Legal
This Privacy Policy explains how Villa Rafalle (“we”, “us”) collects and uses personal data submitted through villarafalle.com (the “Website”), in accordance with the EU General Data Protection Regulation (GDPR) and applicable Greek law.
The data controller for the Website is Villa Rafalle, Agios Aimilianos, Porto Heli, Greece, contactable at bookings@villarafalle.com or +30 694 820 6929.
The only personal data the Website collects is what you choose to submit through the booking enquiry form: first and last name, email address, phone number, requested dates of stay, number of adults and children, and any message you add. There is no user account system, no online payment, and no e-commerce checkout on this Website.
We use this data solely to respond to your enquiry and to discuss a possible booking with you. The legal basis is Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and, where a booking does not proceed, our legitimate interest in Article 6(1)(f) GDPR in being able to reply to enquiries we receive.
Submitting the form sends its contents by email to Villa Rafalle’s booking mailbox via our website hosting provider’s email service. We do not sell your data, use it for automated decision-making or profiling, or share it with any marketing or advertising service. It is only otherwise disclosed where required by law.
The Destination page shows an interactive map built from OpenStreetMap data and served by OpenFreeMap (openfreemap.org). Loading it sends your IP address to OpenFreeMap’s servers, which handle it under their own privacy policy.
This is third-party content and is only loaded if you allow it in our cookie banner. Apart from a cookie that remembers your choice, the Website sets no other cookies of its own. You can review or change your choice at any time via the “Cookie Preferences” link in the footer.
We keep enquiry data for as long as reasonably necessary to respond to you and, if a booking results, for the duration of that booking plus a reasonable period afterwards. Where no booking follows, we aim to delete or anonymize enquiry data within 24 months.
Enquiry data is processed within the European Union. Where a third-party service we rely on (such as our hosting provider) processes data outside the EU/EEA, it does so under an applicable EU adequacy decision or other GDPR-compliant safeguard.
Under the GDPR you have the right to access, rectify, or erase your personal data, to restrict or object to its processing, and to data portability. To exercise any of these rights, contact us using the details in Section 1. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).
We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised date.
Last updated: September 2026.