Privacy Policy

1. Data controller

This Privacy Policy explains how personal data is processed through almiraprassa.gr, a website presenting Almira Prassa Beach House in Kimolos and allowing visitors to contact us or submit booking enquiries.

Data controller: Efi Tressou (Έφη Τρέσσου), owner of Almira Prassa Beach House. Contact address: Kimolos, Cyclades, 84004, Greece. Email: [email protected]. Website: https://almiraprassa.gr.

For privacy enquiries or requests, please contact the data controller using the email address above. No separate Data Protection Officer (DPO) has been identified as appointed.

2. Personal data we collect

Contact form: your full name, email address, telephone number if provided, and the contents of your message.

“Book Now” form: your full name, email, optional telephone number, preferred check-in and check-out dates, numbers of adults and children, and any additional information you choose to provide. This form sends an availability enquiry; it does not take online payments or automatically confirm a reservation.

When you browse the website, technical data such as IP address, access time, device/browser information and security events may be recorded by the web server and active WordPress security services.

Please do not include sensitive information, identity documents or payment card details in free-text fields unless separately requested through an appropriate process.

3. Purposes and legal bases

We use contact details to answer enquiries and manage the related correspondence. For general enquiries, processing may be based on our legitimate interest in responding to visitors (Article 6(1)(f) GDPR).

We process booking enquiries to check availability, provide prices and take steps requested by you before entering into a possible accommodation contract (Article 6(1)(b) GDPR). For confirmed bookings, contract performance and compliance with legal duties, including tax obligations, may also apply (Article 6(1)(b) and (c)).

Website security, spam prevention and prevention of misuse may rely on legitimate interests in operating a secure website (Article 6(1)(f)). Prior consent is requested for non-essential cookies and similar technologies where legally required.

We do not use information submitted through these forms for newsletters or unsolicited promotional communications without an appropriate legal basis.

4. Forms, correspondence and recipients

Information submitted through the forms is stored in WordPress Elementor Submissions and sent to the accommodation contact email address. Access is limited to authorised people who need the information to handle your request.

Website hosting and email services are provided by Hawk Host (https://www.hawkhost.com/). In providing these services, the provider may process information transmitted or stored through the website and email accounts, as well as technical server logs. Technical maintenance, anti-spam/security and backup service providers may also process data to the extent necessary for their services. The role of each provider and any transfers outside the EEA are assessed in light of the services used, processing locations and relevant contractual safeguards.

Planned use of Cloudflare (CDN and website protection): Cloudflare is intended to be enabled at a later stage and is not described here as an already active service. Once enabled, requests to access the website may pass through Cloudflare’s network, which may process technical data such as IP addresses, connection details, requested URLs, device/browser information and security-event data in order to deliver the website efficiently and securely, manage traffic and mitigate malicious requests. The exact configuration and relevant data flows will be verified before the service goes live.

The Hawk Host server is believed to be located in London, United Kingdom, but the server location and the geographical storage location of email have not yet been confirmed. The likely hosting location does not mean that every service provider processes data exclusively in that location.

If an enquiry leads to a confirmed booking, further information may be required through a separate process with appropriate notice at collection. Information may also be disclosed to competent authorities where legally required. We do not sell visitors’ personal data.

5. Cookies and consent choices

The website uses GDPR Cookie Consent / CookieYes to record and manage cookie choices and WPML to remember language preferences. These functions support the website’s technical operation and visitor preferences.

The cookie banner allows you to select non-essential cookie categories and, where provided by the available cookie settings control, revise your choices. The specific cookie names, lifetimes and categories are listed in the cookie information provided on the website.

During our most recent tests, before Google Analytics was activated, no _ga cookies appeared during a fresh visit or after rejecting or accepting cookies. Google Analytics is not described here as an active service. If activated later, the notice and consent settings will be reviewed before it is used.

Once Cloudflare has been activated, technical security cookies such as __cf_bm or cf_clearance may be used, but only if the relevant protection features are enabled. The actual cookie names, purposes and durations will be documented after a new CookieYes audit. Using Cloudflare does not, by itself, mean that analytics or advertising cookies are enabled.

6. Google Maps and third-party reviews

On the Contact page, an information panel appears instead of Google Maps. The map loads only if you select “Show Map / Εμφάνιση χάρτη”. Loading the map connects your browser to Google and may disclose technical data, including your IP address and browser information, and enable technologies controlled by Google.

The website displays reviews originating from Airbnb, Booking.com and Google using Trustindex. To display these reviews, external JavaScript is loaded from cdn.trustindex.io, together with certain images and icons hosted by Trustindex and other providers. These external connections take place when the page loads and may disclose technical information to those providers.

This disclosure does not mean that every external service installs tracking cookies. Third-party providers have their own privacy policies for processing they carry out for their own purposes.

7. Transfers outside the European Economic Area

Some technology and storage services, including services provided by Google or other third parties, may involve access to or transfers of personal data outside the European Economic Area. Where such transfers occur, a lawful transfer mechanism under the GDPR must apply, such as an adequacy decision or appropriate safeguards.

The planned use of Cloudflare may involve routing or processing technical data through infrastructure located in different countries. Accordingly, even if Hawk Host hosting in London is confirmed, this will not be taken to mean that personal data is stored or processed exclusively in the United Kingdom. Before activation, the relevant contractual terms, applicable transfer safeguards and Cloudflare configuration will be reviewed.

The specific providers, data flows and safeguards are reviewed periodically in light of the website services actually in use.

8. Retention and deletion

Ordinary contact messages and booking enquiries that do not result in a confirmed reservation are retained for up to twelve (12) months after the last relevant communication, both in Elementor Submissions and in the related email correspondence. The records are periodically reviewed and deleted unless there is a specific lawful reason for further retention.

When an enquiry results in a confirmed booking, the necessary information is retained as long as required for the booking, compliance with statutory obligations, or the establishment, exercise or defence of legal claims.

For security, weekly backups of files and the database are created using UpdraftPlus and stored in a protected Google Drive location. Up to three scheduled backups are retained for each category, with a typical replacement cycle of approximately 21 days. Deleting data from live systems does not immediately remove it from existing backups; it is removed as backups rotate out.

Technical logs and security events are kept only as long as required for their purposes and in accordance with the relevant services’ actual settings, subject to periodic review.

9. Data security

We apply technical and organisational safeguards appropriate to the relevant risks, including restricted account access, login protection, WordPress/plugin updates, security services and backups.

No internet transmission or storage method is completely secure. Personal data breaches are assessed and handled in accordance with GDPR requirements.

10. Your rights

Subject to GDPR conditions, you may request access, correction, erasure, restriction of processing and, where applicable, data portability. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting processing already lawfully carried out.

To exercise your rights, email [email protected]. We normally respond within one month, with a lawful extension of up to two additional months where necessary. Rights requests are generally free of charge; proportionate proof of identity may be requested when necessary.

You may lodge a complaint with the Hellenic Data Protection Authority (https://www.dpa.gr).

11. External links and updates

The website may link to third-party sites governed by their own privacy policies.

This Policy may be updated when our data processing activities or legal requirements change. The current version and its last-updated date will be published on this website.

Last updated: 23 October 2026