vàrniko Archontikò
Privacy and Personal Data Protection Policy
Last updated: 4 November 2026
vàrniko Archontikò respects your privacy. This policy explains which personal data we process when you visit our website or contact us, why we use it and what rights you have.
Processing is governed by the European Union General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR), and applicable Greek law.
Data controller
The operator of vàrniko Archontikò is responsible for processing your personal data:
Name or business name: Varniko House
Postal address: Paradisos, Lygia, Lefkada, Greece
Email for personal data enquiries: privacy@varniko.house
Website: varniko.house
Personal data we collect
When you submit an availability enquiry or contact us, we process the information you provide: your name, email address, telephone number, preferred arrival and departure dates, number of guests and the content of your message.
To manage your submission, we also record the enquiry reference, submission date and time, form language and your acknowledgement that you have read the privacy notice.
When you visit the website, the hosting and security infrastructure processes technical data such as your IP address, access times, requested pages, browser information and error information.
If you opt in to the relevant optional measurement features, we also process information about the source of your visit, the referring campaign and the submission of an enquiry. Further details are provided in the Cookie Policy.
Please do not include health data, identity card or passport details, payment card details or any other information that is unnecessary for an initial enquiry in the form.
Why we use your data
| Purpose of processing | Legal basis |
|---|---|
| Responding to availability enquiries, providing prices and preparing a possible booking | Taking steps at your request before entering into a contract, Article 6(1)(b) GDPR |
| Managing an agreed booking and communicating about your stay | Performance of a contract, Article 6(1)(b) GDPR |
| Responding to general enquiries | Our legitimate interest in managing communications, Article 6(1)(f) GDPR |
| Keeping the website secure, resolving technical issues and preventing abusive submissions | Our legitimate interest in protecting the website and communications, Article 6(1)(f) GDPR |
| Keeping records required by tax or other legal obligations if a booking is made | Compliance with a legal obligation, Article 6(1)(c) GDPR |
| Optional measurement of website traffic and advertising effectiveness | Your consent, Article 6(1)(a) GDPR |
Consent to optional features is separate from submitting an availability enquiry. Processing that is necessary to respond to your enquiry does not rely on general consent to accept this policy.
Submitting the form does not confirm a booking, reserve dates, take a payment or subscribe you to a marketing list.
Required fields are marked on the form. The form cannot be submitted through the website without this information. The message field is optional.
Who has access to your data
The operator and authorised persons handling communications and stay enquiries have access to your data.
The website is hosted by DNHOST IKE. To provide hosting, DNHOST processes data on behalf of the data controller in accordance with the relevant contractual terms. DNHOST publishes a data processing agreement within its terms of service.
To the extent necessary to operate the website, access or processing is also carried out by:
- Authorised technical support providers, subject to confidentiality and data protection obligations.
- The provider used to send and manage email.
- Competent public authorities or professional advisers, where required by law or necessary to handle a specific legal matter.
We do not sell your personal data. Mentioning a service in this policy does not replace your consent where consent is required.
Processing locations and international transfers
Where data is transferred outside the European Economic Area, an appropriate mechanism under Chapter V GDPR is used, such as a valid adequacy decision or Standard Contractual Clauses, together with any necessary supplementary measures. You can request information about the applicable safeguards using the email address above.
How long we retain your data
| Category | Retention period |
|---|---|
| Contact or availability enquiries that do not result in a booking | 12 MONTHS from the last substantive communication |
| Booking and stay information | For managing the booking and subsequently for as long as required by applicable record-keeping obligations |
| Technical and security logs | 30 DAYS, unless a limited extension is needed to investigate a specific incident |
| Optional measurement data linked to an enquiry | 12 MONTHS |
| Backups | A rolling cycle of up to 5 DAYS |
Where specific data is necessary for a pending dispute or legal claim, it is kept only for as long as needed for that purpose. At the end of the relevant retention period, the data is deleted or anonymised.
Security
We take appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure. Access is restricted to persons who need it to carry out their duties.
Your rights
Subject to the conditions set out in the GDPR, you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests.
Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
To exercise your rights, contact privacy@varniko.house. We respond without undue delay and, in principle, within one month. If a lawful extension is needed because of the complexity or number of requests, we will notify you within the first month. We ask for additional identification information only where necessary.
You have the right to lodge a complaint with the Hellenic Data Protection Authority or another competent supervisory authority.
Automated decisions
We do not make decisions that produce legal effects or similarly significantly affect you based solely on automated processing.
Links to other websites
The website contains links to external services, such as maps and social networks. When you visit those services, the relevant provider explains its processing of personal data in its own privacy policy.
Changes to this policy
We update this policy when our services or processing practices change. The date of the latest update appears at the beginning. Where fresh consent is required, we request it separately.