Privacy Policy - Theros Summer Suites

Privacy Policy (GDPR)
Last updated: April 1, 2025

Introduction
Theros Summer Suites (“we”, “us”, “the company”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard your personal data when you visit our website (therossummersuites.gr) or collaborate with us for marketing services.

We operate in compliance with the General Data Protection Regulation (GDPR) of the European Union and applicable Greek data protection legislation.

Data Protection Officer (DPO)
We have appointed a Data Protection Officer (DPO) to oversee our GDPR compliance. You may contact our DPO at welcome@therossummersuites.gr for any questions regarding the processing of your personal data.

What Personal Data We Collect

We may collect the following categories of personal data:

4.1 Data you provide to us:

Contact details (first name, last name, business address, email, phone)
Company information (company name, VAT number, address)
Information provided through contact forms or newsletter subscriptions
Communication content (emails, phone conversations, meetings)
Payment details (for processing invoices and payments)

4.2 Data we collect automatically:

Technical information such as IP address, browser type and version
Visit information (pages visited, time spent on each page)
Cookies and similar technologies (see our Cookie Policy)

How We Use Your Personal Data

We use your personal data for the following purposes:

5.1 Fulfilling contractual obligations:

Providing the marketing services you requested
Managing our professional relationship
Communicating about our services
Processing payments and invoicing

5.2 Legitimate interests:

Improving our services and website
Analyzing website usage to optimize performance
Ensuring website and systems security
Preventing fraud or other unlawful activities

5.3 With your consent:

Sending newsletters and promotional materials
Inviting you to events and seminars
Conducting market research and customer satisfaction surveys
Using non-essential cookies

5.4 Legal obligations:

Maintaining tax and accounting records
Responding to requests from competent authorities
Complying with our obligations under GDPR and other legal frameworks

Legal Basis for Processing

We process your personal data based on the following legal grounds:

Contractual necessity: When processing is required for the performance of a contract with you or to take steps at your request prior to entering into a contract.
Legitimate interest: When processing is necessary for our legitimate interests, unless those interests are overridden by your interests or fundamental rights and freedoms.
Consent: When you have given clear consent for processing your personal data for a specific purpose.
Legal obligation: When processing is necessary for compliance with a legal obligation.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including compliance with legal, accounting, or tax obligations.

Specifically:

Client data: 5 years after the end of the professional relationship
Invoicing data: 10 years in accordance with tax law
Marketing data: 2 years from the last interaction or until consent is withdrawn
Website traffic data: 13 months

Data Sharing

We may share your personal data with the following categories of recipients:

8.1 Internally:

Our staff who require access to deliver our services

8.2 Externally:

Service providers acting as data processors on our behalf (e.g. website hosting, CRM systems, email marketing platforms)
Professional advisors (e.g. lawyers, accountants, auditors)
Government authorities when required by law

All third-party service providers are bound by contracts requiring them to maintain confidentiality and protect personal data in accordance with the law.

8.3 International Transfers:
We may transfer your personal data outside the European Economic Area (EEA). In such cases, we ensure an adequate level of protection through:

European Commission adequacy decisions
Standard contractual clauses
Binding corporate rules
Other appropriate safeguards under Article 46 of the GDPR

Your Rights

Under GDPR, you have the following rights regarding your personal data:

Right of access
Right to rectification
Right to erasure
Right to restriction of processing
Right to data portability
Right to object
Right to withdraw consent
Right to lodge a complaint

To exercise any of the above rights, please contact us at welcome@therossummersuites.gr. We will respond to your request within 30 days.

Data Security

The security of your personal data is important to us. We implement appropriate technical and organizational measures to protect your personal data against accidental loss, destruction, alteration, unauthorized disclosure, or access.

Cookies and Similar Technologies

Our website uses cookies and similar technologies to enhance browsing experience, analyze site usage, and deliver personalized content and advertisements.

Data Breaches

In the event of a data breach, we will notify you without undue delay and inform the Hellenic Data Protection Authority within 72 hours of becoming aware of the breach.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for operational, legal, or regulatory reasons.

Contact

If you have any questions or concerns about this Privacy Policy or the way we handle your personal data, please contact us:

Theros Summer Suites
Email: welcome@therossummersuites.gr