1. Overview
Fontana Leone offers accommodation in Spili, Rethymno, Crete, Greece. We take the privacy of our guests and website visitors seriously. This notice explains how personal data may be handled when you visit our website, contact us or arrange a stay.
It is intended to provide information under the EU General Data Protection Regulation (GDPR) and applicable Greek data-protection law. The specific processing activities described below must reflect the services actually used by the accommodation.
2. Who is responsible for your data?
The data controller is the person or business operating Fontana Leone and deciding how and why personal data is processed.
Data controller: Fontana Leone
Business address: Spili Village, Rethymno, Crete, Greece
Privacy contact email: info@fontana-leone.com
Please use the contact information above for privacy enquiries or requests concerning your personal data.
3. Information we may collect
- Identity and contact details: name, email address, phone number and, if provided, country of residence.
- Enquiry and stay details: proposed arrival and departure dates, number of guests, messages, preferences and other information you choose to share.
- Reservation and administrative records: information needed to manage a confirmed stay and comply with applicable accounting or hospitality requirements, where relevant.
- Technical and usage information: device and browser information, website interactions and cookie identifiers, depending on your cookie choices and the technology used on the website.
Please avoid including sensitive personal information in general enquiry messages unless it is necessary for your request.
4. How we receive information
We may receive personal information directly from you when you send an enquiry, contact us or make a booking. Technical information may be generated when you use our website.
5. Purposes and legal bases
| Purpose | Typical legal basis |
|---|---|
| Responding to availability requests and preparing a potential reservation | Steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)) |
| Managing confirmed reservations and providing accommodation services | Performance of a contract (Art. 6(1)(b)) |
| Keeping records required by tax, accounting or hospitality legislation | Compliance with a legal obligation (Art. 6(1)(c)) |
| Protecting the website, preventing misuse and responding to legitimate operational issues | Legitimate interests where applicable and balanced against your rights (Art. 6(1)(f)) |
| Optional Google Analytics measurement | Your consent (Art. 6(1)(a)), requested before analytics is enabled |
We do not rely on consent for processing that is necessary to fulfil a booking or meet a legal obligation.
6. Email enquiries, deposits and booking confirmations
Our website does not provide instant or automatic online booking. Guests contact Fontana Leone by email to enquire about availability, prices and proposed dates. We respond personally and agree the reservation details directly with the guest.
Where a deposit is requested, payment instructions and the applicable conditions are communicated directly to the guest. We may process information about the deposit, such as the amount, payment date, payment reference and confirmation of receipt, to administer the reservation and maintain required financial records. Our website does not directly collect payment-card details or process online card payments.
A booking is confirmed by our direct communication with the guest in accordance with the terms agreed for that reservation. Sending an enquiry alone does not create an automatically confirmed booking. Please consult our Terms & Conditions for the applicable booking, deposit and cancellation conditions; the terms communicated for your particular reservation should also be checked.
We use the information provided in email correspondence only as needed to respond to the enquiry, arrange and administer the stay, document payments and meet applicable legal obligations. If necessary details are not provided, we may be unable to process the request.
8. Service providers and recipients
Personal data may be accessible to trusted service providers where necessary to operate the website, communicate with guests, administer reservations and deposit records, provide technical support or comply with legal requirements. These may include website hosting, email services, payment or banking services where used for deposits, professional advisers and competent public authorities, as appropriate.
Google is a provider of optional website analytics if you consent. The exact identity and role of other providers depends on the services used by Fontana Leone; these must be checked and documented before publication. We do not state that we sell personal data.
9. Transfers outside the EEA
Some technology providers may process or access personal data outside the European Economic Area. Where such transfers occur, they must be supported by a valid GDPR transfer mechanism, such as an applicable adequacy decision or standard contractual clauses with any required additional safeguards. The actual providers and transfer mechanisms must be verified for this website.
10. Retention and security
We keep personal information only as long as necessary for the purpose for which it was collected, including applicable tax, accounting, legal or dispute-resolution requirements. Email enquiries, confirmed reservation correspondence, deposit and accounting records, and technical records may have different retention periods. The actual retention schedule must be confirmed by the business and reflected here before publication.
We use reasonable technical and organisational safeguards appropriate to the data and risks involved, and limit access to those who need it for legitimate business purposes. No online system can be guaranteed completely secure.
11. Your data-protection rights
Subject to the conditions and exceptions in applicable law, you may have the right to:
- Request access to your personal data and a copy of it.
- Request correction of inaccurate or incomplete information.
- Request deletion of data where the law allows.
- Request restriction of processing or object to certain processing.
- Receive certain information in a portable format and transfer it to another controller.
- Withdraw consent at any time without affecting processing carried out lawfully before withdrawal.
- Not be subject to certain solely automated decisions, where applicable.
To exercise your rights, contact the controller using the details in Section 2. We may need to verify your identity and will respond within the timeframes required by law, normally within one month, subject to permitted extensions.
12. Complaints
If you have concerns, please contact us so we can review them. You also have the right to lodge a complaint with a competent data-protection supervisory authority. In Greece, this is the Hellenic Data Protection Authority (HDPA).
13. Changes to this policy
We may update this policy to reflect changes in the website, our services, our providers or legal requirements. The revision date shown at the top indicates when this page was last updated. Material changes to optional tracking may require a renewed consent choice.