: info@thesyntopiahotel.gr

We determine the purposes and means of the processing of personal data described in this Policy. Depending on the service involved, certain third parties may process personal data as independent controllers, joint controllers or processors, as applicable under the GDPR.

3. Principles of the processing of personal data

The Personal Data Protection Policy (hereinafter referred to as the “Policy”) aims to protect the personal data processed by the Hotel and to prevent any form of unfair processing.

The Policy and the processing of personal data pursuant to this Policy, is based on the following principles:

Lawfulness, fairness and transparency in processing (‘lawfulness, fairness and transparency’)
Limitation of the purpose of processing (‘purpose limitation’)
Minimisation of the data being processed (‘data minimisation’)
Accuracy and where necessary, updating of the data being processed (‘accuracy’)
Integrity and confidentiality in processing (‘integrity and confidentiality’)
Limitation of the retention/storage time (‘storage limitation’)
Compliance with the applicable legal and regulatory framework

The Hotel is responsible for, and able to demonstrate its compliance with the above principles, as specified in this Policy. The Hotel checks, reviews and updates at regular intervals and, in any event, whenever necessary, this Policy, taking into account the applicable legal and regulatory framework.

4. Definitions

“Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed.
“Personal data” means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one can be identified, directly or indirectly.
“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data that have been or will be made known to the Hotel, both under relations with individuals and in the context of information that the Hotel receives from third parties, natural or legal, persons or public sector bodies, in the exercise of their legal rights or the rights of the Hotel.
“Data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
“Restriction of processing” means the marking of stored personal data with the aim of limiting their processing in the future.
“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
“Third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. For the purposes of this Policy, the Hotel shall be deemed to be the Controller.
“Data protection officer” means the natural or legal person designated by the controller to participate in all matters relating to the protection of personal data in accordance with this Policy and the applicable legal and regulatory framework.
“Data subject” means any identified or identifiable natural person to whom the personal data being processed relates.

5. Categories of personal data we process

Depending on the nature of our relationship with you and the services you use, we may process:

5.1 Identification data

Name, nationality, date of birth where required, identification/passport details where legally required, and information concerning accompanying persons, data relating to children/minors, where necessary in connection with reservations and accommodation services.

5.2 Contact data

Address, email address and telephone number.

5.3 Reservation and stay data

Booking details, dates of stay, room information, number of guests, services used, preferences, communications and information necessary to manage your stay.

5.4 Payment and financial data

Payment, transaction and billing information. Where applicable, payment card details may be collected and processed directly by a payment service provider in accordance with its own privacy arrangements.

5.5 Preferences and special requests

Dietary requirements, accessibility requirements, room preferences and other requests. Where a request reveals health or other special-category information, we process it only where a lawful condition under Article 9 GDPR applies.

5.6 Technical and online data

IP address, browser and device information, online identifiers, usage information and cookie-related information, where applicable.

5.7 CCTV images

Images captured by our video surveillance systems where CCTV is operated for security and safety purposes.

5.8 Marketing and communication data

Communication details, marketing preferences, records of consent or objection, and information necessary to manage marketing communications.

6. How we collect your personal data

We may collect personal data directly from you, including when you make a reservation, communicate with us, stay at the Hotel, use our services, submit a request or complaint, or use our website. We may also receive information from persons making reservations on your behalf, accompanying persons, travel agencies, tour operators, online travel agencies and booking platforms and service providers.

7. Legal bases of processing

We process personal data only where a lawful basis under the GDPR applies.

7.1 Contract – Article 6(1)(b) GDPR

Where necessary to perform a contract with you or take steps at your request before entering into a contract, including reservations, accommodation, communications concerning your stay, service requests, payments, cancellations and related administration.

7.2 Legal obligation – Article 6(1)(c) GDPR

Where processing is necessary to comply with applicable legal obligations, including tax, accounting, financial, reporting, hospitality, tourism, health and safety obligations and lawful requests from competent authorities.

7.3 Legitimate interests – Article 6(1)(f) GDPR

Where necessary for legitimate interests pursued by the Hotel or a third party, provided that such interests are not overridden by your interests or fundamental rights and freedoms. These interests may include security, protection of persons and property, fraud prevention, IT and network security, management of legal claims, incident and complaint management, operational records and service improvement.

