Privacy Notice

Prologue: At the Apostolata Island Resort and Spa we collect and process your personal data in compliance with the EU Regulation 2016/679 as well as the applicable Greek data protection legislation.

Data Controller Details: Xydias Techniki S.A. with Tax Number: 099789185, Tax Office: F.A.E. Piraeus, Address: Skala, 28086, Kefalonia.

Collection of personal data – categories of data – purpose of processing: Your personal data (Name, Surname, Identity / passport, interests, habits, bank accounts, credit cards, electronic communications data, contact details, etc.) are subject to automated and non-automated processing by our authorized staff, in order to handle your booking and to facilitate your stay at the hotel. Your special (“sensitive”) data (medical data) can also be used to meet your needs, in cases where you inform us about it, e.g., for any medical issue, disability or other request related to your health or diet, or for the purpose of providing wellness and care services during your stay or visit to our hotel facilities.

Legal Basis for processing your Personal Data: Τhe collection and processing of personal data necessary to make a reservation and to facilitate your hotel stay, is based on the legal ground “necessity for the performance of a contract” (Article 6 par. 1 (b) GDPR).

Legal basis for the processing of the Special Categories of your Personal Data: The collection and processing of your “sensitive” personal data is based on thelegal basis: “explicit consent of the data subject”(Article 9 par. 2 (a) GDPR).

Recipients of Personal Data: Apostolata Island Resort and Spa will transmit your personal data to collaborating third parties (data processors), only if this is necessary for the execution of our agreement with you, or to comply with a legal obligation.

Personal Data Retention:

1. 1. The Data Controller is entitled by the current legislation (Article 937 – Civil Code – Limitation) to keep the data concerning its clients, for twenty (20) years.

   2. The Data Controller is entitledby the current legislation (L.4174 / 2013 as amended by article 32 par.2 L.4646 / 2019 and is valid), to keep the details of the financial transactions with itsUnip@ss042021 customers, for a period of ten (10) years from the end of the year in which the deadline for submission of the tax declaration or the last tax declaration expires in case more than one declaration is foreseen.

Data Subject Rights: Regarding your personal data, you have the option of exercising the following rights: right of access, right of rectification, right of deletion, right of limitation of processing, right of data portability and right to object, by submitting a written request in person at the Apostolata Island Resort and Spa premises or by sending the request by post, or email with your authenticated signature. Apostolata Island Resort and Spa will respond to your request free of charge, without delay and in any case within one month of receipt of the request, except in exceptional circumstances, when that deadline can be extended by a further two months if necessary, taking into account the complexity of the request and the number of requests. We will inform you of any extension within one month of receipt of the request, as well as of the reasons for the delay. If it is not possible to meet your request, we will notify you without delay and at the latest within one month of receipt of the request for the reasons. You have the right to also contact the Personal Data Protection Authority: www.dpa.gr.

Data Protection Officer Details: MILTIADES N. KLONARIS & ASSOCIATES 1976 Address: 41 SOLONOS STR. 106 72 ATHENS, HELLAS TEL: (30) 2103604021 Fax: (30) 2103605208 E-mail: [email protected]

Privacy Policy: Our Privacy Policy (for detailed information on the processing of your personal data), as well as this Privacy Notice, are available on our web site https://www.apostolata.gr/, in which, any posted revised version, supersedes their paper version.