The Velanidies - Οι Βελανιδιές

Privacy Notice and Information for Data Subjects pursuant to Art. 13 and Art. 14 of the EU General Data
Protection Regulation.
This notice describes how we process your personal data.
If you book a villa or accommodation with ‘The Velanidies – Οι Βελανιδιές’ the controller is Samuel David
Brett Mercer Α.Φ.Μ. 168122717 Δ.Ο.Υ. ΚΩ.
The controller’s address is Αγια Μαρίνα, Ελτα Τθ 17, 85400 Λέρου. Please see “How do I get in touch with
you” below for contact details for specific matters.
Whenever you deal with The Velanidies – Οι Βελανιδιές, the ‘controller’ of your personal information will be
the individual with whom your information has been shared.
Where this policy refers to “we”, “our” or “us” or “The Velanidies – Οι Βελανιδιές” below, unless it mentions
otherwise, it’s referring to the controller of your personal information.
This notice applies to:
• Bookers;
• Guests;
• Visitors;
• Callers; and
• Other customers.
And anyone contacting, visiting or using our:
• Websites;
• Facebook sites
• LinkedIn sites
• Xing sites
• Newsletter
• Reservation Centre;
• Guest Relations Team; and
• premises.
Summary of the purposes for processing your personal data and the legal basis for doing so:
• We process personal data to make, amend and administer room bookings, provide hotel services,
process and store payment details and provide other products and services (such as meals and car
parking). We also deal with enquires, gather customer feedback, undertake market research and
direct marketing (including analysis to create profiles), in our legitimate interests to promote our
business and improve our service and delivery.
• When booking with us, we don’t ask for accessibility, dietary, health or other sensitive personal
data. If you (or someone on your behalf) do provide such information to us, please be aware we
may need to ask for your explicit consent. In some cases, it may be permissible for us to have such
data as it is in your vital interests that we do so.
• On our websites we use third party marketing and analytical cookies plus similar technologies are
included in our marketing emails, as explained in our Cookie Notice. You can reject and block
cookies in your browser settings.
• We monitor social media to respond to comments or complaints about our business and with the
permission of the platform owner we may reproduce your comments on our website, on the lawful
basis of our legitimate interests.
• In our legitimate interests, we also seek to prevent and detect crime as well as protect our business
and premises.
• In order to fulfil the above purposes:
◦ we disclose your personal data to payment providers, technology providers, insurers, and
other specialist professional and technical service providers and advisers, to manage your
bookings, arrange payments, and provide services.
◦ we may transfer your personal data outside the European Economic Area (the EU Member
States plus Iceland, Lichtenstein and Norway) and, where we do this, we will use
safeguards to protect your data.
• We keep your data to enable us to fulfil our contract with you or to provide services, where required
by law, to respond to a question or complaint, to obey rules about keeping records, to uphold or
protect contractual or legal rights or where it is in your or another party’s vital interests or our
legitimate interests. Where we process personal data on the basis of your consent, we will retain it
for as long as required for the specified purpose. We also keep your data in line with any statutory
limitation periods and for tax, legal or regulatory purposes.
Your rights
• Any consent(s) you give us may be withdrawn at any time.
• You have an absolute right to object to direct marketing (and any profiling for the purposes of direct
marketing) at any time.
• You also have the qualified right to:
◦ request access, rectify, and erase your personal data;
◦ object to processing for any purpose where we rely on our legitimate interests as the legal
basis;
◦ restrict processing; and
◦ supply or transfer your personal data in a portable format.
Where you exercise any of your rights, we will process your personal data to comply with your request in
accordance with our legal obligations.
• Where we use automated decision-making, you have the right to human intervention, to add a
statement, and to have the decision reviewed.
You have the right to lodge a complaint with any data protection supervisory authority, in particular, the one
of the country in which you are resident, work or in which your complaint arises. For the contact details of
the Information Commissioner details of all EU supervisory authorities can be found at http://ec.europa.eu/
newsroom/article29/item-detail.cfm?item_id=612080
We may provide additional information during the booking and check-in process and at other points at
which we collect your personal data.
