Privacy policy

This policy explains what personal data Aura Luxury Villas collects, why, how long we keep it and what your rights are. We follow the EU General Data Protection Regulation (GDPR) and Greek law 4624/2019.

1. Controller

[Legal entity name], Tax ID [Tax ID / VAT no.], Afantou, Rhodes 851 03, Greece. Email info@aura-villas.com, phone +30 694 878 8448. We have not appointed a data protection officer; for any question about your data write to the email above.

2. What data we collect

• Contact and booking data: name, email, phone, arrival and departure dates, number and names of guests, special requests, messages you send us.
• Identity data at check-in: the details from your ID card or passport that Greek law requires accommodation providers to record for every guest.
• Payment data: bank transfer details or payment confirmation. We never see full card numbers; card payments, where offered, are processed by a licensed payment provider.
• Website data: IP address, browser, device, pages visited and time of visit, collected by our hosting provider in server logs, and, only if you accept it, by analytics cookies.
• Preferences stored on your device: your cookie choice and accessibility settings (see the Cookie policy).

3. Why we use it and on what legal basis

• To answer your request and to manage your booking and stay: performance of a contract (art. 6(1)(b) GDPR).
• To record guest identity, issue invoices and keep accounting records: legal obligation (art. 6(1)(c)).
• To protect the villas, handle damage and defend legal claims: legitimate interest (art. 6(1)(f)).
• To send you news or offers by email: only with your consent (art. 6(1)(a)), which you can withdraw at any time.
• To measure how the website is used: only with your consent to analytics cookies.

4. Who receives your data

Our staff and cleaning partners, to the extent needed for your stay; our accountant and bank; our email and hosting providers; the Greek tax authority (AADE) and, when required by law, the police and tourism authorities; Google, only if you accept analytics cookies or load Google Fonts and Maps through our pages. We never sell your data.

Some providers (Google, Starlink) may process data outside the European Economic Area. Where this happens we rely on the European Commission’s standard contractual clauses or an adequacy decision.

5. How long we keep it

• Booking requests that do not lead to a booking: 12 months.
• Booking records, invoices and guest registers: as long as Greek tax and tourism law requires, currently 5 years after the end of the year of your stay.
• Correspondence about complaints or damage: until the matter is closed and any limitation period has expired.
• Marketing consent: until you withdraw it.
• Server logs: up to 12 months. Analytics data: as set in the Cookie policy.

6. Your rights

You can ask us at any time for access to your data, correction, deletion, restriction of processing, a copy in a portable format, and you can object to processing based on legitimate interest and withdraw any consent. Write to info@aura-villas.com; we answer within one month. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr, Kifissias 1-3, 115 23 Athens).

7. Security

Data is stored on servers inside the EU, protected by access controls and encryption in transit (HTTPS). Only people who need the data for your booking have access to it. No transmission over the internet is completely secure; if we become aware of a breach that affects you, we will inform you as required by law.

8. Children

Our website and services are addressed to adults. We record children’s names and identity details only as part of a booking made by an adult and as required by law.

9. Changes

We may update this policy; the date at the top shows the current version. Material changes will be announced on the website.