Last updated: 12 October 2026
1. Who we are
Callisto Azzure (“we”, “us”) operates the luxury villa residence at Tragaki 29100, Zakynthos, Greece, and the website https://callistoazzure.com. We are the controller of the personal data described in this policy.
This policy explains what personal data we collect, why, on what legal basis, how long we keep it and how you can exercise your rights. It applies to website visitors, people who contact us, and guests who book or stay at the villa.
- Address: Tragaki 29100, Zakynthos, Greece
- Email: enquiry@callistoazzure.com
- Phone: +49 157 548 95 381
- WhatsApp: +44 786 198 22 44
2. Legal framework
We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Greek Law 4624/2019 on the protection of personal data, and Greek Law 3471/2006 on privacy in electronic communications. We also comply with Greek laws that apply to tourist accommodation, tax and accounting.
We follow the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
3. What data we collect
| Category | What it includes | How we get it |
|---|---|---|
| Contact form, email and phone | Name, email, subject, your message, and phone number if you call or write to us | When you fill in the contact form, email or call us |
| Your phone number, name and messages | When you message us on WhatsApp | |
| Booking data | Name, contact details, dates of stay, number of guests, villa level booked, price, special requests | From you, or from the booking engine or platform you used (see section 5) |
| Guest registration | Full name, nationality, identity document or passport details, dates of stay | At check-in, as required by Greek law |
| Payment data | Amount paid, payment method, payment status, invoice details. Card details are processed by the payment provider; we do not store full card numbers. | At booking or during your stay |
| Extra services | Flight details for airport pick-up, preferences for private chef or massage, dietary requirements or allergies | Only if you request these services |
| Technical data | IP address, browser and device type, date and time of visit, pages visited | Automatically, from our web server and the third-party services described in section 6 |
Information about allergies or health conditions you share for the private chef or massage services is health data. We use it only to provide the service you asked for, and only with your explicit consent, which you give by sharing it with us.
4. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Managing your booking and stay, check-in and check-out | Performance of a contract with you (Art. 6(1)(b)) |
| Guest registration and reporting required by Greek law | Legal obligation (Art. 6(1)(c)) |
| Invoicing, accounting, tax and the climate resilience fee | Legal obligation (Art. 6(1)(c)) |
| Answering your enquiries | Steps taken at your request before a contract (Art. 6(1)(b)), or our legitimate interest in replying to enquiries (Art. 6(1)(f)) |
| Arranging airport pick-up, private chef or massage | Performance of a contract (Art. 6(1)(b)) |
| Meeting dietary or health-related requests | Your explicit consent (Art. 9(2)(a)) |
| Running, managing and securing the website, including Google Fonts and Google Tag Manager | Our legitimate interest in a working and secure website (Art. 6(1)(f)) |
| Handling complaints and legal claims | Our legitimate interest in defending our rights (Art. 6(1)(f)) |
We do not sell your data, we do not send marketing messages without your consent, and we do not make automated decisions that have legal effects on you.
5. Bookings
Reservations made with the “Book Now” button are handled by our booking engine provider, Beds24, which processes your data on our behalf. If you book through an online travel platform, that platform collects your data first under its own privacy policy and passes us what we need to provide your stay. For the data they hold, such platforms are separate controllers.
6. Cookies and third-party services
Our website uses only cookies that are necessary for it to work and to keep it secure. We do not use analytics, advertising or tracking cookies.
Some services on our website are provided by third parties:
- Google Tag Manager – a tool provided by Google Ireland Limited that is installed on our website to manage website scripts. We do not use it to run analytics, advertising or tracking tools. Google Tag Manager does not set cookies by itself, but when a page loads, Google receives your IP address and basic technical data such as your browser type. More information: Google Privacy Policy.
- Google Fonts – fonts may be loaded from Google’s servers, which receive your IP address.
- Booking engine – when you click “Book Now” you go to Beds24’s booking page, which has its own cookies and privacy policy.
- Google Maps, Instagram and WhatsApp – our address, Instagram and WhatsApp icons are simple links. Google or Meta receive data only if you click them.
You can block or delete cookies at any time in your browser settings.
7. Who we share data with
- Public authorities – Greek tax authorities, police and other authorities when the law requires it.
- Booking providers – Beds24 and any online travel platform you booked through.
- Payment providers and banks – to process payments and refunds.
- Service partners – drivers for airport pick-up, private chefs and massage therapists, only with the data needed to provide the service you requested.
- Technical providers – our website hosting provider, our web developer Park Studios for website maintenance, Google for Google Tag Manager and Google Fonts, and our email service provider. They act only on our instructions or under their own privacy policies as described in section 6.
- Meta (WhatsApp, Instagram) – if you contact us there, under Meta’s own privacy policy.
- Accountants and advisers – under a duty of confidentiality.
8. International transfers
Some providers, such as Google and Meta, may process data outside the European Economic Area, including in the United States. Such transfers take place only on the basis of an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or with appropriate safeguards such as standard contractual clauses, as required by the GDPR.
9. How long we keep your data
| Data | Retention period |
|---|---|
| Enquiries by form, email or WhatsApp that do not lead to a booking | 1 year after the last contact |
| Booking and stay records | For the period needed for the stay and any claims, and as long as required by Greek tax law |
| Guest registration data | For the period required by Greek law |
| Invoices and accounting records | For the period required by Greek tax and accounting law |
| Dietary or health-related information | Until the end of your stay |
| Website server logs | 6 months |
After these periods, data is securely deleted or anonymised.
10. Security
We use appropriate technical and organisational measures to protect your data, including an encrypted connection (HTTPS), restricted access for authorised persons only, regular updates of our website software and confidentiality obligations for staff and partners. If a data breach is likely to put your rights at risk, we will notify the Hellenic Data Protection Authority within 72 hours and, where the risk is high, inform you without undue delay.
11. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy;
- correct inaccurate or incomplete data;
- erasure, where we no longer need the data and are not legally required to keep it;
- restrict processing in certain cases;
- object to processing based on our legitimate interests;
- data portability for data you gave us under a contract or consent;
- withdraw consent at any time, without affecting earlier processing.
To exercise your rights, email enquiry@callistoazzure.com with the subject “Personal data request”. We may ask you to confirm your identity. It is free of charge and we will reply within one month.
12. Children
Our website is not directed at children under 15. Children’s data is processed only when they stay with a parent or guardian, and only as required for registration and their stay.
13. Complaints and changes
If you believe your data is processed unlawfully, please contact us first so we can resolve it. You also have the right to lodge a complaint with the Greek supervisory authority, or with the data protection authority in your EU country of residence:
- Hellenic Data Protection Authority
- Address: Kifisias 1-3, 115 23 Athens, Greece
- Website: www.dpa.gr
- Email: complaints@dpa.gr
We may update this policy when the law or our practices change. The current version is always published on this page with the date of the last update at the top.