If you wish to exercise your rights, please contact us by writing to contact@thevelanidies.com Then please
specify “Privacy” in the subject and please write your message.
We collect personal information when you book with us or request or use our services. This includes hotel
visits, using our websites, or corresponding with us. We may also receive personal data about you from
another source. This includes:
• Personal Identifiers – title, name, marital status, postal and email addresses, postcode, IP
addresses and contact telephone numbers. We may also collect the names of those who are part of
a group booking where necessary, and the age of children to meet your needs (e.g. to provide a cot)
and enable us to confirm any restrictions that may apply to a room booking;
• Business-to-Business Information – for corporate customers and corporate business leads and
contacts: job title, business address and business email address;
• Transaction Information – payment, reservation and booking details, including meals, beverages &
car parking;
• Newsletter – When registering for our newsletter, you provide us with your e-mail address, first
name and last name. We use this information exclusively to send you the newsletter. The data you
enter when registering for our newsletter will remain stored by us until you unsubscribe from our
newsletter. You can unsubscribe at any time via the link provided for this purpose in the newsletter
or by sending us a message to this effect. By unsubscribing, you object to the use of your email
address.
• Facebook Page Insights Data – In relation to our Facebook Pages, we may receive Insights Data
from Facebook, i.e. aggregated data that can help us to understand how visitors are engaging with
our Page, which may be based on personal data collected during your visit to our Page or its
contents. In relation to the processing of this personal data only, we are joint controllers with
Facebook Ireland Limited. Facebook Ireland Ltd has agreed to take primary responsibility under the
GDPR for the processing of Insights Data and to comply with all applicable obligations under the
GDPR with respect to the processing of Insights Data, so all requests and queries should be
addressed to Facebook Ireland Limited. The Page Insights Controller Addendum sets out our
respective responsibilities and is subject to the jurisdiction of the Irish Courts and the laws of
Ireland. The Irish Data Protection Commissioner is the lead supervisory authority; and
• Customer special requests and feedback including complaints – via call centres, emails and
online free text fields.
Third parties that we receive personal data from may include:
• Travel agents, booking agents, other agents, tour operators and schools;
• Corporate customers and public information sources such as Companies House or similar registers
in the jurisdictions of our operations;
• Comparison and review websites;
• Social networks;
• Car park operators;
• Business Account management operators;
• Market researchers;
• Marketing service providers and advertising technology providers;
• Government and law enforcement agencies;
• Other licensees in accordance with licensing requirements;
• Other hotel providers and other organisations as part of their contingency plans
How do we use your information, and what is the legal basis for this use?
• To fulfil a contract, or take steps linked to a contract. This is relevant when you want to make a
reservation with us; or receive other products and services from us such as meals and includes:
◦ making, amending or administering your booking;
◦ providing products and services requested by you;
◦ verifying your identity;
◦ processing payments;
◦ communicating with you;
◦ providing customer services, including managing complaints; and
◦ alerting you by text, email or phone in the event of an unplanned incident, as a result of
which we have to make alternative arrangements under our contract (or where we believe it
is in your vital interests).
If the information we request is not provided, we may not be able to enter into or comply with a contract or
our legal obligations.
In our legitimate interests regarding the conduct of our business, in particular:
Ensuring customer satisfaction, maintaining goodwill and dispute resolution
• we provide technical support and investigate and process any complaints about our website or our
products or services, and to maintain appropriate records for internal administrative purposes. We
reserve the right to request evidence to support any claims or complaints.
To protect our business and prevent fraud
• monitor, test and control the performance and security of our systems, networks, processes and
premises to prevent and detect fraud and protect our business; and
• if you provide a credit or debit card as payment, we use third parties to check the validity of your
bank account or card details in order to prevent fraud.
For business performance and improvement
• monitor and record CCTV, call centre communications, including incoming and outgoing calls and
emails for staff training, quality improvement purposes and establishing facts; and
• analyse transactions to enable us to improve our services and products and plan for our business.
