Draft. This text has not yet been reviewed by a lawyer and is not yet in force.
Version of 9 August 2026
Who processes your data
Spiti Greece, reachable at [email protected], is responsible for the data that comes in through this site. Company details: [to be completed].
What we keep and why
When you make a request we keep your name, email address, the dates you want, the number of guests, your message, and the language you used on the site. That last one only so we can reply in your own language.
If you go on to book, we add the details we need for our records and for the guest registration that Greek rules require.
Beyond that we keep nothing. No profile, no advertising data, no visitor statistics.
Our legal grounds
For handling your request and your stay: performance of the contract. For our records and guest registration: a legal obligation. For the little that falls outside those, such as answering a question: our legitimate interest in being able to reply.
How long
A request that does not lead to a booking is deleted after twelve months.
Data about a stay is kept for as long as Greek tax and registration rules require, and deleted afterwards.
We back up the database weekly, stored encrypted at Cloudflare within Europe. Those backups are kept for six months and then expire on their own. If you ask us to delete your data we remove it from the database; it leaves the backups as soon as those expire.
If you are a member of the Filoxenia circle, our list of returning guests, we keep your name, email address and preferences until you tell us to remove you. One email is enough.
Who else sees it
Our site and database run at Cloudflare, which is our processor. The data is held in the European Union.
For the typefaces the site currently loads files from Google Fonts. In doing so Google sees your browser's IP address. No cookie is placed.
We send our replies from an ordinary email programme, so your email address also reaches our email provider.
We pass on nothing else, and we never sell anything to third parties.
Your rights
You may see your data, have it corrected or deleted, and object to the processing. Ask us by email and we will arrange it, without fuss.
If you disagree with something, you can complain to the supervisory authority in your own country. In Greece that is the Hellenic Data Protection Authority.
Security
The connection to the site is encrypted. The admin panel is behind a password and hidden from search engines. The private part of the island guide is not in the page itself and only travels over the line after a valid guest key.
Changes
If anything changes we will update this text and put the new date above it.