Sofia HOTEL (the ‘hotel’, ‘us’, ‘we’ or ‘our’, as appropriate) attaches great importance to the lawful processing, security and protection of your personal data, in any capacity you communicate or cooperate with us, such as prospective or active customers, consumers, website visitors, employees, and suppliers.
Please read carefully the terms of this Privacy and Personal Data Protection Policy (the ‘Policy’). In order for you to use our website or our services, you first need to accept the terms and conditions of this Policy, which shall also govern our contractual relationship.
If you do not agree with our Policy, please do not use our website or our services.
The terms of this Policy may be improved, updated or in any way modified, in whole or in part, at any time, so please review them regularly.

1. What are your personal data
Your personal data includes any information on paper or electronic media that may result, either directly or in combination with others, to your unique identification. Personal data may include information such as your full name, Tax Identification Number, Social Security Number, postal and/or electronic address (email), your landline and/or mobile phone number, your bank/debit/prepaid card details, passport number, as well as any other information that allows your unique identification in accordance with the provisions of the General Data Protection Regulation (Regulation 2016/679/EU, the ‘GDPR’), the local framework, as in force from time to time, including Greek Law 4624/2019, as well as relevant decisions of the Hellenic Data Protection Authority (the ‘DPA’).

2. What personal data we collect
We process and protect your personal data when you contact us and/or purchase our services directly and/or online, when you call us to provide you with information about our services or our activity in general, in accordance with the relevant legislation.
When you make a reservation with us, by contacting us directly (by phone or online), you may be asked to provide personal information, such as:
your contact information, full name, postal address, email address and telephone number, data concerning your credit or debit card, as well as information about your stay, including the date of arrival and departure.
The provision of some of the above personal information is mandatory if you are going to use our services. If you do not provide such data, we will unfortunately not be able to provide our services. We do not collect or process any type of special categories of personal data (sensitive personal data), save for and subject to the requirements and instructions issued by local authorities, including the Greek Ministry of Health, only during the COVID-19 pandemic period. You shall refrain from providing us with sensitive data that concern you or others. In the event that you provide us with such data we will delete the same as soon as we are made aware of them. We shall bear no liability whatsoever towards customers or third parties for any provision and/or processing of sensitive data due to acts or omissions on the part of customers in breach to the above obligation.
Please note that we do not store or collect payment details during electronic or online reservations or payments. Upon recording the number, security code, holder’s full name and expiration date of your credit or debit card and upon completing payment, such data are automatically transmitted to the competent bank, which carries out the payment. Your credit or debit card is only used for the specific transaction you have requested.

3. Ways we collect your personal data
We collect your personal data in various occasions, such as:
• when you call our numbers, when you send us an email, or make a reservation with us;
• when you contact us, either to request information or to make a reservation, to express your opinion, file a complaint or make a comment;
• when you send us your postal address so that we can issue an invoice or any other tax statement;
• when you voluntarily subscribe to receive electronic information or other marketing material or to renew your preferences or to participate in promotional competitions we may organise (e.g. giveaways or special promotions and offers); and/or
• when you visit our website through which we collect, with your explicit consent, via cookies, information from your terminal device, such as your Internet Protocol (IP) address, the type and version of your browser, etc.

4. Processing Purposes (Lawfulness of Processing)
4.1 We will process your personal data for the following lawful processing purposes (according to article 6 of the GDPR), as the case may be, following your explicit consent, which you can freely revoke at any time, or for the performance of a contract or pre-contractual relationship between us, or to serve our legitimate interests or to protect your vital interests, and in particular:
(1) In the normal course of our business, in order to be able to manage your reservation, to the extent that the processing is necessary for us to process and/or manage your reservation request, or your direct reservation with us, or for the provision of our services or to answer questions and requests about our services.
(2) In order to be able to understand your personal preferences and customise the services that we will provide to you as a guest of our hotel.
(3) For your convenience, so that we can facilitate you by re-providing the information you are interested in when you visit our website again.
(4) To contact you, following your explicit consent, and to send you information about the services that we believe you may be interested in. You may unsubscribe from communications at any time by sending a message at: info@hotel-sofia.gr
(5) To validate your information (and, in some cases, match it with information collected from third parties, such as travel agents and online intermediaries), to verify that our customers’ data is correct and accurate, especially regarding the date of arrival and payment level of the reservation. This processing is necessary for the realization of your reservation or for the provision of other services.
(6) To effect the contractual and/or transactional relationship between you and our hotel;
(7) For the safety of persons, property and goods. To ensure our legitimate interests, there is a closed camera recording circuit (CCTV) to ensure the safety of our premises, staff and customers.
(8) To comply with any of our legal obligations, e.g. when we receive documents, requests, orders, petitions, warrants, etc. of third parties, such as supervisory, prosecutorial, judicial, tax authorities, to investigate crimes and protect you against fraud or the fight against all forms of crime and to prevent the infringement of legal property.
(9) To periodically review if your personal data we have stored is accurate.
(10) For the verification of your data when you connect to our website and our wi-fi.
(11) For our internal operations and analysis, such as internal management, fraud prevention, use by administration and management information systems, invoicing, accounting, and billing.
4.2 Our website is not intended to be used by minors, below the legal age limit. No one below the legal age can provide any personal data on or through our website. We do not knowingly collect personal data from minors. If you are below the legal age limit, please do not visit our website, do not make any use of the above and do not send information about yourself to us, including your name, address, telephone number, or email address. In the event that we find that we have collected personal data from minors without verifying the consent of their parents or guardians, this information will be deleted, with the relevant notification of the minor’s parent or guardian. If you think we may have information from or about minors, please contact us at info@hotel-sofia.gr. To the fullest extent permitted by all applicable laws and regulations and without prejudice to any other provision of this Policy, we decline and reject any and all liability for any personal data submitted in violation of this clause.

