Privacy Policy

The data controller is Damari Luxury Villas, Kechria, Skiathos, Greece. Contact us about anything on this page at damariskiathos@gmail.com or +30 698 0560 280.

We process personal data in line with the EU General Data Protection Regulation (GDPR) and Greek data protection law.

• Enquiries and contact forms. Your name, email address, phone number, preferred dates, party size and anything you write in your message. We use this to reply to you. Legal basis: taking steps at your request before a contract.
• Bookings. The details above plus the names of everyone in your party, your home address, payment details and, at check-in, the photo ID that Greek law requires us to record for every guest. We use this to manage and fulfil your booking, take payment and meet our legal obligations. Legal basis: performance of a contract and legal obligation.
• Guides and downloads. If you request one of our free guides we ask for your email address so we can send it, and we may send occasional emails about the villas. You can unsubscribe at any time using the link in every email. Legal basis: consent.
• Website usage. Anonymised analytics data such as pages visited, approximate location, device and browser, described in section 04. Legal basis: our legitimate interest in understanding how the site is used.

We do not collect any special category data and we do not sell personal data to anyone.

We only share your data with services we need to run the villas:

• Payment providers, to process deposits and balances. We never store full card details ourselves.
• Email and hosting providers that deliver our website and messages.
• Google Analytics, for the anonymised usage data described below.
• Booking platforms such as Booking.com, if you booked through them, to the extent needed to manage that booking.
• Greek authorities, where the law requires us to record and report guest identity details.

Some of these providers are based outside the European Economic Area. Where that is the case they rely on the European Commission's standard contractual clauses or an adequacy decision.

This website uses Google Analytics to understand which pages are visited and how people find us. Google Analytics sets cookies and collects your IP address, which is anonymised, along with device and browser information. We do not use this data to identify you personally.

We also set a single functional cookie that remembers your language choice. You can block or delete cookies in your browser settings at any time. The site will still work, though it may not remember your language.

Pages that embed a map or a booking widget from a third party may set that third party's cookies when they load. Their privacy policies apply to that data.

• Enquiries that do not lead to a booking: up to 12 months after our last contact.
• Booking records, invoices and guest registration details: as long as Greek tax and tourism law requires, which is generally 5 to 10 years.
• Marketing email addresses: until you unsubscribe or 3 years after your last interaction with us.
• Analytics data: retained by Google Analytics for a maximum of 14 months.

Under the GDPR you can ask us at any time to:

• tell you what personal data we hold about you and give you a copy;
• correct anything that is wrong or incomplete;
• delete your data, where we no longer need to keep it;
• restrict or object to how we use it;
• send you your data in a portable format;
• withdraw consent, where consent is the basis we rely on.

Email damariskiathos@gmail.com and we will respond within one month. If you are not happy with our answer you can complain to the Hellenic Data Protection Authority (www.dpa.gr) or the supervisory authority in your own country.

Our website is served over HTTPS. Booking and payment information is handled by established providers with their own security controls, and access to guest records is limited to the people who need it to look after your stay.

We may update this policy from time to time. The date at the top shows the current version. Our booking terms are set out separately in the Terms of Service.