Privacy Policy

1. Who we are

This privacy policy applies to the Villa Koumos website, villakoumos.com, and to enquiries and direct bookings for Villa Koumos in Gavalochori, Crete.

Villa Koumos Crete Holidays is responsible for deciding how the personal information covered by this policy is used. This is sometimes described as being the data controller.

For privacy enquiries, please email holidays@villakoumos.com or use our contact page.

We handle personal information in accordance with applicable data-protection legislation, including the UK Data Protection Act 2018, the UK GDPR and, where applicable, the EU GDPR.

2. Information we collect

When you make an enquiry or booking

Depending on how you contact or book with us, we may collect:

• Your name and postal address
• Your email address and telephone number
• Your arrival and departure dates
• The number and names of guests in your party
• Payment and transaction information
• Arrival information, such as flight details
• Requests or information you provide about your stay
• Copies of correspondence relating to your enquiry or booking

If you book through an external travel website, such as Booking.com or Airbnb, we receive the information that the booking platform makes available to us. The platform also processes information under its own privacy policy.

When you use our website

We may collect limited technical information, including:

• Your IP address
• Browser and device type
• Operating system
• Pages visited and links selected
• The approximate location from which the site was accessed
• The website or search engine that referred you to us
• Cookie preferences and consent records

This information helps us maintain the website, understand how it is used and improve the experience offered to visitors.

Contact forms and email

If you contact us, we collect the details entered into the form or email, together with any other information you choose to provide. Our website may also record the date, time and IP address associated with a form submission for security and spam-prevention purposes.

Please do not send sensitive personal or financial information through an ordinary contact form or unencrypted email unless we have specifically asked you to do so.

3. How we use your information

We use personal information to:

• Respond to enquiries and availability requests
• Set up, administer and confirm reservations
• Take and record payments
• Send booking, arrival and departure information
• Provide services and assistance during a stay
• Meet accounting, taxation and legal requirements
• Prevent fraud, spam and misuse of the website
• Maintain, secure and improve the website
• Manage complaints, cancellations or legal claims

We do not currently operate a general marketing mailing list. We will not add guests to a marketing list merely because they have made an enquiry or booking.

4. Our lawful bases

Data-protection law requires us to have a valid reason for processing personal information. The lawful basis depends on why the information is being used.

Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that took place before consent was withdrawn.

5. Sharing your information

We do not sell or rent personal information. We may share information only when it is reasonably necessary to operate the website, administer a booking, provide your stay or meet a legal obligation.

Recipients may include:

• Website hosting, maintenance, security and email providers
• Booking and payment-service providers
• Online travel agencies through which a booking is made
• Professional advisers, accountants or insurers
• Housekeeping or local support staff where information is needed to prepare for or support your stay
• Government, taxation, regulatory or law-enforcement authorities where disclosure is legally required

Our principal technology providers currently include our website host, 3001 Web; Microsoft, which provides our business email service; and Google, where its mapping or analytics services are used. These providers process information under their own terms and privacy policies.

You can read the relevant provider policies here: Google Privacy Policy, Microsoft Privacy Statement and 3001 Web Privacy Policy.

6. International data transfers

Villa Koumos is located in Greece and the business uses service providers that may operate in the United Kingdom, European Economic Area or other countries. Consequently, personal information may be accessed or processed outside the country in which you live.

Where applicable, we rely on recognised safeguards for international transfers, such as an adequacy decision, approved contractual terms or another legally permitted transfer mechanism.

7. How long information is kept

We retain information only for as long as it is reasonably needed for the purpose for which it was collected, including any legal, accounting, taxation or reporting requirements.

• Booking and payment records: retained for the period required by applicable accounting and taxation law, normally for at least five years after the relevant reporting period.
• Enquiries and correspondence: retained while the enquiry is active and afterwards where needed to maintain an appropriate business record or deal with a claim.
• Email contacts: removed when no longer required or when you make a valid request for deletion, unless there is a legal reason to keep the information.
• Website and analytics information: retained according to the settings applied within the relevant website, consent or analytics service.

Some information may be retained for longer where it is needed to establish, exercise or defend a legal claim. Information that is no longer needed will be deleted, anonymised or securely archived.

8. How we protect your information

We use reasonable technical and organisational safeguards designed to protect personal information against loss, unauthorised access, disclosure or alteration.

These measures include, where appropriate:

• Encrypted connections between your browser and our website
• Access controls and password protection
• Website firewalls and security monitoring
• Software and security updates
• Restricted access to booking and business records
• Use of established hosting, email and payment providers

No internet transmission or electronic storage system can be guaranteed to be completely secure. If we become aware of a personal-data breach, we will assess it and notify the appropriate regulator and affected individuals where the law requires us to do so.

9. Cookies and analytics

Cookies are small text files placed on a device when a website is visited. Some cookies are necessary for the website to function. Others help us understand website use, remember preferences or provide third-party features.

Non-essential cookies are used only in accordance with the choices available through our cookie notice. You can change those choices at any time.

We may use Google Analytics or similar services to understand matters such as visitor numbers, popular pages, device types and general navigation through the site. Where required, analytics will not be activated until permission has been provided.

You can also restrict or delete cookies through your browser settings. Blocking essential cookies may prevent parts of the website from operating correctly.

10. Your data-protection rights

Depending on the circumstances and the law that applies, you may have the right to:

• Be informed about how your information is used
• Request access to the personal information we hold about you
• Ask us to correct inaccurate or incomplete information
• Ask us to delete information in certain circumstances
• Request that processing be restricted
• Object to certain uses of your information
• Receive certain information in a portable format
• Withdraw consent where processing depends on consent
• Object to a decision based solely on automated processing where that decision has a significant effect

These rights are not absolute. For example, we may need to retain booking information to comply with tax law or deal with a legal claim.

To make a request, email holidays@villakoumos.com. We may ask for reasonable evidence of identity before releasing or changing personal information. We will normally respond within one month, subject to any lawful extension.

11. Questions and complaints

Please contact us first if you have a question or concern about how we use your information. We will investigate and do our best to resolve the matter.

You also have the right to complain to the UK Information Commissioner’s Office or, where the EU GDPR applies, an appropriate data-protection authority in the European Economic Area.

Information about making a UK complaint is available from the Information Commissioner’s Office .

12. Changes to this policy

We may update this policy to reflect changes to the website, our booking arrangements, service providers or applicable law. The latest version will be published on this page, with its revision date shown near the beginning.