Last updated: 14 October 2026
1. Who we are
Casa Midas (“we”, “us”) is a private luxury villa for rent on the island of Zakynthos, Greece. For the personal data processed through this website (casamidas.gr) and in connection with your stay, we are the controller.
- Location: Zakynthos, Greece
- Email: info@casamidas.gr
2. Legal framework
We process personal data in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Greek Law 4624/2019 and Greek Law 3471/2006 on electronic communications and cookies. This policy explains what data we collect, why we collect it, how long we keep it and what rights you have.
3. What data we collect
| Category | What it includes | How we get it |
|---|---|---|
| Contact form data | Name, phone number, email address, subject and message | When you contact us through the form on the website |
| Booking data | Name, email, phone, dates of stay, number of guests, price, special requests (e.g. events, celebrations) | When you book the villa with us or through a booking platform |
| Guest registration data | Full name, nationality, date of birth, ID card or passport number | At check-in, where required by Greek law |
| Payment data | Amount paid, payment method, invoice or receipt details | When you pay. We do not store full card numbers. |
| Technical data | IP address, browser and device type, pages visited, date and time of visit | Automatically, through server logs |
4. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Answering your enquiries | Steps taken at your request before a contract (Art. 6(1)(b)) / legitimate interest (Art. 6(1)(f)) |
| Managing your booking and your stay | Performance of a contract (Art. 6(1)(b)) |
| Guest registration and reporting to authorities, where required | Legal obligation (Art. 6(1)(c)) |
| Issuing receipts and invoices and keeping tax records | Legal obligation (Art. 6(1)(c)) |
| Handling complaints and protecting our legal rights | Legitimate interest (Art. 6(1)(f)) |
| Keeping the website secure and working properly | Legitimate interest (Art. 6(1)(f)) |
5. Cookies and third-party services
Our website uses only necessary cookies, which it needs to work correctly. We do not use analytics or advertising cookies.
The website uses or links to these third-party services:
- Google Fonts (Google Ireland Ltd.) and Adobe Fonts (Adobe Systems Software Ireland Ltd.): load the fonts on the website. When the page loads, these providers receive your IP address.
- Instagram and Facebook (Meta Platforms Ireland Ltd.): our pages there are linked from the website. These platforms process your data under their own privacy policies only when you click through to them.
6. Who we share your data with
We do not sell your personal data. We share it only when needed with:
- staff and service providers working at the villa (e.g. cleaning, maintenance, transfers), only as needed for your stay;
- booking platforms you choose to book through;
- payment providers and banks, to process payments;
- our website hosting and email providers;
- our accountant and the Greek tax authorities (AADE), as required by law;
- the police or other authorities, when the law requires us to.
7. International transfers
Some of the providers listed above (such as Google, Adobe and Meta) may process data outside the European Economic Area, including in the United States. In those cases, the transfer is protected by appropriate safeguards, such as the European Commission’s adequacy decision for the EU–US Data Privacy Framework or standard contractual clauses (GDPR Art. 45–46).
8. How long we keep your data
| Data | Retention period |
|---|---|
| Enquiries that do not lead to a booking | 1 year |
| Booking and stay data | 2 years after your stay, for complaints and returning-guest service |
| Guest registration data | As long as required by Greek law |
| Invoices, receipts and tax records | As long as required by Greek tax law (generally 5 years, and up to 20 years in specific cases) |
| Server logs | 6 months |
9. Security
We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS) and access only for authorised persons. If a data breach is likely to put your rights at risk, we will notify the Hellenic Data Protection Authority within 72 hours and inform you when the law requires it.
10. Your rights
Under the GDPR you have the right to:
- access the data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data deleted, where there is no legal reason for us to keep it (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw any consent you have given, at any time.
To use any of these rights, write to info@casamidas.gr. We will reply within one month.
11. Children
Our website is not aimed at children under 15, and we do not knowingly collect their data online. Data of children staying at the villa is provided by their parents or guardians and processed only for the booking and, where required, for guest registration.
12. Complaints and changes
If you think we have not handled your data correctly, you can complain to the Hellenic Data Protection Authority: Kifisias 1-3, 115 23 Athens, Greece; www.dpa.gr; complaints@dpa.gr. You can also complain to the data protection authority of the EU country where you live.
We may update this policy. The current version is always published on this page, with its date at the top.