Safety & Security of our Guests and Employees
• to protect premises and for security purposes including information recorded from CCTV;
• to monitor food safety and hygiene;
• to obtain statements from witnesses to accidents and other incidents; and
• for the detection and prevention of crime.
Developing and Marketing Products and Services
• for raising brand awareness;
• to understand you better as a customer by analysing your transactions and other information you
provide to us or which we learn through your interactions with us;
• for marketing (including creating profiles), competitions and promotions by post, email, text and
push notification where permitted to do so by law;
• we may use your data to provide personalised promotional offers to you where permitted to do so
by law;
• we may also use your data to provide you with personalised promotional offers on selected partner
websites (for example, you might see an advertisement for our products on a partner site such as
Facebook and Google);
• we also share some of your information with marketing service and ad technology providers and
digital marketing networks, such as Facebook, Google, Adobe and The Trade Desk, to present
advertisements that might interest you.
For example we may transfer information about you to such providers so that they may recognise your
devices and deliver interest-based content and advertisements to you. The information may include your
name, email, device ID, or other identifier in encrypted form. The providers may process the information in
hashed form. These providers may collect additional information from you, such as your IP address and
information about your browser or operating system; may combine information about you with information
from other companies in data sharing cooperatives in which we participate; and may place or recognise
their own unique cookie on your browser. These cookies may contain demographic or other data in deidentified
form;
• for monitoring the use of our websites and apps in order to improve their performance and optimise
our media spend;
• we use personal data of some individuals to invite them to provide feedback or take part in market
research; and
• for developing corporate business and applying rates.
Legal and Regulatory purposes
• in connection with legal claims, compliance, regulatory and investigative purposes as necessary
(including disclosure of such information in connection with claims, legal process or litigation);
• to comply with health and safety legislation, including accounting for the number of individuals on
our premises and logging accidents;
• to prevent, investigate and/or report suspected fraud, terrorism, security incidents or other crime, in
accordance with applicable law; and
• to anonymise personal data when we no longer need to process it.
Where we have relied on legitimate interests as the lawful basis for processing, we have carried out a
balancing test. Please email contact@thevelanidies.com for further information.
Where you give us consent:
• we will send you emails, texts and push notifications (including newsletters) in relation to products
and services provided by us, or by our named affiliates and carefully selected partners;
• when you use our websites or apps, we place cookies and use similar technologies on your
computer, mobile or other device and we use such technologies such as pixel tags and web
beacons in marketing emails and communications (also see our Cookie Notice);
• to participate in competitions we run and, if you win, to use your information for promotional
purposes;
• we will process health information, such as dietary, accessibility, and allergy information you or a
party on your behalf provides to us (we may also be able to do this where it is in your vital interests);
• when you make a donation to a charity, we will process your payment for this purpose; and
• on other occasions where we ask you for consent, we will use the personal data for the purpose
which we explain at that time.
You have the right to withdraw consent at any time.
For purposes which are required by law:
• to record the identity of guests on check-in. Guests will be asked to complete a registration form
and provide their identity card/passport details, to comply with the Greek Tax Law in order to
explain the source of income for bookings. Acceptable forms of identification are: a passport,
driving licence, ID card or police warrant card.
• in response to requests by government, law enforcement authorities, or intelligence services and
court orders;
• if required to comply with health and safety legislation to which we are subject;
• we may be required to share information with other licensees in accordance with local licensing
requirements; and
• responding to a rights request under data protection legislation.
To protect your vital interests or those of another person:
• disclosing your personal data to the emergency services where we believe it is necessary to protect
your vital interests or the vital interest of another person; and
• where you (or a person acting on your behalf) provide us with dietary or other personal health data
such as allergies.
Other recipients that we disclose, transfer or share your personal data with.
