1. Who is the data controller
The data controller for the personal information collected through this site is Mochlos Beach, with its registered address at Mochlos 10, 72057 Sfaka, Crete, Greece. For any privacy question, you can write to us at annaliyoga@gmail.com.
2. What we collect and why
When you book a stay, we collect your name, contact details, dates of stay, party size and payment information. We need this to process your reservation — the lawful basis is performance of a contract, under GDPR Article 6(1)(b).
When you contact us by email or messaging app, we keep your messages so we can pick up the conversation where it left off. The lawful basis is our legitimate interest in answering you well, under Article 6(1)(f).
If you opt in to receive seasonal news or special offers, we collect your email on the basis of your consent, under Article 6(1)(a). You can withdraw this consent at any time using the unsubscribe link in any email we send.
We do not collect any special-category data, and we do not run any advertising or profiling.
3. Who we share your data with
We work with a small set of carefully chosen service providers, each acting as a data processor on our instructions.
Shopify Inc. hosts this site and processes your payment through its built-in checkout. Card numbers reach Shopify's payment provider directly and are never stored on our servers.
Cloudflare powers the technical layer that fetches live availability for each property. Cloudflare logs the IP address and date of each availability request for security and abuse prevention; these logs are kept for thirty days.
Brevo (formerly Sendinblue) sends transactional emails for your booking confirmation, pre-arrival message and post-stay note. Brevo records whether each email was delivered and opened, so we can detect delivery problems.
Beds24 is the booking-management system that synchronises your reservation across Airbnb, Booking.com and our own channels. Your name, dates and contact details are shared with Beds24 to prevent double bookings across platforms.
Where any of these providers process data outside the European Economic Area, they do so under the standard contractual clauses approved by the European Commission.
4. How long we keep your data
We keep booking records for seven years to comply with Greek tax and accounting law. Marketing email lists are kept until you unsubscribe. General correspondence is kept for as long as the conversation remains useful, then deleted.
5. Your rights
Under the GDPR you have the right to access the personal data we hold about you (Article 15), to ask us to correct it if it is wrong (Article 16), to ask us to delete it when there is no longer a legal reason for us to keep it (Article 17), to ask us to limit how we use it (Article 18), to receive a copy of your data in a portable format (Article 20), and to object to processing based on our legitimate interest (Article 21).
Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before you withdrew.
To exercise any of these rights, write to us at annaliyoga@gmail.com. We respond within thirty days.
If you believe we have not handled your personal data correctly, you can lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias Avenue 1–3, 11523 Athens, Greece — www.dpa.gr.
6. Cookies
Our site uses a small number of cookies that are strictly necessary for the checkout to work. We do not use advertising or tracking cookies. The full list is in our Cookie Policy.
7. Updates to this policy
We may update this policy as our practices evolve. The version applicable to you is the one published on the date you provided your data.