Privacy Policy & Cookies Policy

This page explains what data I collect when you visit kardianibay.com or book the house, why, who it is shared with and what your rights are. It follows the EU General Data Protection Regulation (GDPR). 

1. Who is responsible for your data 

SPYRIDON AGAPAKIS, Kardiani Bay, Tinos Cyclades 84200, Greece — owner of Kardiani Bay. For any question about your data: [email protected]. 

2. The data I collect and why 

Your booking request. Name, email, phone, country, dates, number of adults and children (and the children’s ages), pet, and your message. I use them to reply and prepare an offer, at your request (legal basis: pre-contractual steps, Art. 6(1)(b) GDPR).

Your booking. The rental agreement and the record of its acceptance (date, time, IP address), the amounts paid and our correspondence. Before arrival: your full name, the number and issuing country of your ID card or passport, and the names of the other adults. For winter stays, the bank details needed for the deposit transfer and its refund. Legal basis: performance of the contract (Art. 6(1)(b)) and legal obligations, in particular the stay declaration to the Greek tax authority (Art. 6(1)(c)). I keep no copy or photo of your ID. 

Payment. Card payments go through Stripe. I never see your full card number. 

Messages around your stay. Confirmation, access details before arrival, welcome. After the stay, I may send you one message asking for your review (legal basis: legitimate interest, Art. 6(1)(f)). You can opt out at any time. I send no newsletters without your consent. 

Your visit to the site. Only with your consent: visit statistics (Google Analytics) and measurement of bookings that come from my Google ads (Google Ads). See section 7 on cookies. 

The availability calendar. It is displayed by a Cloudflare service, which technically receives your IP address to load the calendar. No other data is collected. 

3. Who your data is shared with 

Only with the providers needed, acting on my behalf: 

HighLevel — website hosting, forms and messages; 

Stripe — card payments; 

Google — statistics and ad measurement (with your consent), and email; Cloudflare — availability calendar; 

Papaki — hosting of the [email protected] address; 

my accountant, and the Greek tax authority, for legal obligations. 

I never sell or rent your data to anyone. 

4. Transfers outside the European Union 

Some providers (HighLevel, Stripe, Google, Cloudflare) may process data in the United States. These transfers rely on the safeguards provided by the GDPR, such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. 

5. How long I keep your data 

Requests that do not lead to a booking: deleted within 12 months. 

Agreement, payments and tax-declaration data: as long as Greek tax law requires, then deleted. 

Google Analytics statistics: 14 months at most. 

6. Your rights 

You can ask for access to your data, correction, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest. You can withdraw your cookie consent at any time. Write to [email protected]; I reply within one month. 

You can also complain to the Greek data protection authority (www.dpa.gr) or the authority in your own country. 

7. Cookies 

A cookie is a small file stored by your browser. The site uses three kinds:

Necessary — to run the site and the forms and to remember your cookie choice. They do not need your consent. 

Statistics — Google Analytics, to see how many people visit the site and which pages are read. Only with your consent. 

Advertising — Google Ads, to see whether a booking request came from one of my ads. Only with your consent. 

Before you choose, no statistics or advertising cookies are set. You can accept, refuse or change your mind at any time from the “Cookies” link at the bottom of every page, or by clearing your browser’s cookies. The payment page is provided by Stripe, which sets its own cookies needed for payment security. 

8. Changes 

I may update this page; the date below shows the latest version. 

Last updated: 10 2026.