This privacy policy explains how Anapollo Boutique Hotel processes personal data when you visit Anapollo Boutique Hotel Adults Only | Naxos Chora, contact us or use our services.

Last updated: November 5, 2026

Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

Anapollo Boutique Hotel
Koronou Street, Chora Naxos
Email: [email protected]

What we collect and why

We process personal data only for the purposes below, each on a legal basis under Article 6(1) GDPR.

Website operation and security

When you visit the website, our hosting provider processes technical data such as your IP address, browser type and the pages you request, so that the website can be delivered and protected against attacks. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). These logs are kept only for a short period.

Visitor statistics without cookies

To understand how our website is used, we count page views and how often pages are visited, which websites, search engines and campaigns visitors come from, and visitors' countries, device types, browsers and languages, as well as missing pages and visits by search engines. The counts come from the request records of our content delivery network, Cloudflare (Cloudflare, Inc.), which acts as our processor. Nothing is stored on or read from your device for this. Your IP address is not passed on to us, and we keep only daily totals that identify no one: no IP addresses, no visitor identifiers and only the domain of the page you came from. Legal basis: our legitimate interest in understanding and improving our website (Art. 6(1)(f) GDPR). We keep these totals for 25 months.

Your cookie choices

When you make a choice in our cookie banner, we keep a record of it (a random consent ID, the date, your choices, the version of the consent text, the language, a scrambled browser identifier and a shortened IP address) so that we can prove your consent. Legal basis: our legal obligation to demonstrate consent (Art. 6(1)(c) and Art. 7(1) GDPR). We keep these records for 3 years.

Contact forms and email

When you write to us through a contact form or by email, we process the data you give us (such as your name, email address, phone number and message) to answer you. Legal basis: steps you ask for before a contract (Art. 6(1)(b) GDPR) when your message concerns a booking or another contract; otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We keep these messages for up to 12 months after our last reply.

Bookings

When you book with us, we process your identity and contact details, the dates and details of your stay or service and the payment information needed for the booking. Payments are handled by the booking or payment provider. Legal basis: the performance of the contract (Art. 6(1)(b) GDPR) and our obligations under tax and accounting law (Art. 6(1)(c) GDPR). We keep booking data for as long as tax and accounting law requires.

Statistics

With your consent, we use statistics services to understand how visitors use the website. They load only after you allow the “Statistics” category in the cookie settings. Legal basis: your consent (Art. 6(1)(a) GDPR; for storing or reading information on your device, Art. 5(3) of the ePrivacy Directive 2002/58/EC, in Greece Article 4(5) of Law 3471/2006). The services and their cookies are listed in our cookie policy.

Advertising

With your consent, we use advertising services to measure our campaigns and to show you relevant ads on other websites. They load only after you allow the “Marketing” category in the cookie settings. Legal basis: your consent (Art. 6(1)(a) GDPR; for storing or reading information on your device, Art. 5(3) of the ePrivacy Directive 2002/58/EC, in Greece Article 4(5) of Law 3471/2006). The services and their cookies are listed in our cookie policy.

Embedded content

Some pages show content from other providers, such as videos, maps or social media posts. It loads only after you agree, in the cookie settings (category “Marketing”) or with the button on the content, because the provider receives your IP address and may set cookies. Legal basis: your consent (Art. 6(1)(a) GDPR; for storing or reading information on your device, Art. 5(3) of the ePrivacy Directive 2002/58/EC, in Greece Article 4(5) of Law 3471/2006). The services and their cookies are listed in our cookie policy.

Recipients and processors

We share personal data only with providers that process it on our behalf under a data processing agreement (Art. 28 GDPR), or with the providers of services you allow:

  • Hosting: HETZNER
  • Email: Google Workpspace
  • Accessibility toolbar (This website)
  • Cloudflare (Cloudflare, Inc.) – privacy policy
  • Cloudflare Turnstile (Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA)) – privacy policy
  • Site language (This website)
  • Site statistics (This website)

Where the law requires it, we also disclose data to public authorities, for example to tax authorities.

Transfers outside the EU/EEA

Some providers may process data outside the European Union and the European Economic Area:

  • Cloudflare (Cloudflare, Inc.): certified under the EU-U.S. Data Privacy Framework, on the basis of the European Commission’s adequacy decision (Art. 45 GDPR)
  • Cloudflare Turnstile (Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA)): certified under the EU-U.S. Data Privacy Framework, on the basis of the European Commission’s adequacy decision (Art. 45 GDPR)

How long we keep data

We keep personal data only as long as the purpose it was collected for requires, or as long as the law obliges us to. The periods are given in each section above.

Your rights

You have the right to:

  • access your personal data (Art. 15 GDPR);
  • have inaccurate data corrected (Art. 16 GDPR);
  • have your data erased (Art. 17 GDPR);
  • restrict the processing (Art. 18 GDPR);
  • receive your data in a structured, machine-readable format and have it transmitted to another controller (Art. 20 GDPR);
  • object to processing based on our legitimate interests (Art. 21 GDPR);
  • not be subject to a decision based solely on automated processing (Art. 22 GDPR). We do not make such decisions.

To exercise your rights, write to [email protected]. We answer within one month (Art. 12(3) GDPR) and may ask you to confirm your identity.

Withdrawing consent

You can withdraw your consent at any time, as easily as you gave it: open the Cookie settings, or use the unsubscribe link in our emails. Withdrawal does not affect the lawfulness of processing before it (Art. 7(3) GDPR).

Complaints

If you believe that we process your data unlawfully, you can lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work. The authority responsible for us is the Hellenic Data Protection Authority, Kifissias 1–3, 115 23 Athens, Greece (www.dpa.gr).

Cookies

The cookies and similar technologies we use, and how to change your choice, are described in our cookie policy.

Children

Our website is not directed at children. We do not knowingly collect personal data of children under 15 without the consent of their parents or guardians (Art. 8 GDPR; in Greece, Article 21 of Law 4624/2019).

Changes to this policy

We update this policy when our services or the law change. The date at the top shows the latest version.