Privacy Policy — NERION Hospitality

Template for legal review. This Privacy Policy is a working draft. Details shown in [square brackets] must be confirmed and the full text reviewed by a qualified legal adviser before it is relied upon.

1. Who we are

This website is operated by [Legal company name], trading as NERION Hospitality (“NERION”, “we”, “us”). We are the data controller for the personal data described in this policy.

Registered address: [Registered address]
VAT number: [VAT number]
Commercial registry (G.E.MI.) number: [G.E.MI. number]
Privacy contact: [Privacy contact email]

We have [not appointed / appointed] a Data Protection Officer. [If appointed: DPO contact details.]

2. Scope of this policy

This policy explains how we collect and use personal data when you visit this website, submit a property enquiry or otherwise contact us. It applies to property owners, investors, developers and their representatives who interact with us. Separate terms apply to any services we may later agree to provide.

3. The data we collect

Information you give us through the property enquiry form:

your name;
your email address;
your phone number (optional);
the property name, location, type (for example hotel, suites or villa) and number of rooms or units;
the services you are interested in;
your message and any other information you choose to include;
a record of your consent to this policy, including the date and time of submission and the version of the form.

Information you give us by other means, such as email, telephone or in person: the details you choose to share, including any property or performance information.

Information collected automatically: technical data such as IP address, browser type, device information and pages visited, collected through server logs and, only where you have consented, through analytics cookies. See our Cookie Policy.

We do not intentionally collect special categories of personal data. Please do not include such information in your enquiry.

4. Why we use your data and our legal bases

To respond to your enquiry and arrange an initial conversation: the steps you ask us to take before entering into a possible contract (Article 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (Article 6(1)(f)).
To assess whether we can work together, including reviewing information you share about your property: legitimate interests (Article 6(1)(f)) and pre-contractual steps (Article 6(1)(b)).
To keep a record of your consent and our correspondence: compliance with legal obligations (Article 6(1)(c)) and legitimate interests in demonstrating compliance (Article 6(1)(f)).
To operate, secure and improve the website: legitimate interests (Article 6(1)(f)).
Analytics and marketing cookies: your consent (Article 6(1)(a)), which you may withdraw at any time.
To send occasional updates, only where you have specifically opted in: consent (Article 6(1)(a)).

Where we rely on legitimate interests, we have considered your rights and expectations and believe our use is proportionate. You may object at any time (see section 9).

5. How long we keep your data

Enquiries submitted through the website are stored for a configurable period, by default 12 months from submission, after which they are deleted or anonymised unless a longer period is needed. If your enquiry leads to a working relationship, relevant data will be kept for the duration of that relationship and afterwards for as long as required by Greek tax, accounting or other law, or to establish, exercise or defend legal claims. Consent records are kept for as long as needed to demonstrate compliance. Server logs are kept for [retention period to be confirmed].

6. Who we share your data with

We do not sell your personal data. We share it only where necessary, with:

our website hosting provider, which stores the website and enquiry data on our behalf;
email delivery providers, which transmit notifications and correspondence;
PAVLA, our digital and technology partner, which may access personal data where it supports, maintains or secures the website, acting on our instructions;
analytics providers (such as Google), only where you have consented to analytics cookies;
professional advisers such as lawyers and accountants, where reasonably necessary;
public authorities, where we are legally required to do so.

Service providers acting on our behalf are bound by written data processing terms and may use your data only to provide services to us.

7. International transfers

We aim to store and process personal data within the European Economic Area. Some providers, for example email or analytics services, may process data outside the EEA. Where this happens, we rely on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework where the recipient is certified) or on the European Commission’s Standard Contractual Clauses, together with any supplementary measures required. You may request further information about these safeguards using the contact details above.

8. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access restricted to people who need it, regularly updated software, and secure hosting. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident in line with our legal obligations.

9. Your rights

Under the General Data Protection Regulation (EU) 2016/679 and Greek Law 4624/2019, you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased in certain circumstances;
restrict how we use your data in certain circumstances;
receive your data in a portable format, where processing is based on consent or contract and carried out by automated means;
object to processing based on our legitimate interests, and to direct marketing at any time;
withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at [Privacy contact email]. We will respond within one month, which may be extended where permitted by law. We may need to verify your identity before acting on a request.

10. Your right to complain

If you are concerned about how we handle your personal data, please contact us first so we can try to resolve the matter. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA), Kifisias 1–3, 115 23 Athens, Greece, www.dpa.gr, or with the supervisory authority in the EU member state where you live or work.

11. Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.

12. Links to other websites

This website may link to third-party websites. We are not responsible for their privacy practices and encourage you to read their policies.

13. Changes to this policy

We may update this policy from time to time. The current version will always be published on this page with the date of the latest update. Where changes are significant, we will take reasonable steps to let you know.

14. Contact

[Legal company name], [Registered address]. Email: [Privacy contact email]. Telephone: [Phone number].