Service Providers
For some activities The Velanidies – Οι Βελανιδιές uses third party service providers including where we are
joint controllers. Your personal data will be disclosed to such organisations where this is necessary to
provide a service to you, or where it is in our legitimate interests. You will be informed separately if a third
party is operating as a joint controller with The Velanidies – Οι Βελανιδιές. Third parties are used to:
• administer bookings;
• provide Wi-Fi;
• undertake customer feedback surveys;
• provide analytics;
• send promotional offers;
• provide personalised advertisements;
• provide insurance;
• provide IT development, support, maintenance and hosting, including the provision of applications
and website hosting;
• process payments to enable you to pay by credit or debit card;
• provide credit checks and fraud checks; and
• provide CCTV systems and maintenance.
Other parties
Personal data may be shared with regulators, government authorities and/or law enforcement officials for
the prevention or detection of crime, if required by law or if required for a legal or contractual claim or
regulatory purposes.
We disclose your personal data to payment providers, technology providers, insurers, and other specialist
professional and technical advisers, to manage your bookings, arrange payments, and provide services.
With your consent, we will also disclose your personal data to Ombudsman services and Citizens’ Advice.
International transfers
Sometimes we may need to send or store your data outside of the European Economic Area (the EU plus
Iceland, Lichtenstein and Norway) (‘EEA’). For example, to follow your instructions, comply with a legal duty
or to work with or receive services from our service providers who we use to help run your accounts and
our services.
If we do transfer information outside of the EEA, we will make sure that it is protected by using one of these
safeguards:
• Transfer it to a non-EEA country with privacy laws that give the same protection as the EEA. Some
countries have been deemed adequate by the EU.
• Put in place a contract with the recipient that means they must protect it to the same standards as
the EEA or use other mechanisms and measures to achieve adequate protection. We also may use
the Standard Contractual Clauses published by the EU.
• Transfer it to organisations that are part of Privacy Shield. This is a framework that sets privacy
standards for data sent between EU countries and the US. It makes sure those standards are
similar to what is used within the EEA.
• Binding corporate rules. These are internal rules adopted by group companies to allow international
transfers of personal data to entities within the same corporate group located in countries which do
not provide an adequate level of protection.
Significant automated decision-making
Like many businesses The Velanidies – Οι Βελανιδιές use business rules on financial and other information
in order to detect and prevent fraud. When used, these may identify a risk and, as a result, a particular
transaction may not be processed.
What rights do I have?
Withdrawing consent
Wherever The Velanidies – Οι Βελανιδιές rely on your consent, you will always and at any time be able to
withdraw that consent with effect for the future. We will continue to process your personal data for other
purposes on a different lawful basis (other than consent) where that applies.
Objecting to data processing including direct
You have the right to object, on grounds relating to your particular situation, at any time to processing of
your personal data which is conducted on the legitimate interest basis or which is necessary for the
performance of a task carried out in the public interest or in the exercise of official authority vested in the
controller, including profiling based on those provisions. In such case, we will no longer process your
personal data unless we can demonstrates compelling legitimate grounds for the processing which
overrides your interests, rights and freedoms or that the processing serves the establishment, exercise or
defence of legal claims.
Where personal data are processed for direct marketing purposes, you have an absolute right to opt-out
of direct marketing, and any profiling we carry out for direct marketing, at any time and without any
limitation. You can do this by clicking on the ‘unsubscribe’ link located in the footer of every marketing email
or text or by contacting us (see the contact details provided below). Where you objected to our processing
for direct marketing purposes, we will no longer process your personal data for such purposes.
Where you have a relationship with another organisation, such as a social media platform like Facebook, we
may ask them to send marketing to you, subject to your consent. If you object to receiving marketing from
us we will stop marketing to you. However, please contact the organisation directly if you want to withdraw
your consent to such organisation marketing to you.
Other qualified rights
• You have the right to know whether or not we process information about you and to access that
information.
• You have the right to update, correct and complete any information we hold about you which is
inaccurate or incomplete.
• You have the right to obtain the personal data you provide to us for a contract or with your consent
in a commonly used, structured, and machine-readable format, and to ask us to share (port) this
personal data to another controller.
• You have the right to ask that we erase or restrict (stop active) processing of your personal data.
