At Dragonfly Villas we respect your privacy. This policy explains what personal data we collect when you visit our website, contact us, request an offer, book or stay with us, how we use it and what rights you have under the EU General Data Protection Regulation (GDPR) and Greek law.
1. Who we are
The data controller is Dragonfly Villas, [Company legal name], Kamari, Santorini, Cyclades, Greece 84700, PO Box 5301 (VAT number: [VAT number]). You can contact us about privacy at any time by email at info@dragonflyvillas.com or by phone on +30 698 741 6090.
2. What data we collect
- Contact form: your name, email address, phone number, subject and message.
- Offer requests: your travel dates, preferred villa, number of adults, children and infants, name, email address, mobile number, message and any extra services you are interested in.
- Online check-in: your check-in and check-out dates, reservation code, name, number of guests, arrival time, email address, mobile number, the services you request, and a copy of the front and back of your ID card or passport.
- Messages and calls: what you share with us by email, phone, WhatsApp, Viber or iMessage.
- During your stay: details needed to look after you, such as dietary preferences for breakfast or a special occasion you tell us about.
- Website visits: basic technical data such as your IP address, browser type and the pages you visit, which our hosting provider records for security and to keep the site working.
3. Why we use your data and our legal basis
- To answer your enquiries and prepare offers – steps you ask us to take before a booking (GDPR Art. 6(1)(b)).
- To manage your booking and stay, including breakfast, transfers, rentals and tours you request – performance of our contract with you (Art. 6(1)(b)).
- To register guests and keep accounting and tax records, as Greek law requires of hotels – legal obligation (Art. 6(1)(c)).
- To keep our website and systems secure and improve our service – our legitimate interests (Art. 6(1)(f)).
- Anything else – only with your consent, which you can withdraw at any time (Art. 6(1)(a)).
We do not sell your personal data, and we do not use it for automated decision-making or profiling.
4. Your ID or passport
We ask for a copy of your ID card or passport only to complete check-in as required by Greek law. It is stored securely, seen only by the staff who need it, and deleted as soon as we are no longer legally required to keep it.
5. Who we share your data with
- Service providers who help us run the website, email and forms, and who may only use your data on our instructions.
- Local partners such as transfer, car or scooter rental and tour companies – only the details they need, and only when you ask us to arrange one of their services.
- Public authorities, when Greek law requires us to provide guest information.
6. Third-party services on our website
- Google Analytics: only if you accept analytics cookies – see section 7.
- Google Fonts: our pages load fonts from Google, which receives your IP address when you visit.
- Google Maps: the map on our contact page is provided by Google, which may set cookies and collect data under its own privacy policy.
- Social media: links to our Facebook and Instagram pages take you to those sites, which have their own privacy policies.
Some of these providers may process data outside the European Economic Area. Where they do, they use safeguards approved by the European Commission, such as Standard Contractual Clauses or the EU–US Data Privacy Framework.
7. Cookies and Google Analytics
With your consent, we use Google Analytics (provided by Google Ireland Limited) to understand how visitors use our website – for example which pages are visited and how people find us – so we can improve it. Google Analytics sets cookies (named _ga and _ga_…, kept for up to 2 years) and receives information such as the pages you view, your device and browser type, and your approximate location. It is not used for advertising, and we do not use it to identify you personally.
Google Analytics only runs if you click “Accept” in the cookie banner. If you click “Decline”, it is not loaded and no analytics cookies are set. You can change your choice at any time with the “Cookie settings” link at the bottom of every page. Your choice itself is remembered in your browser’s local storage, which does not track you.
The embedded Google Map on the contact page may also set cookies under Google’s own privacy policy. We do not use any other tracking or advertising cookies.
8. How long we keep your data
- Enquiries and offer requests that do not lead to a booking: only as long as needed to answer you, and then deleted.
- Booking, guest and invoicing records: for the period required by Greek tax and tourism law.
- ID copies: only as long as the law requires for guest registration.
- Website logs: for a short period, for security purposes.
9. Your rights
You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable format, and to withdraw your consent at any time. To use any of these rights, email info@dragonflyvillas.com and we will reply within one month.
You also have the right to complain to the Hellenic Data Protection Authority (www.dpa.gr).
10. How we protect your data
We use appropriate technical and organisational measures to protect your data, including secure (HTTPS) connections, limited staff access and secure storage of ID documents.
11. Children
Our website is not aimed at children. Details of children staying with us are provided by their parents or guardians, and are used only for the booking.
12. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed.