Privacy Policy

Last updated: 19 October 2026

This policy explains what happens to your personal data when you visit cozykamilari.gr or send us an enquiry. In short: we use your details only to answer you and to arrange your stay. The website has no user accounts, no newsletter, no analytics, no advertising and no tracking cookies, and it does not store your enquiry.

Who is responsible

The controller for your personal data is Spyridakis Vangelis, owner of Gina’s and Tanya’s Cozy Houses, Kamilari, South Crete, Greece. Email: [email protected], telephone: +30 6947 800301.

Enquiries through the website

When you send the enquiry form, we receive the house you are interested in, your arrival and departure dates, the number of adults and children, your name, your email address, your telephone or WhatsApp number (optional), your message, the language of the page and the address of the page you sent it from.

The website sends these details by email to Vangelis, with your email address as the reply address, so that he can answer you directly. The website does not save your enquiry in its database.

To stop automated abuse, the website keeps a one-way coded (hashed) form of your IP address for one minute, so that only one enquiry per minute can be sent from the same connection. It is deleted automatically after that minute.

We use your details to answer your enquiry and, if you wish, to prepare and manage your booking. The legal basis is Article 6(1)(b) GDPR (steps taken at your request before entering into a contract). For general questions that are not about a stay, and for the abuse protection, the legal basis is our legitimate interest in answering messages and keeping the form usable (Article 6(1)(f) GDPR). Giving your details is voluntary, but without your name and email address we cannot reply.

Email, telephone and WhatsApp

If you email or call us directly, we use your details in the same way and for the same purposes.

The “ask on WhatsApp” link opens WhatsApp, a service of WhatsApp Ireland Limited (Meta), with a prepared message naming the house and your dates. Nothing is sent until you press send in WhatsApp. If you contact us there, WhatsApp processes your messages under its own privacy policy, and data may be transferred to the United States (see “Transfers outside the EU”). If you prefer not to use WhatsApp, please use the form, email or telephone.

When you visit the website

Server logs. Like every website, ours runs on a web server that automatically records technical data for each request: your IP address, the date and time, the page requested, your browser and device type, and the page that linked to us. This is needed to deliver the website and keep it secure (legitimate interest, Article 6(1)(f) GDPR). The logs are kept by our hosting provider for a limited period and then deleted.

Page cache. To load quickly, the website keeps ready-made copies of its pages. These copies contain no information about you.

Nearby places. The home page and the Kamilari page show beaches and sights near the houses. When you scroll close to that section, your browser loads the list and its photos from geotour.gr (Geotour Crete, run by the website’s developer, Nikolakakis Manolis, Greece), which is delivered through Cloudflare. Your browser therefore sends its IP address and technical browser information to those servers. No cookies are sent with this request. The legal basis is our legitimate interest in showing useful local information (Article 6(1)(f) GDPR).

Fonts. The website uses fonts already installed on your device. No fonts are loaded from Google or other providers.

No analytics or advertising. We do not use analytics, advertising or social media plugins. Links to Facebook, WhatsApp, OpenStreetMap and Geotour only take you to those websites when you click them; from then on their own privacy policies apply.

Cookies

The website sets one cookie:

• pll_language remembers which language version of the website you are viewing (for example “en”), so that you see the pages in that language. It expires after one year. It contains no other information and is not used for tracking.

Because this cookie only provides the language you chose, we do not ask for consent for it. You can delete it in your browser at any time; the website still works. We use no analytics, advertising or other third-party cookies.

Who receives your data

• Vangelis, the owner, who answers your enquiry. Enquiries arrive in his mailbox at Yahoo Mail (Yahoo EMEA Limited).
• Email delivery: the website sends enquiry emails through a Google (Gmail) account, so Google processes them on the way.
• Our hosting provider, which runs the server where the website and its logs are stored.
• WhatsApp (Meta), only if you contact us there.
• Geotour and Cloudflare, which receive only the technical data needed to show the nearby places.

We do not sell your data or pass it on for marketing. We disclose data to authorities only where the law requires it.

Transfers outside the EU

Google, Yahoo, Meta (WhatsApp) and Cloudflare may process data in the United States or other countries outside the European Economic Area. Where they do, they rely on the EU–US Data Privacy Framework (the European Commission’s adequacy decision of 10 July 2023) or on the Commission’s Standard Contractual Clauses.

How long we keep your data

• Enquiry emails and messages: as long as needed to answer you and to manage any stay that follows. If no booking follows, we delete them no later than two years after our last contact. If you book, the records needed for the booking are kept for as long as Greek tax and accommodation law requires.
• The coded IP address for the one-minute limit: one minute.
• Server logs: for the limited period set by our hosting provider.
• The language cookie: one year, or until you delete it.

Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest (Articles 15 to 21 GDPR). To use these rights, write to [email protected]. We will answer within one month.

We do not use automated decision-making or profiling.

If you think we have not handled your data properly, you can complain to the Hellenic Data Protection Authority (HDPA), Kifisias 1–3, 115 23 Athens, Greece, www.dpa.gr, or to the data protection authority in the EU country where you live or work.

Changes to this policy

We update this policy when the website or the way we handle data changes. The date at the top shows the latest version.