Privacy

1. Controller

The controller responsible for data processing on this website is {HOSTS}, Eleftherias 00, 731 00 Sternes Akrotiriou, Chania, Griechenland.

Contact: hallo@kalimera-neachora.eu or via the enquiry form.

No data protection officer is designated – under Art. 37 GDPR this is not required for a private holiday rental of this size.

2. Hosting and server log files

This website is hosted by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe (Germany). The server is located in a data centre in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with the host.

When you visit the website, the system automatically processes technical access data in server log files:

• IP address of the accessing device (truncated and not merged with other data)
• Date and time of access
• page or file requested and volume of data transmitted
• referrer URL (previously visited page)
• browser and operating system used

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and reliable provision of the website). The log files are not merged with other data sources and are deleted or anonymised regularly, usually after 14 days at the latest, unless they are required for the assertion or defence of claims.

3. Enquiry form

If you send us an enquiry via the form, we process the details you enter:

• name (required field)
• email address (required field)
• phone number (required field, so we can reach you quickly if we have questions)
• number of guests, preferred arrival and departure (optional) and your message

Purpose and legal basis: Processing serves solely to answer your enquiry and to initiate a possible rental contract. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or, for general questions without booking intentions, Art. 6(1)(f) GDPR (legitimate interest in responding to your contact).

No storage on the web server: Your details are not stored in a database. The message is forwarded exclusively by email to the hosts’ mailbox (hallo@kalimera-neachora.eu) and remains there as an email thread. You additionally receive an automatic acknowledgement at your email address; this acknowledgement is not stored after sending.

Retention period: The email thread is deleted as soon as your enquiry has been conclusively answered and no statutory retention obligations prevent deletion. In the event of a later booking, the details relevant to the booking remain in the email thread until the stay has been completed.

Abuse protection: To ward off spam, the IP address of the submitting device is briefly evaluated with a timestamp on each submission (rate limit, maximum 3 requests per 10 minutes). This data is retained for at most 10 minutes and then no longer used. The legal basis is Art. 6(1)(f) GDPR (protecting the form against automated abuse). The form also contains an invisible honeypot field that is only filled in by bots; its content is not stored.

4. Email correspondence

If you write to us directly by email, we process your email address and the details contained in your message in order to answer your enquiry (Art. 6(1)(b) or (f) GDPR, as above). For delivery we use a German mailbox (Uberspace) on our own domain.

5. Availability calendar

The availability display (Airbnb calendar) is a static preview that is calculated when the page is built. No data is transmitted to a calendar service when you visit the site; your data is not processed.

6. Website analytics (Umami, self-hosted)

This website uses Umami Analytics, a privacy-friendly analytics tool that we operate ourselves on our own server in Germany. It records statistical metrics about the use of the website, including:

• pages visited and time on page
• referrer URL (origin of the visit)
• browser type, operating system and device type
• country of origin (derived from the IP address, without storing the IP)

Umami uses no cookies and collects no personal data: IP addresses are not stored in plain text but discarded immediately after processing; attributing data to you is not possible for us. The data collected is not merged with other data sources, not passed on to third parties and not used for advertising. Inference to your person is ruled out.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the statistical evaluation of website usage to improve our offering). Because no personal data is processed and no cookies are set, consent is not required for this evaluation. You can prevent collection by enabling “Do Not Track” in your browser or by contacting us by email.

7. What we do not process

• No cookies – no cookies are set on your device and no data is read from it. Consent under § 25 TDDDG (German telecommunications law) is therefore not required, and there is no cookie banner.
• No advertising or social media services – no external fonts or map services, no profiling. The anonymised usage statistics (section 6) set no cookies and process no personal data.
• No payment data – no payment takes place via this website (enquiries are non-binding; booking and payment run via Airbnb or personally).
• No guest registration data – communication via the website collects no passport, address or registration form data.

8. Recipients and third-country transfers

We do not use your data for advertising and do not pass it on to parties who would use it for their own purposes. The only parties technically involved are the following service providers within the European Union, who process the data strictly on our behalf (data processing):

• netcup GmbH (Germany) as host of the website, within a data processing agreement pursuant to Art. 28 GDPR (server log files, section 2)
• Uberspace (Germany) as provider of the email mailbox and for sending enquiry and acknowledgement emails
• the own Umami instance on our own server in Germany, for anonymised usage statistics (section 6)

There are no transfers to third countries (in particular the USA): the site embeds no services from third countries and loads no resources from there.

9. Your rights

You have the following rights towards us:

• access to your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on Art. 6(1)(e) or (f) GDPR on grounds relating to your particular situation (Art. 21 GDPR); after an objection we only process your data if we can demonstrate compelling legitimate grounds
• withdrawal of consents given, with effect for the future (Art. 7(3) GDPR); the lawfulness of processing up to the withdrawal remains unaffected

To exercise your rights, an informal message to hallo@kalimera-neachora.eu is sufficient.

Right to lodge a complaint: You may complain to a data protection supervisory authority, in particular in the member state of your habitual residence or the place of the alleged infringement (Art. 77 GDPR). For us as providers established in Greece, the competent authority is:

Hellenic Data Protection Authority (HDPA)
Kifisias 1, 115 23 Athens, Greece
Website: www.dpa.gr

10. SSL/TLS encryption

For security reasons, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the padlock symbol in your browser bar; all transmitted data is encrypted.

11. Status and changes to this statement

Status: September 2026. This privacy statement may be adapted so that it always meets current legal requirements; the version current at the time of your visit applies. It will be finalised with the hosts once their binding details are available.