Privacy Policy

1. Who is responsible for your data

The controller of your personal data is the operator of Crystal View Mykonos. Crystal View Mykonos is operated by VIDALI KAI KOUSATHANAS L.P., Megali Ammos, Mykonos 84600, Greece, VAT No. 802810880, Tax Office MYKONOS

For any question about your data or to exercise your rights, contact us at info@crystalviewmykonos.gr.

2. The data we collect

• Booking data: full name, email address, mobile telephone, country (optional), number of adults and children, dates, suite and board basis, arrival and departure flight or ferry details (optional), comments and special requests (optional), discount code used, website language, the price and payment option, your acceptance of our Terms and policies, and the payment status and payment references we receive from Viva (order code and transaction ID). We do not receive or store your card number.
• Data at the property: identity card or passport details of guests, as required by Greek law, and records of payments made at the property.
• Contact form and messages: name, email, telephone, your message and language, and anything you tell us by email, telephone or WhatsApp.
• Welcome offer: the email address you enter, the code we send you and whether it has been used.
• Technical data: IP address, browser and device information and the date and time of requests, recorded by our servers and hosting providers for security and to keep the Website working; and the preferences stored in your browser described in our Cookie Policy.
• Analytics data: only if you consent to analytics cookies, information about how you use the Website (pages viewed, approximate location, device type).

Please do not include health or other sensitive information in comments or messages unless it is necessary for your stay (for example allergies or accessibility needs). If you do, we use it only to accommodate you.

3. Why we use your data and on what legal basis

• To take and manage your booking, process your payment, send your confirmation, arrange your transfer, communicate with you before and during your stay and provide our services. Legal basis: performance of a contract and steps at your request before entering into a contract (Art. 6(1)(b) GDPR).
• To meet our legal obligations, including tax and accounting records, issuing receipts and invoices, and registering guests as required by Greek law. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• To answer your enquiries sent through the contact form, email, telephone or WhatsApp. Legal basis: steps at your request before a contract (Art. 6(1)(b)) and our legitimate interest in replying to people who contact us (Art. 6(1)(f)).
• To send you your welcome code and apply it to your booking, and to make sure each person uses the offer only once. Legal basis: your request (Art. 6(1)(b)) and our legitimate interest in preventing abuse of offers (Art. 6(1)(f)). We do not use this email address for newsletters or marketing unless you separately agree.
• To keep the Website and payments secure, prevent fraud and misuse, and establish, exercise or defend legal claims, including payment disputes and chargebacks. Legal basis: our legitimate interests (Art. 6(1)(f)).
• To understand how the Website is used through analytics cookies. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time through Cookie settings.
• Special requests involving health data that you choose to give us. Legal basis: your explicit consent (Art. 9(2)(a)).

Giving us your name, email address and mobile telephone is necessary to make a booking; without them we cannot accept it. All other booking fields are optional.

4. Who we share your data with

We share your data only where necessary, with:

• Viva (Viva.com), which processes online payments as an independent controller under its own privacy notice;
• service providers acting on our behalf under data processing agreements: website and server hosting and database providers (including Amazon Web Services), email delivery (Mailjet), and internal team messaging (Slack) through which we receive notifications of new bookings and enquiries;
• transfer drivers or licensed transport partners, who receive only your name, telephone and arrival or departure details;
• our accountants and legal advisers, and public authorities (such as the Independent Authority for Public Revenue or the police) when required by law;
• Google, only if you consent to analytics cookies; and the font providers described in our Cookie Policy, which receive your IP address when your browser loads the Website;
• WhatsApp (Meta), if you choose to contact us through WhatsApp.

We do not sell or rent your personal data and we do not share it with third parties for their own marketing.

5. Transfers outside the European Economic Area

Some of our service providers (for example Slack, Google and Amazon Web Services) may process data outside the European Economic Area, in particular in the United States. In those cases the transfer is protected by an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework for certified companies) or by the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.

6. How long we keep your data

• Confirmed bookings and the related payment and accounting records: for as long as Greek tax law requires (as a rule, five years from the end of the year in which the stay took place, and longer if the tax audit period is extended) and, in any case, until the limitation period for claims arising from the booking has expired.
• Booking attempts that were not paid (expired or failed): for up to 12 months, for fraud prevention and to answer any related questions, and then deleted or anonymised.
• Enquiries that do not lead to a booking: for up to 2 years after our last contact.
• Welcome offer data: for as long as the code is valid and for up to 2 years afterwards, so that the offer can be claimed only once per person.
• Guest registration data: for the period required by law.
• Server and security logs: for a limited period needed for security purposes, unless needed to investigate an incident.
• Analytics data: for no more than 14 months.

Where we need data to establish or defend a legal claim, we may keep it until that matter is finally resolved.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, where there is no longer a legal reason for us to keep it;
• restrict the processing of your data in certain cases;
• receive the data you gave us in a structured, machine-readable format and have it transmitted to another controller (portability);
• object at any time to processing based on our legitimate interests, on grounds relating to your particular situation;
• withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise any of these rights, write to info@crystalviewmykonos.gr. We will reply within one month, which may be extended by two further months for complex requests. We may ask you to confirm your identity before acting on a request. Some rights are limited where we have to keep data by law (for example tax records).

If you believe that we process your data unlawfully, you have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), 1-3 Kifisias Avenue, 115 23 Athens, Greece, www.dpa.gr, or with the supervisory authority of the EU country where you live or work. We would appreciate the chance to deal with your concern first.

8. Security

We protect your data with appropriate technical and organisational measures, including encrypted connections (HTTPS), restricted access for authorised staff only, and the use of a regulated payment provider so that card details never pass through our systems. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the authorities of any breach where the law requires.

9. Other information

• We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
• Our Website and services are not directed at children under 18. Data about children staying with us (such as their number) is provided by the adult making the booking.
• The Website contains links to third-party websites and social networks (for example Facebook, Instagram, TripAdvisor). Their own privacy policies apply when you visit them.
• We may update this Privacy Policy from time to time. The date of the latest version is shown at the top of this page, and we will inform you of significant changes where appropriate.
• This Privacy Policy is available in Greek and English. If there is any inconsistency, the Greek version prevails, to the extent permitted by law.