Privacy Policy

Last updated: October 12, 2026

This Privacy Policy explains how Aphrodite Studios collects, uses, and protects your personal data when you use our website, and informs you of your rights under the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Greek law.

1. Data Controller

The data controller responsible for your personal data is:

Aphrodite Studios
Kallithea, Halkidiki 63077, Greece
Email: info@aphroditestudios.gr
Phone: +30 2374 023662

2. What Data We Collect

Booking enquiry data

When you submit a booking enquiry through our contact form, we collect:

  • Full name
  • Email address
  • Number of guests (adults and children)
  • Requested check-in and check-out dates
  • Any message you choose to include

Usage data

We use Google Analytics to understand how visitors use our website. With your consent, Google Analytics may collect your IP address, browser type, pages visited, and time spent on pages. This data is anonymised and used solely to improve our website. Google Analytics is only activated if you accept analytics cookies.

Technical and security data

When you visit our website, our hosting provider automatically records server logs: your IP address, browser type, the page requested, the time of the request and the response status. When you submit the contact form, Cloudflare Turnstile checks that the submission comes from a person rather than an automated program; it processes your IP address and technical browser signals. To prevent spam and abuse, the contact form keeps a short-lived, in-memory count of submissions per IP address and per email address. We use this data only to run, secure and protect the website.

Map and consent banner

The contact page shows an interactive map from Google Maps, and every page loads our cookie consent banner from PrivacyPolicies.com. Loading these services sends your IP address and browser information to those providers.

3. Legal Basis for Processing

We process your personal data on the following legal bases (Article 6 GDPR):

  • Performance of a contract / pre-contractual steps (Art. 6(1)(b)) — processing your booking enquiry so we can respond to your request for accommodation.
  • Consent (Art. 6(1)(a)) — for analytics cookies (Google Analytics). You may withdraw consent at any time via the cookie preferences link in the footer.
  • Legitimate interests (Art. 6(1)(f)) — keeping the website secure and available, protecting the contact form against spam and abuse, and showing our location on a map. You may object to this processing at any time (see Section 8).
  • Legal obligation (Art. 6(1)(c)) — where we are required to retain data to comply with applicable law.

4. How We Use Your Data

We use your booking enquiry data solely to:

  • Respond to your accommodation enquiry
  • Communicate availability, pricing, and booking arrangements
  • Comply with any legal obligations

We do not use your data for marketing, profiling, or automated decision-making. We do not sell your data to third parties.

5. Data Sharing

We share your data only where necessary:

  • Email service provider (Resend, Inc., USA) — processes enquiry emails on our behalf as a data processor. They act under our instructions and may not use your data for their own purposes. Transfers to the USA are covered by Standard Contractual Clauses.
  • Email hosting (Papaki, Greece) — hosts the mailbox where your enquiry is received.
  • Website hosting (Microsoft Ireland Operations Ltd — Azure, Italy North region) — hosts the website and its server logs within the EU as a data processor.
  • PrivacyPolicies.com — provides the cookie consent banner and stores your cookie choice.
  • Google LLC — if you consent to analytics cookies, Google Analytics processes anonymised usage data. Google may transfer data outside the EU under Standard Contractual Clauses.
  • Cloudflare, Inc. (Turnstile) — our booking form uses Cloudflare Turnstile to protect against automated abuse. When you use the form, Cloudflare processes technical data such as your IP address and browser characteristics on our behalf, based on our legitimate interest in securing the website (Art. 6(1)(f)). Cloudflare may process data outside the EU under the EU-US Data Privacy Framework and Standard Contractual Clauses.
  • Google LLC (Google Maps) — provides the map on our contact page. When the page loads, Google processes your IP address in order to serve the map content.
  • Law enforcement — where required by law or valid public authority request.

We do not share your data with any other third parties.

6. Data Retention

We retain booking enquiry data for up to 3 years from the date of your enquiry, consistent with the statutory limitation period for contractual claims under Greek law. Usage data collected by Google Analytics is retained for up to 14 months. Server and security logs are kept for 30 days. The contact form's anti-abuse counters are held in memory only and expire within 24 hours.

7. Cookies

We use two categories of cookies:

  • Strictly necessary cookies — required for the website to function (e.g., anti-forgery tokens for the contact form, language preference, your cookie consent choice). These do not require consent.
  • Analytics cookies (Google Analytics) — used to understand site usage. Activated only with your explicit consent. You can withdraw consent at any time via the cookie preferences link in our footer.

The map on our contact page (Google Maps) and the anti-spam check on our booking form (Cloudflare Turnstile) load content from third parties as described in section 5.

8. Your Rights

Under GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15) — request a copy of the personal data we hold about you.
  • Right to rectification (Art. 16) — request correction of inaccurate data.
  • Right to erasure (Art. 17) — request deletion of your data, subject to our legal retention obligations.
  • Right to restriction (Art. 18) — request that we restrict processing of your data in certain circumstances.
  • Right to data portability (Art. 20) — receive your data in a machine-readable format where processing is based on consent or contract.
  • Right to object (Art. 21) — object to processing based on legitimate interests.
  • Right to withdraw consent (Art. 7(3)) — withdraw cookie consent at any time via the preferences link in the footer, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at info@aphroditestudios.gr or by phone at +30 2374 023662. We will respond within 30 days.

9. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA):

  • Website: www.dpa.gr
  • Address: Kifissias 1-3, 115 23 Athens, Greece
  • Phone: +30 210 6475600
  • Email: contact@dpa.gr

10. Children's Privacy

Our website is not directed at children under the age of 15. We do not knowingly collect personal data from children under 15. If you believe a child has submitted an enquiry, please contact us and we will delete the data promptly.

11. Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and recommend you review their policies.

12. Changes to This Policy

We may update this policy from time to time. The updated date at the top of this page reflects when changes were last made. For significant changes, we will endeavour to notify you via the website.

13. Contact Us

For any questions about this Privacy Policy or to exercise your data rights: