Privacy Policy

1. Introduction

Welcome to StayInKos ("we", "our", "us"). StayInKos is an online hospitality platform connecting travelers with accommodation providers on the island of Kos, Greece. We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and Greek national data protection law.

This Privacy Policy explains how we collect, use, store, and share your personal information when you use our website at stayinkos.gr and related services.

2. Data Controller

The data controller responsible for your personal data is:

3. Information We Collect

We collect and process the following categories of personal data:

• Identity data: full name, date of birth, nationality, passport or ID number (required for accommodation registration under Greek law).
• Contact data: email address, phone number, home address.
• Booking data: check-in/check-out dates, property details, number of guests, special requests.
• Payment data: billing information processed securely via Stripe. We do not store card numbers on our servers.
• Account data: login credentials (email, hashed password), account preferences.
• Usage data: IP address, browser type, pages visited, time spent on pages, referral source (collected via cookies and analytics).
• Communications: messages sent through our platform, support enquiries, review submissions.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract performance: to fulfill a booking or service agreement you have entered into.
• Legal obligation: to comply with Greek police registration requirements (Δελτίο Κίνησης) and tax obligations.
• Legitimate interests: to improve our platform, prevent fraud, and communicate service updates.
• Consent: for marketing communications and non-essential cookies, where you have given explicit consent.

5. How We Use Your Data

• Processing and managing your accommodation bookings.
• Sending booking confirmations, pre-arrival information, and post-stay communications.
• Complying with Greek law on guest registration with local authorities.
• Processing payments and handling refunds.
• Providing customer support.
• Improving and personalising your experience on our platform.
• Sending marketing emails where you have opted in (you may unsubscribe at any time).
• Detecting and preventing fraud, abuse, and security incidents.

6. Sharing Your Data

We do not sell your personal data. We share it only where necessary:

• Property owners/hosts: your booking details and guest registration information are shared with the property you book, as required to provide the service.
• Payment processors: Stripe Inc. for secure payment processing.
• Channel managers: Channex Ltd., to distribute availability and receive reservations from OTA channels (Booking.com, Airbnb, etc.).
• Email / SMS providers: Resend and Twilio, to deliver transactional messages.
• Greek authorities: guest identity data as required by Greek law (Police registration).
• Analytics: anonymised usage data may be shared with analytics providers.

All third-party processors are bound by data processing agreements and are required to maintain appropriate security measures.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy, and in any case:

• Booking and guest registration records: minimum 5 years (Greek tax and legal requirements).
• Account data: until you request deletion or your account is inactive for more than 3 years.
• Marketing consent records: until you withdraw consent.
• Payment records: as required by financial regulations (typically 7 years).

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: request a copy of the data we hold about you.
• Right to rectification: request correction of inaccurate data.
• Right to erasure: request deletion of your data ("right to be forgotten"), subject to legal obligations.
• Right to restriction: request that we limit how we use your data.
• Right to data portability: receive your data in a machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: withdraw marketing consent at any time without affecting prior processing.

To exercise any of these rights, please contact us at hello@stayinkos.gr. We will respond within 30 days. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr.

9. Cookies

We use cookies and similar tracking technologies to operate our platform and improve your experience. These include:

• Essential cookies: required for the platform to function (authentication, session management).
• Analytics cookies: to understand how visitors use our site (e.g. page views, user flows).
• Preference cookies: to remember your settings and preferences.

Non-essential cookies are only placed with your consent. You can manage your cookie preferences at any time through your browser settings.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encrypted data transmission (HTTPS), access controls, and regular security reviews. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or by posting a prominent notice on our website. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact us: