Privacy Policy

We may collect and process the following categories of personal data:

• Identity data: name, surname, date of birth, nationality
• Contact data: email address, phone number, postal address
• Booking data: reservation details, check-in/out dates, guest count, preferences
• Payment data: payment method, transaction references (we do not store full card numbers)
• Technical data: IP address, browser type, device information, cookies
• Communication data: messages, reviews, support requests
• Property owner data: property details, tax identification, bank account for payouts

We process your personal data for the following purposes:

• Processing and managing bookings and reservations
• Communicating with you about your booking or inquiry
• Payment processing and fraud prevention
• Improving our website and services
• Sending marketing communications (only with your consent)
• Compliance with legal obligations (tax, regulatory)
• Protecting our legitimate interests (security, dispute resolution)

We process personal data based on one or more of the following legal grounds under the GDPR:

• Contract performance: processing necessary to fulfill your booking
• Consent: marketing emails, non-essential cookies
• Legal obligation: tax and regulatory compliance
• Legitimate interests: fraud prevention, service improvement, analytics

We retain personal data only as long as necessary:

• Booking data: 5 years after the stay (tax/legal requirements)
• Account data: until you request deletion
• Marketing data: until you unsubscribe or withdraw consent
• Technical/analytics data: up to 26 months
• Communication records: 3 years

We may share your data with:

• Property owners (to fulfill your booking)
• Payment processors (Stripe, bank partners)
• Cloud hosting providers (within the EU/EEA)
• Analytics services (Google Analytics — see Cookie Policy)
• Legal authorities when required by law

We do not sell your personal data to third parties.

Your data is primarily stored within the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure adequate safeguards are in place, such as Standard Contractual Clauses (SCCs).

Under the GDPR, you have the following rights:

• Right of access: request a copy of your personal data
• Right to rectification: correct inaccurate data
• Right to erasure: request deletion of your data
• Right to restrict processing: limit how we use your data
• Right to data portability: receive your data in a structured format
• Right to object: object to processing based on legitimate interests
• Right to withdraw consent: at any time, without affecting prior processing

To exercise your rights, contact us at privacy@villa4you.gr. We will respond within 30 days.

Our website uses cookies to enhance your experience. For detailed information, please see our Cookie Policy.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date.