Privacy Policy

PRIVACY NOTICE

The hotel chain Divani Collection Hotels, including Divani Caravel Hotel, Divani Palace Acropolis,
Divani Apollon Palace & Thalasso, Divani Apollon Suites, Divani Meteora Hotel, Divani Larissa
Palace and Divani Corfu Palace  and each of them acts as a Data Controller (hereinafter each of
them as “Company”). With this Privacy Notice, the Company wishes to inform its guests about
the processing of their personal data during their stay. The Company has taken the required
technical and organizational measures in order to be fully compliant with the General Data
Protection Regulation 2016/679 (GDPR), the Law 4624/2019, the Decisions, Instructions and
Opinions of the Hellenic Data Protection Authority and in general the national/EU legislation
and jurisprudence regarding data protection (hereinafter “Existing Legislation”), in order to
guarantee the security, integrity and confidentiality of your personal data.

Personal Data Collected

Identification data (name – surname – nationality – date/place of birth – loyalty program
member number – preferred communication language); Stay-related data (room number –
accommodation duration – additional consumptions of goods and/or services – departure
specifics); Special preferences (dietary – allergies – other health details); Image data (photo /
video recordings); Contact details (home address – email – mobile phone); Payment data /
payment method (e-cards – credit or debit cards). The collection of these data serves the
following purposes:

Reservation of guestroom or other venues and the provision of respective services
Additional/extra services
Transfer/transportation booking
Planning and execution of events
Informative material prior, during and after your stay or visit at the hotel premises
Service charging / invoicing including extra consumptions, as well as payment
execution.

Name, surname, phone number, email, address, number of guests (adults & minors), date and
number of reservations, booking method (e.g. travel agent, via a booking platform e.g. booking,
by phone, etc.) date of arrival and departure, signature, type and room cost per night, payment
details, comments –> Purpose: Management of room reservations (Legal Basis: GDPR article 6
para.1΄b & GDPR article 6 para.1΄c)

• First name, last name, phone number, email, address, zip code, city, country, date of
  birth, passport/ID number, number of guests (adults & minors), date and reservation
  number, reservation method arrival and departure date, signature, room type and
  cost per night, details of the person responsible for the payment, additional
  consumptions, total cost for the services provided –> Purpose: Provision of
  accommodation services ( GDPR article 6 para.1΄b & GDPR article 6 para.1΄c )
• First name, last name, date and time of reservation, number of people –> Purpose:
  Management of restaurants reservations (GDPR article 6 para.1΄b)
• Name, surname, date, content of request/complaint, phone number –> Purpose:
  Management of requests/complaints ( GDPR article 6 para.1΄b , GDPR article 6
  para.1΄c & GDPR article 6 para.1΄f )
• Reservation and accommodation data such as first and last name, father’s name, VAT
  number and tax office, duration of stay, room number, number of guests, additional
  charges/ consumptions, discounts, payable costs, payment method data in issued
  receipt/invoice, advances, outstanding debts.–> Purpose: Invoicing (GDPR article 6
  para.1΄b, GDPR article 6 para.1΄c &  GDPR article 6 para.1΄f )
• Image data collected through the closed-circuit surveillance system, data included in
  security (e.g. theft) or accident reports such as name and surname, duration and
  room of stay, description of event/ accident etc.     –> Purpose: Safety of people and
  goods ( GDPR article 6 para.1΄c &  GDPR article 6 para.1΄f)
• Email –> Sending Newsletter emails ( GDPR article 6 para.1΄a)
• Reservation ID, name and surname, check in and check out date, room number,
  number of guests, email, language, nationality, responses to a guest satisfaction
  questionnaire (optional) –> Purpose : Guest satisfaction assessment, after
  completing (optionally) a relevant questionnaire via external partner’s platform (
  GDPR article 6 para.1΄a)

PRIVACY POLICY

The hotel chain Divani Collection Hotels , including Divani Caravel Hotel, Divani Palace Acropolis,
Divani Apollon Palace & Thalasso, Divani Apollon Suites, Divani Meteora Hotel, Divani Larissa
Palace and Divani Corfu Palace  wishes to inform the users of this website (hereinafter “Data
Subject”, “you”) for the processing of their personal data, in accordance with the provisions of
the Regulation (EU) 2016/679 (hereinafter “GDPR”), law 4624/2019, Decisions, Guidelines and
Opinions of Hellenic Data Protection Authority and, the relevant legislation about the protection
of Personal Data (hereinafter “Data Protection Legislation”).

