Privacy Policy

AVAL Luxury Suites

Last updated: March 2026

1. Data Controller

AVAL Luxury Suites (“AVAL”, “we”, “us”) is the data controller responsible for the personal data collected through our website and during your stay at our properties: AVAL All Suite Santorini (Mesaria, Santorini) and AVAL Riviera Lagonisi (Lagonisi, Attica, Greece).

For any privacy-related enquiries, please contact us at: [email protected]

2. Personal Data We Collect

We collect only the personal data that is necessary to provide our services and fulfil our legal obligations. This may include:

2.1 Reservation & Stay Data

Full name, nationality, and date of birth
Passport or identity card number (required by Greek law for hotel registration)
Contact details: email address, phone number, postal address
Payment information (processed securely; we do not store full card details)
Special requests, dietary requirements, or accessibility needs
Arrival and departure dates, suite type, and booking history

2.2 Newsletter Subscription

First name, surname, and email address

2.3 Website Usage Data

IP address and browser information (collected via cookies and analytics tools)
Pages visited, time spent, and interaction data

3. How We Use Your Data

We use your personal data for the following purposes:

To process and manage your reservation and provide the services you have requested
To comply with legal obligations, including Greek hospitality law requirements for guest registration
To process payments and prevent fraud
To communicate with you about your reservation, changes, or special requests
To send you our newsletter and marketing communications, where you have given your explicit consent
To improve our website and services through anonymised analytics

4. Legal Basis for Processing

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

Contract performance — to fulfil your reservation and provide hotel services
Legal obligation — to comply with Greek law requirements for guest registration and tax purposes
Legitimate interests — to operate and improve our business, prevent fraud, and ensure security
Consent — for newsletter subscriptions and non-essential cookies; you may withdraw consent at any time

5. Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

Reservation and stay records: retained for 5 years, as required by Greek tax law
Guest registration records: retained for the period required by applicable Greek hospitality regulations
Newsletter subscriptions: retained until you unsubscribe or withdraw consent
Website analytics: anonymised data retained for up to 24 months

6. Your Rights

Under GDPR, you have the following rights regarding your personal data:

Right of access — to obtain a copy of the personal data we hold about you
Right to rectification — to have inaccurate data corrected
Right to erasure — to request deletion of your data, subject to our legal obligations
Right to restriction — to request that we limit the processing of your data
Right to data portability — to receive your data in a structured, commonly used format
Right to object — to object to processing based on legitimate interests or for direct marketing
Right to withdraw consent — at any time, for processing based on consent

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr (opens in new tab).

7. Third Parties & Data Transfers

We may share your data with trusted third parties where necessary to provide our services:

Booking platforms and reservation system providers
Payment processors, who handle transactions securely under their own privacy frameworks
Analytics providers (Google Analytics), operating under data processing agreements
Legal and regulatory authorities, where required by law

We do not sell, rent, or trade your personal data to third parties for marketing purposes. Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place.

8. Cookies

Our website uses cookies to enhance your browsing experience and analyse website traffic. You can manage your cookie preferences at any time via the cookie settings available on our website. For more information on how we use cookies, please refer to our cookie notice displayed when you first visit our site.

9. Contact & Complaints

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

Email: [email protected]
AVAL All Suite Santorini: +30 22860 37371
AVAL Riviera Lagonisi: +30 22910 22917

If you are not satisfied with our response, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA), the supervisory authority for data protection in Greece.