These rights may be limited, for example if fulfilling your request would reveal personal data about another
person or you ask us to erase information which we are required by law to Relevant exemptions are also
included within the data protection laws that apply in Greece. We will inform you of relevant exemptions we
rely upon when responding to any request you make.
To exercise any of these rights, you can get in touch with us using the details set out below.
If you have concerns, you have the right to lodge a complaint with any data protection supervisory
authority, in particular, the one of the country in which you are resident, work or in which your complaint
arises. For the contact details of the Information Commissioner details of all EU supervisory authorities can
be found at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080
How long will you retain my personal data?
We keep your data to enable us to fulfil our contract with you or to provide services, where required by law,
to respond to a question or complaint, to obey rules about keeping records, to uphold or protect
contractual or legal rights or where it is in your or another party’s vital interests or our legitimate interests.
Where we process personal data on the basis of your consent, we will retain it only for as long as required
for the specified purpose. We also keep your data in line with any statutory limitation periods and for tax,
legal or regulatory purposes.
The period for which we will retain your personal data depends on the purposes for which we are
processing it and where the same personal data is processed for two or more purposes, we will retain it for
the longest period. For example, we retain:
• CCTV recording for up to 48 hours in Greece;
• for up to 25 months from your last stay, any personal data we process for managing your bookings;
• for up to 36 months after it is resolved, any personal data we process in relation to queries,
complaints or feedback relating to your booking;
• until a period of 3 years has elapsed since your last interaction with us, personal data we process
for marketing (including profiling) purposes, unless you ask us to stop sending electronic direct
marketing, in which case we will act on your request, and then keep a record of your request
indefinitely;
• for 3 years in the case of accident report forms (or for accidents relating to a child, for 3 years after
the child’s 18th birthday);
• for up to 10 years in Greece, financial and transactional data for the purposes of insights and
analytics; and
• for up to 10 years in Greece, financial information for accounting, business reporting, analysis and
audit purposes.
In any of the cases mentioned above, The Velanidies – Οι Βελανιδιές may retain the personal data for longer,
if it is required for the purposes of any internal or external investigation or litigation. In these cases, it may
be retained until the matter is resolved. We may keep your data for longer in line with any limitation periods,
or if we cannot delete it, e.g. for tax, legal or regulatory reasons.
You have the qualified right to request deletion of your personal data at any time, or we may choose or be
obliged to erase your personal data earlier, for example, if we no longer need to process it.
When you call up our web pages, you transmit data to our web server via your Internet browser (for
technical reasons). The following data is recorded during an ongoing connection for communication
between your Internet browser and our web server:
• Date and time of the request
• Name of the requested file
• Page from which the file was requested
• Access status (file transferred, file not found, etc.)
• Web browser and operating system used
• complete IP address of the requesting computer
• transferred data volume.
For reasons of technical security, in particular to defend against attempts to attack our web server, this data
is stored by us for a short time. It is not possible for us to draw conclusions about individual persons on the
basis of this data. After seven days at the latest, the data is anonymised by shortening the IP address at
domain level, so that it is no longer possible to establish a link to individual users. In anonymised form, the
data is also processed for statistical purposes; it is not compared with other data sets or passed on to third
parties, even in excerpts.
Cookies and other similar technologies we use.
Information about the first and third parties cookies and other technologies we use is available in our
Cookie Notice.
How do I get in touch with you?
Queries and exercise of rights
If you have any queries or want to exercise any of your rights please contact us at
contact@thevelanidies.com Then please write ‘Privacy’ in the subject. and then write your message.
General data protection queries
If you have any questions, suggestions or complaints about the processing of your personal information in
the Greece, please contact us by writing to:
The Velanidies – Οι Βελανιδιές, Κριθώνι 1, Τθ 17 Αγία Μαρίνα Λερου, Λέρος 85400
If you have any questions, suggestions or complaints about the processing of your personal information,
please contact our data protection officer in Greece:
contact@thevelanidies.com
This Privacy Notice was last updated on 8th June 2023. Any changes to this Privacy Notice will be
communicated on our website https://thevelanidies.com/privacynotice