John & Mary Suites respects your privacy. This policy explains which personal data we collect through this website and during your booking and stay, why we collect it, who we share it with and what rights you have under the General Data Protection Regulation (EU) 2016/679 (GDPR) and Greek law.
01Who we are
The data controller is Maria Mathioudaki, operating under the trade name “John & Mary Suites”, Ioannou Melissinou 9, 741 31 Rethymno, Crete, Greece. VAT number (AFM): 075933814. General Commercial Registry (GEMI) number: 169195650000.
For any question about your personal data, contact us at info@johnmarysuites.gr or +30 210 300 2211.
02What data we collect
When you contact us (contact form, email or phone): your name, email address, phone number (optional) and the content of your message. When you use the contact form we also send you an automatic email confirming that we received your message.
When you book: bookings are made through our online booking system, which collects the details needed for your stay: name, contact details, dates, number of guests and payment details. Card details are processed by the booking system’s payment provider and are never stored on this website or by us.
When you stay with us: at check-in we ask for an identity card or passport, because Greek law requires accommodation providers to record their guests’ details.
When you ask for extra services (airport transfer, car or bike rental, breakfast, excursions): the details needed to arrange them, for example your name, dates, number of people and flight details.
When you browse: our hosting provider automatically processes technical data such as your IP address, browser type and the pages requested, for security and to keep the website running. To protect the contact form from spam, a coded (hashed) form of your IP address is kept for up to one hour.
Visit statistics (only with your consent): if you accept statistics cookies, Google Analytics collects information about how you use the website, such as the pages you visit, your device and browser and your approximate location (country or city). We look at this data only in aggregate.
We do not have CCTV cameras at the property.
03Why we use your data and on what legal basis
- To answer your questions and requests: steps taken at your request before a contract (Art. 6(1)(b) GDPR) and our legitimate interest in replying to you (Art. 6(1)(f)).
- To manage your booking and your stay: performance of the contract with you (Art. 6(1)(b)).
- To record guests and keep tax and accounting records: compliance with our legal obligations (Art. 6(1)(c)).
- To arrange extra services you ask for: performance of the contract (Art. 6(1)(b)).
- To keep the website secure and working, including spam protection: our legitimate interest (Art. 6(1)(f)).
- To produce visit statistics with Google Analytics: your consent (Art. 6(1)(a)), which you can withdraw at any time.
Giving us your details is not compulsory, but without them we cannot answer your message or confirm your booking, and without an identity document we cannot complete your check-in as the law requires.
We do not use your data for advertising, we do not sell it, and we do not make automated decisions or profiles about you.
04Who we share it with
Only with partners who help us provide our services, only as far as needed, and under contracts that oblige them to protect your data:
- Guesty: our online booking and payment system, provided to us by Hotelyzer, which also built and maintains this website.
- Papaki: hosting of the website, the contact form and our email, on servers in the European Union.
- Google: Google Analytics (only if you accept statistics cookies) and Google Maps (only if you choose to load the map).
- Local partners (transfer drivers, car and bike rental, the partner restaurant for breakfast, excursion providers): only when you ask us for one of their services, and only the details they need.
- Our accountant, for our tax and accounting obligations.
- Public authorities, when the law requires it.
Some of these providers (Guesty and Google) may process data outside the European Economic Area. In that case the transfer is protected by appropriate safeguards, such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
05How long we keep it
- Messages and enquiries: for as long as needed to answer them and for up to 2 years afterwards.
- Booking, guest and invoicing records: for as long as Greek tax and accommodation law requires.
- Coded IP address of the contact form: up to 1 hour.
- Hosting server logs: a short period, for security only.
- Google Analytics data: 14 months.
06Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing and to receive it in a portable format. Where processing is based on your consent, you can withdraw it at any time, without affecting what was done before.
To exercise any of these rights, write to us at info@johnmarysuites.gr. We may ask you to confirm your identity, and we will reply within one month. You also have the right to lodge a complaint with the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens (www.dpa.gr).
07Children
This website is not addressed to children. Bookings must be made by an adult, who provides the details of any children travelling with them.
08Security
We take appropriate technical and organisational measures to protect your data. The website is served only over an encrypted connection (HTTPS), and card payments are handled exclusively by the booking system’s secure payment provider.
09Changes to this policy
We may update this policy when our services or the law change. The latest version is always on this page, with the date of the last update at the top.