Privacy Policy

The controller of your personal data is the host of the property, John & Family — Archontiko Chios – Traditional Mansion, Βασιλείου Κουτσουράδη 48, Θυμιανά, Χίος 82100, Ελλάδα.

Contact for data matters: karsampasg@gmail.com · 6986189698.

Bookings and booking requests: first name, surname, email, phone, stay dates, number of adults, children's ages, your message, your language, the booking reference, and when you accepted the terms together with their version.

Payments: the amounts and dates of transfers recorded by the host, and the payment or refund status. We do not collect card details; payment is made by bank transfer from your own bank.

Contact messages: name, email, optional phone and your message. Reviews: first name, rating, comment and language.

Security data: to protect against abuse we keep only an irreversible hashed form of the IP address for bookings, requests, messages and reviews — not the address itself.

Visit statistics, only if you allow them: pages visited, where the visit came from (e.g. search, social media, campaign), device type, language and random visitor/session identifiers. They are not linked to your name.

We do not ask for your country, ID details or other data not needed for the booking.

Checking availability, creating and managing your booking, sending booking emails (payment instructions, confirmation, changes, cancellation) and arrival/stay information: to perform the contract or take steps at your request before entering into it.

Keeping accounting, tax and other records required for short-term rentals: legal obligation.

Answering messages, managing reviews, website security and preventing fraud or abuse: legitimate interest in operating the property and website safely.

Visit statistics and embedded Google maps: only with your consent, which you can withdraw at any time via “Cookie settings”.

We do not send marketing messages and do not subscribe you to any newsletter.

We may use your phone number to send you practical stay information by hand (e.g. arrival, access) via call, SMS, WhatsApp or Viber. Nothing is sent automatically and it is not advertising. These apps operate under their own privacy terms.

Data is stored on the website's hosting and database infrastructure (Lovable Cloud), and booking emails are sent through the same platform's email service. These providers process data only on our behalf.

Booking.com and Airbnb receive only which dates are booked, with no guest details. If you show the map, Google receives technical data from your device. We do not sell data. We may share it with public authorities only when the law requires it.

Some infrastructure providers may process data outside the European Economic Area. In that case the transfer relies on the safeguards provided by the GDPR, such as an adequacy decision or Standard Contractual Clauses.

Booking and payment details are kept for as long as the stay requires and afterwards for the period required by tax and accounting law. Requests that did not lead to a booking and contact messages are kept while useful for our communication and deleted when no longer needed. Published reviews remain while they are displayed or until you ask for their removal. Statistics are used only for aggregate analysis and are not kept longer than necessary.

Reviews sent through the website are not published automatically; they appear only after the host checks and approves them, and only your first name is shown.

For children accompanying a booking we ask only for their age, as needed for capacity and organising the stay. Bookings are made by an adult.

We apply reasonable technical and organisational measures to protect data, such as encrypted connections and access limited to authorised people.

You have the right of access, correction, erasure (where no retention obligation applies), restriction, objection to processing based on legitimate interest, portability of the data you gave us, and withdrawal of consent where processing relies on it. For any request, contact us using the details above.

You may also lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr) or the competent authority in your country.