Privacy policy.

1. Data controller

The data controller of your personal data is Ξενοδοχειακές Επιχειρήσεις Ιωακείμ ΕΠΕ (Latin: Xenodocheiakes Epicheiriseis Ioakeim EPE), the Greek limited-liability company (ΕΠΕ) operating the hotel under the trading name 'Emotions Boutique Hotel — Karpenisi'. VAT number (ΑΦΜ): 998895739. GEMI registration: ELGEMI.124144923000. EOT operating licence: 1352Κ113Κ0204000. Registered seat: Voutyro Village, Central Square, 36100 Karpenisi, Evrytania, Greece. ΕΠΕ incorporated 20/12/2010; the family hotel operation in Voutyro has been running since 1988 under predecessor entities.

• Email: [email protected]
• Phone: +30 22370 25725
• Website: https://www.emotions.com.gr

For any matter relating to the processing of your data you may contact us at the details above. Given the size of the business there is no statutory obligation to appoint a Data Protection Officer (DPO) under Article 37 GDPR; your requests are handled directly by hotel management.

2. What data we collect

In the course of operating the hotel and its website we process the following categories of personal data:

• Booking data: full name, email, phone number, country of residence, arrival/departure dates, room type, number and ages of guests, special requests.
• Identification data at check-in: type and number of identification document (national ID card or passport), nationality, date of birth — as required by Greek law on the keeping of the Hotel Guest Book.
• Payment data: your card details are not collected or stored by us; they are transmitted directly through the PCI-DSS-certified payment processor of the booking engine (reserve-online.net, operated by Bookassist Ltd) or, for direct charges, through Viva Wallet.
• Contact form data: name, email, message.
• Web analytics (server logs & GA4): IP address, device/browser type, time of visit, pages viewed. Collected in non-identifiable form via Google Analytics 4.

3. Purposes and legal basis

We process your data on the following legal bases under Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019:

Purpose	Legal basis
Booking management, provision of accommodation services, invoicing	Art. 6(1)(b) GDPR — performance of a contract
Keeping the Hotel Guest Book and forwarding data to competent authorities	Art. 6(1)(c) GDPR — compliance with a legal obligation
Issue and archiving of tax records	Art. 6(1)(c) GDPR — Greek tax law
Replies to enquiries via the contact form	Art. 6(1)(f) GDPR — legitimate interest / pre-contractual steps
Statistical analysis of website traffic via GA4	Art. 6(1)(f) GDPR — legitimate interest (anonymised, opt-out via browser)

4. Forwarding of guest data to the Hellenic Police

As a regulated accommodation business, we are required by law (Presidential Decree 8/1986, Law 1652/1986 and applicable police regulations) to maintain a Hotel Guest Book and to forward to the locally competent police authorities the identification data of guests in residence (full name, nationality, ID/passport number, dates of stay). This transfer takes place upon request of judicial and public authorities or in the context of routine inspections by the Hellenic Police, and constitutes a legal obligation under Art. 6(1)(c) GDPR — your consent is neither required nor sought for this purpose.

5. Recipients — Processors

Your data is shared only with the following parties, under contractual confidentiality obligations:

• Bookassist Ltd (Ireland) — the operator of the reserve-online.net booking engine (data processor)
• Viva Wallet — PCI-DSS-certified payment provider for direct payments
• Our accounting firm — for the issuing of invoices and tax filings
• Web hosting provider (Hetzner Online GmbH, Germany) and CDN/security service (Cloudflare, Inc., USA — under EU Standard Contractual Clauses)
• Google Ireland Ltd. for Google Analytics 4
• Competent public authorities (Hellenic Police, Greek Tax Authority, judicial authorities) in the cases described in section 4 and where otherwise required by law.

6. International transfers

Data are hosted on servers within the EU (Germany). Cloudflare and Google Analytics may process data outside the EEA; such transfers are covered by the European Commission's Standard Contractual Clauses (SCCs) 2021/914 and by the EU–US Data Privacy Framework.

7. Retention period

• Booking data and tax records: ten (10) years, in accordance with Greek tax and commercial law.
• Hotel Guest Book: for the period mandated by applicable police regulations.
• Contact form enquiries: up to twelve (12) months from the last communication.
• Server logs: up to ninety (90) days.
• GA4 data: up to fourteen (14) months (Google default).

8. Cookies

The website is static and sets no tracking cookies of its own. We use Google Analytics 4 (gtag.js) for anonymised traffic measurement with IP-anonymisation enabled. You may opt out at any time by enabling "Do Not Track" in your browser, by installing the official Google Analytics opt-out browser add-on, or by blocking third-party cookies in your browser settings.

9. Your rights

You have the right to request access, rectification or erasure of your data, as well as portability or restriction of processing, to object to processing and to withdraw any consent at any time (without affecting the lawfulness of processing carried out before withdrawal). We respond to every request within one (1) month of submission, in accordance with Article 12 GDPR.

10. Exercising your rights — Complaints

To exercise your rights you may contact us at [email protected] or at the postal address in section 1. If you consider that the processing of your data infringes the law, you have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Avenue, 115 23 Athens, Greece, +30 210 6475600, [email protected], www.dpa.gr).

11. Changes to this policy

We may amend this policy from time to time. The current version is always published on this page along with the date of last update.