Privacy Policy

1. Who we are

P.R.O.K.O.S. PAROS, Kakapetra, Paros 84400, Cyclades, Greece, is the data controller for personal data processed through this website. You can contact us about privacy at care@prokosparos.com.

2. Data we collect

• Booking details: name, email, phone number, country, stay dates, number of guests (including children and infants), arrival time, requests and selected extras.
• Payment data: processed directly by Stripe. We receive confirmation of payment and limited card details (such as card type and last four digits) but never your full card number.
• Identity documents: collected at check-in where required by Greek law.
• Communications: messages you send us by email, WhatsApp, phone, social media or our contact form.
• Technical data: IP address, device and browser information and, with your consent, analytics and cookie data (see our Cookie Policy).

3. Why we use it and our legal basis

• To take, manage and fulfil your booking and arrange extras you request — performance of a contract.
• To communicate with you before, during and after your stay, including by WhatsApp — performance of a contract and our legitimate interests in providing a personal service.
• To meet legal, tax and guest-registration obligations — legal obligation.
• To prevent fraud and keep our residences secure, including external CCTV covering entrances and parking — legitimate interests.
• To send you returning-guest offers and news — your consent, which you can withdraw at any time.
• To understand how our website is used and improve it — your consent via our cookie banner.

4. Who we share it with

We never sell your data. We share it only with service providers who help us run our business, under appropriate data processing agreements: Stripe (payments), Netlify (website hosting and database), Ketch (consent and chat tools), Meta/WhatsApp (messaging), Google (maps and, with consent, analytics), our accountants, and local partners who deliver services you book (for example a transfer driver, who receives only your name, phone number and travel details). We may also disclose data where required by law, for example to the Greek police or tax authorities.

Some providers are located outside the European Economic Area. Where this happens, transfers are protected by an adequacy decision or the European Commission’s Standard Contractual Clauses.

5. How long we keep it

• Booking and accounting records: as long as required by Greek tax law (typically 5 to 10 years).
• Guest communications: up to 3 years after your stay.
• CCTV footage: up to 15 days unless needed to investigate an incident.
• Marketing preferences: until you unsubscribe.

6. Your rights

You have the right to access, correct, delete or restrict the use of your personal data, to object to processing based on legitimate interests, to data portability and to withdraw consent at any time. To exercise any right, email care@prokosparos.com. We will respond within one month.

You also have the right to complain to the Hellenic Data Protection Authority (www.dpa.gr) or the supervisory authority in your country.

7. Security

Our website is served over encrypted HTTPS connections, access to guest data is restricted to the people who need it, and payments are handled by PCI-DSS certified Stripe.

8. Children

Bookings must be made by adults. We only process information about children travelling with you to provide the right beds, cots and services.

9. Changes

We may update this policy from time to time. The date at the top shows when it was last revised.