5. What are the principles of collection and processing
The purpose of this Policy is to inform you regarding the terms of collection, processing, and transmission of your personal data that we may collect in our capacity as data processor or data controller, as the case may be. Our hotel and its trained staff apply the GDPR principles of processing (lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability). The above applies without discrimination and applies to all the processing we perform and in all services we provide.

6. Minimisation, storage and erasure of your data
We will always request the minimum personal data required by law to connect with us, to offer for purchase or permit the use of our services, or to take part in any promotional activities (e.g. giveaways and special offers) we may organise. We will retain your personal data only for the period required under relevant legal framework, based on the respective processing purpose, and then destroy or render the same anonymous, unless the maintenance of such personal data is required by law for tax, evidentiary or judicial purposes and for the prosecution of illegal acts.

7. Cookies Policy
In accordance with the DPA recommendations dated 25.2.2020, our website accepts the use of cookies. Cookies are online tools for collecting and analysing information from social networking platforms or collaborating with third-party websites to measure traffic, improve functionality, the content and overall appearance of our website and be customised to the needs of customers. When using our website, your personal data may be processed by third parties, such as social networks and search engines (e.g. Google Analytics) without any involvement, influence or control by our hotel, and may be transmitted either inside or outside the European Economic Area, for which transfer each such third party is solely responsible. If you do not wish third parties, such as Google, to receive information from your browser when you visit our website, you may opt out of the terms provided by the respective terms of use on the website of such third party. Although most browsers automatically accept the use of cookies, you can always change the settings on your computer, by choosing not to accept cookies, or to be asked to accept each of them separately. However, you should be aware that this will limit the range of browsing capabilities available to you on each website and your user experience.

8. Transfer of your data to third parties
8.1. Your personal data is collected, stored and processed by us, exclusively for the purposes stated in this Policy and in accordance with the applicable legal framework.
8.2. We may share your personal data with third parties, when this is necessary for the performance of a contract or when we have a legitimate interest to do so. Therefore, we may provide your personal data to third parties that are responsible or are directly or indirectly implicated in our operations (e.g. tax and financial advisors, legal counsels, host providers, IT companies, etc.). Finally, we may share your personal data in the following occasions:
a) to governmental, police or other competent authorities, when required to do so by all applicable laws and regulations, in order to comply with any judicial order or other legal obligation, or to respond to a certain governmental request;
b) when we believe, in good faith, that disclosure is necessary to protect our rights or property, your safety or the safety of others, or to assist in the investigation of theft or fraud. This includes exchanging information with other companies and organizations or police authorities for the purposes of protection against possible fraud and reducing the risk of stolen credit cards;
c) to service providers and data processors we may use to provide or improve our services and support our business; or
d) in case your stay has been paid by a third party we will provide the billing information to the party who made the payment.
In any case we will require such third parties to respect the security and confidentiality of your data and to handle it in accordance with all applicable laws and regulations.
8.3. We will not transfer your personal data outside the European Union and/or the European Economic Area (EEA).

9. Security of your Personal Data
We will process all your information with great care and respect, and make every effort to continuously adopt all reasonable technical and organizational measures to keep your personal data secure as soon as it arrives in our systems and in the database we hold. We implement the best practices for collection, storage and processing of data and security measures to protect against unauthorized access, modification, disclosure or destruction of personal data. In particular, we make every effort to keep your personal data in a safe place under the protection of encryption as well as security and protection software. However, keep in mind that while we take reasonable steps to protect your information, no internet site, no internet transmission, no computer system and no wireless connection is completely secure.

10. Links to third party websites
Our website may contain links that lead to websites of third parties, which are independent us, (such as payment service providers etc.) which are operated and maintained exclusively by such third parties, and which we do not control. Therefore, we have absolutely no responsibility for the content, actions or policies of these websites. Please read the respective data protection policies on the websites you visit carefully, as they may differ significantly from ours.

11. Your rights
11.1. You may contact us via email at info@hotel-sofia.gr, at any time and free of charge, in order to:
– obtain information about whether or not we process any of your personal data and/or to access your personal data;
– rectify any inaccurate or incomplete personal data;
– request that we delete your personal data, when –among other reasons- the processing of your data is no longer necessary for the purposes it was collected and there is no imperative reason to continue processing (or storing) your personal data;
– restrict the processing of your data, provided the requirements under the relevant framework are met;
– confirm that you revoke your previous consent; or
– request the portability of your personal data.
11.2. If you would like additional information regarding this Policy, please contact us via email at info@hotel-sofia.gr.
In case you have further questions, you have the right to contact the competent authority (DPA in Greece) at www.dpa.gr and/or file a complaint.

12. Jurisdiction and Applicable Law
Any dispute or claim arising out of or in connection with this Policy and/or the interpretation of any of the terms hereof, shall be governed by and construed in accordance with Greek law. The competent courts of Heraklion, Crete, Greece shall have exclusive jurisdiction.