Ι. What personal data we collect, for which purposes and which are the legal bases

• For the purpose of communicating with the users of our website, it is necessary to
  collect their name, surname, email address, telephone, personal data that may be
  included in the message. The above action is in accordance with Article 6 (1) (b)
  GDPR, according to which processing is necessary for the performance of a contract
  to which the data subject is a party or for measures to be taken at the request of the
  data subject prior to entering into a contract.
• Through the plugins in use in our website we may be granted access only to publicly
  shared information found on the respective Social Media platforms. The use of the
  plugins found on our website is governed by the terms and conditions of each
  platform.

II. How long your personal data is retained for
Personal data shall be retained for as long as necessary for data collection purposes, as
specified in section I, unless otherwise specified by law. It is our responsibility, once the
retention period expires, to ensure that your data will be safely deleted or destroyed in
accordance to explicitly described standards and specifications.
ΙΙΙ. To whom your personal data are disclosed and/or transferred
Each hotel Divani Collection Hotels chain, may disclose your personal data to its authorized
employees and/or transfer data collected through this website to:
a) Entities entrusted with the execution of specific tasks such as, but not limited to, product
suppliers and/or IT service providers and/or support service providers of all kinds of computer-
based information systems or electronic systems and networks. Those entities offer adequate
assurance for the implementation of necessary technical and organizational measures, so that
data processing is conducted in accordance to GDPR and other relevant legislation for data
protection.
b) Supervisory, independent, judicial, prosecuting, public and/or other authorities, bodies or
parties assigned to control/monitor our activities within the scope of their responsibilities.
Your personal data shall not be processed for any other purposes than mentioned above, nor
shall be transferred to unauthorized third parties. Although we do not transfer your personal
data to countries/organizations outside the EU/EEA, in the event that we need to proceed with
such transfer, we will ensure that the conditions of articles 44etc. of the GDPR are met.

ΙV. Rights of the data subject
The General Data Protection Regulation provides you with rights that we are committed to
satisfying. Thus, you may:

• request information about your stored personal data and the way it is processed. If
  you so wish, we shall provide a copy of your personal data undergoing processing,
  free of charge.
• request rectification of inaccuracies or errors, correction of incomplete data or an
  update of your data.
• request erasure of personal data, if no longer retained for specific, legal or stated
  purposes.
• request restriction of processing a) when the accuracy of the personal data is
  contested, b) when the processing is unlawful (but you oppose the erasure of the
  data), c) when the data is no longer needed for the purposes of the processing, and
  d) for as long as the verification whether the legitimate grounds of the controller
  override those of the data subject are still pending.
• object on grounds relating to your particular situation, at any time, to processing of
  personal data, especially when this data is processed for direct marketing purposes
  or profiling. More specifically, you may object to a decision based solely on
  automated processing. In such a case, you may exercise your right of intervention.
• receive your personal data in a structured, commonly used and machine-readable
  format or transmit this data to another controller at your behest, where technically
  feasible and at all times under the specific conditions of the law.
• revoke your once granted consent for your data processing at any time. As a result,
  we will not be allowed to continue the data processing based on this consent in the
  future.

You may address your requests via email dpo@divanis.com and we shall answer all your
requests within one (1) month. In the extremely rare cases that such a fulfillment is proven
unfeasible, we shall immediately inform you explaining the reasons in detail. If you believe that
the provisions for personal data are being violated, you may file a complaint to the Hellenic
Data Protection Authority (DPA).

V. Contact Information
DATA PROTECTION OFFICER

Email: dpo@divanis.com

Telephone: 2107207000