7.4 Consent – Article 6(1)(a) GDPR

Where processing is based on your consent, including where prior consent is required for particular marketing or promotional activities.

7.5 Special categories of data – Article 9 GDPR

Where we process special categories of personal data, such as health-related information, we do so only where one of the conditions under Article 9(2) GDPR applies and only to the extent necessary for the relevant purpose.

8. Specific purposes of processing

We may process personal data for the following purposes:

managing reservations and bookings;
providing accommodation and hotel services;
check-in and check-out administration;
communicating with guests;
processing payments and issuing invoices;
responding to requests and special requirements;
managing complaints and incidents;
complying with legal and regulatory obligations;
protecting guests, employees and property;
operating CCTV and other security measures;
preventing and investigating fraud or misuse;
maintaining IT systems and network security;
establishing, exercising or defending legal claims;
improving hotel operations and guest services;
sending marketing communications where legally permitted;
administering loyalty or promotional programmes, where applicable; and
operating and securing our website and online booking services.

9. Recipients of personal data

Personal data may be disclosed, where necessary and lawful, to:

authorised Hotel personnel;
reservation, booking and property-management system providers;
booking engines and channel-management providers;
travel agencies, tour operators and online travel agencies;
payment and financial service providers;
IT, hosting, cloud and technical-support providers;
email and communications providers;
marketing service providers;
lawyers, accountants, auditors and other professional advisers;
public authorities, courts and law-enforcement authorities where legally required or permitted; and
other third parties where disclosure is necessary for a lawful purpose.

The legal role of each third party depends on the relevant processing activity. A third party may act as an independent controller, joint controller or processor.

10. Data Processors

Where a third party processes personal data on our behalf and under our instructions, we treat that party as a processor and require appropriate contractual and technical safeguards in accordance with Article 28 GDPR. Processor arrangements address, as applicable, confidentiality, security, documented instructions, sub-processors, assistance with data-subject rights, personal data breaches, audits and deletion or return of personal data. We assess the role of each service provider based on the actual facts and circumstances of the processing.

11. International Transfers

Where personal data are transferred to, accessed from or otherwise processed in a country outside the European Economic Area (EEA), the Hotel will ensure that such transfer is carried out in accordance with Chapter V of the GDPR. Depending on the circumstances, the Hotel may rely on an adequacy decision adopted by the European Commission or, where applicable, implement appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with any supplementary measures required under applicable law.

12. Data Retention

We retain personal data only for as long as necessary for the purposes for which they were collected, taking into account applicable legal and regulatory requirements. Retention periods are determined by reference to factors including the purpose of processing, statutory tax and accounting requirements, contractual requirements, limitation periods for legal claims, legitimate business needs and security requirements. Indicatively:

reservation and guest records are retained for the period necessary for hotel administration and applicable legal/business requirements;
accounting and financial records are retained for the periods required by applicable law;
marketing data are retained until consent is withdrawn or otherwise in accordance with the applicable retention criteria;
CCTV footage is retained only for the period necessary under applicable law and the Hotel’s CCTV policy, subject to longer retention where necessary for an incident or legal claim; and
data relevant to legal claims may be retained for the applicable limitation or defence period.

13. CCTV/Video Surveillance

Where CCTV is operated at the Hotel, it is used primarily for legitimate security and safety purposes and is subject to principles of necessity, proportionality, transparency and data minimisation. Appropriate signage and information are provided in accordance with applicable requirements. CCTV footage is retained only for the period necessary for the relevant purpose, subject to longer retention where necessary for an incident, investigation or legal claim. Further information is provided in the dedicated CCTV/Video Surveillance Notice.

14. Your Data Protection Rights and how to exercise them

Subject to the conditions and limitations provided by the GDPR, you may have the following rights:

14.1 Right of access

You may request access to your personal data and information about how it is processed.

14.2 Right to rectification

You may request correction of inaccurate or completion of incomplete personal data.

14.3 Right to erasure

You may request deletion of your personal data where the legal conditions for erasure are met.

