This Privacy Policy explains how Kos Aktis Art Hotel ("we", "us") collects, uses and protects your personal data when you use this website, contact us, or make a booking. We are committed to handling your information lawfully and transparently under the EU General Data Protection Regulation (GDPR) and Greek data-protection law.
Who we are
Kos Aktis Art Hotel, Vasileos Georgiou 7, Kos 85300, Dodecanese, Greece. For any privacy question or request, email [email protected].
What we collect
When you contact us through a form: your name, email, phone (optional), travel dates and message.
When you subscribe to our newsletter: your email address.
When you make a reservation: your booking is processed by our booking partner (reserve-online.net / WebHotelier); the details you enter there are handled under their privacy terms.
Automatically: standard server logs and cookies (see our Cookie Policy).
How we use it and our legal basis
We use your data to respond to enquiries and manage your stay (legitimate interest and the steps needed to enter a contract), to send our newsletter where you have opted in (consent), and to keep the site secure (legitimate interest). We do not sell your personal data.
Who we share it with
We share data only with the service providers that operate this site and our services on our behalf — our booking engine (reserve-online.net / WebHotelier), our email and newsletter provider, and our hosting provider — and only as far as needed to deliver the service.
Cookies
We use cookies and similar technologies as described in our Cookie Policy. Non-essential cookies are set only with your consent.
Your rights
You have the right to access, correct, delete, restrict or object to the processing of your data, to data portability, and to withdraw consent at any time. To exercise any of these, email [email protected]. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA).
Retention
We keep personal data only for as long as necessary for the purpose it was collected, or as required by law, after which it is deleted.
This is a baseline policy provided with the website build and is pending legal review and confirmation of the data controller and any retention specifics before launch.