Draft — to be reviewed before launch
Villa Blotto
Privacy policy
Last updated
We only ask for what we need to answer you and look after your stay — and we never sell or share it for marketing.
Who we are
The data controller is Villa Blotto — operator TBC, Lakka, Paxos 490 82, Greece. You can reach us about anything in this policy at hello@villablotto.com.
What we collect
When you send a booking request: your name, email, phone number and country; your dates and number of guests; and what you tell us about your stay (who’s coming, what the trip is for, how you’re arriving). If you choose to, a link to a profile such as Airbnb.
When you send an enquiry: your name and email, and — if you give them — your phone number, preferred dates, number of guests and your message.
When you pay: payments are handled by Stripe. Your card details go straight to Stripe — we never see or store card numbers. We keep a record of the amounts, dates and a payment reference.
Technical details: when you send a request or enquiry we also record your IP address and basic browser information (user agent and the page you came from). We use these only to prevent spam and fraud, and they’re deleted with the request or enquiry.
We never ask about age, nationality, gender or anything else about who you are — only about the stay.
Why we use it
- To reply to your enquiry or request, and to manage your booking (our lawful basis: taking steps to enter into, and performing, a contract with you).
- To take the deposit, balance and security hold through Stripe.
- To meet our legal, tax and accounting obligations in Greece.
- To send you occasional news only if you tick the box to say yes — you can unsubscribe at any time.
Who we share it with
Only the services that help us run the booking: Stripe (payments), our email provider (to send you messages) and our website and database hosts. Each processes your data on our instructions. Some are based outside the EU; where that’s the case, transfers are protected by the European Commission’s standard contractual clauses.
How long we keep it
- Booking requests that are declined or expire are deleted after 6 months.
- Enquiries that don’t lead to a booking are deleted after 6 months.
- Bookings are kept for as long as Greek tax and accounting law requires, then deleted.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on your consent (news emails), you can withdraw it at any time. Just email hello@villablotto.com — we’ll answer within a month.
If you’re unhappy with how we’ve handled your data, you can complain to the Hellenic Data Protection Authority (www.dpa.gr) or the authority where you live.
Cookies
See our cookie policy.