14.4 Right to restriction

You may request restriction of processing where the legal conditions are met.

14.5 Right to data portability

Where applicable, you may receive personal data concerning you in a structured, commonly used and machine-readable format and transmit it to another controller. This right applies where processing is based on consent or contract and is carried out by automated means.

14.6 Right to object

You may object to processing based on legitimate interests on grounds relating to your particular situation. You have an unconditional right to object to processing of your personal data for direct marketing purposes.

14.7 Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

14.8 Rights relating to automated decision-making

Where applicable, you have rights under Article 22 GDPR in relation to solely automated decisions producing legal or similarly significant effects.

Your requests regarding your personal data and the exercise of your rights are submitted to the Data Protection Officer (DPO) of the Hotel, to the e-mail address dpo@fodelebeach.gr or to The Syntopia Hotel to the e-mail address info@thesyntopiahotel.gr to the attention of the Data Protection Officer (DPO). To this end, you may fill in the special form of the Hotel available at the hotel reception.

If your request is not satisfied or in case you consider that the processing of your Personal Data violates the applicable legal framework for the protection of personal data, you can lodge a complaint with the Hellenic Data Protection Authority (Kifissias Avenue no. 1-3, 11523 Athens, Tel: 2106475600, E-mail: complaints@dpa.gr).

15. Data security

15.1 Security of processing

The Hotel implements appropriate technical and organisational measures to ensure a level of security appropriate to the risks to the rights and freedoms of data subjects. In this context:

we have developed a personal data protection Policy and procedures for maintaining confidentiality and ensuring the integrity, availability and reliability of processing systems and services;
we regularly carry out testing, assessment and evaluation of the effectiveness of technical and organisational measures to ensure the security of processing, taking into account mainly risks arising from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
we ensure that any natural person acting under our supervision and having access to personal data (Processor), processes the data only within the limits of the relevant order given to him by the Hotel and under the terms and conditions set by the Hotel.

15.2 Breach of personal data

Any breach of this Policy, as well as of the applicable to personal data and personal data protection legal and regulatory framework, and, in general, any breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed shall constitute a breach of personal data. In the event of a personal data breach, the Hotel will assess the breach without undue delay and determine whether notification to the competent supervisory authority is required under Article 33 GDPR. Where notification is required, the Hotel will notify the Hellenic Data Protection Authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach. Where notification is not made within 72 hours, the reasons for the delay will be documented. In addition, in the event of data breach, the DPO shall be informed without undue delay and shall advise the Hotel on the applicable data protection requirements and, where appropriate, on notification and communication obligations.

16. Privacy by design and by default

16.1 Data protection by design (privacy by design)

We shall apply effectively, both at the time of the determination of the means of data processing and at the time of processing, appropriate technical and organisational measures designed for the application of data protection principles, which we ensure that they meet on an ongoing basis the requirements of the GDPR and protect your rights as data subjects.

16.2 Data protection by default (privacy by default)

We apply appropriate technical and organisational measures to ensure that, by definition, only the personal data necessary for the purpose of the processing are processed. The above obligation covers all the data collected, the degree of their processing, the period of retention and storage and access to them.

16.3 Staff confidentiality and training

We take care of the complete information and training of our staff on all issues related to the protection of personal data and its compliance with the obligations arising from the GDPR, the applicable legal and regulatory framework, as well as the policies/procedures that the Hotel has adopted. Personnel who have access to personal data are subject to appropriate confidentiality obligations and receive relevant data protection and security guidance or training appropriate to their roles.

17. Data Protection Officer (DPO)

We have appointed a Data Protection Officer who participates, duly and in a timely manner, in all matters relating to the protection of personal data. The DPO shall inform and advise the Hotel and its personnel as regards its obligations arising from the GDPR, the applicable legal and regulatory framework, as well as the policies adopted by the Hotel relating to the protection of personal data. The DPO shall cooperate with the Hellenic Data Protection Authority and act as a point of contact with you for any matter relating to the processing of your personal data and the exercise of your rights. You may contact the DPO of the Hotel at dpo@fodelebeach.gr

Last updated: 18-09-2026