# PRIVACY & DATA PROTECTION POLICY **Konnos Villas ** Operated by **S.Krasas Ltd** Office: Ayias Elenis 12, Cyprus Website: **[www.konnosvillas.com](http://www.konnosvillas.com)** Email: **[konnosvillas@gmail.com](mailto:konnosvillas@gmail.com)** **Last updated: 7 September 2026** --- ## 1. Introduction S.Krasas Ltd ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy & Data Protection Policy explains how we collect, use, store and protect personal information when you: * visit [www.konnosvillas.com](http://www.konnosvillas.com); * contact us by email, telephone or WhatsApp; * make an enquiry about Konnos Villa 1; * make or manage a reservation; * make a payment; * stay at the villa; or * subscribe to receive marketing communications from us. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Cyprus data-protection legislation. --- ## 2. Who is responsible for your personal data? The data controller responsible for the processing of your personal data is: **S.Krasas Ltd** Ayias Elenis 12 Cyprus Email: **[konnosvillas@gmail.com](mailto:konnosvillas@gmail.com)** If you have any questions about this Privacy Policy or wish to exercise your data-protection rights, please contact us using the email address above. --- ## 3. What personal data do we collect? Depending on how you interact with us, we may collect: ### Information you provide directly * Full name * Email address * Telephone/mobile number * Billing or contact address * Number of guests * Arrival and departure dates * Booking details * Special requests or requirements * Information you provide when communicating with us * Information required for guest registration or legal obligations ### Payment information When you make a payment through our website, payment processing is handled by the relevant payment provider, such as Stripe or PayPal. We do not intend to store your full payment-card number or security code on our own systems. Payment providers may collect and process payment information in accordance with their own privacy policies and applicable payment regulations. ### Automatically collected information When you visit our website, certain technical information may be collected automatically, including: * IP address * browser type and version * device type * operating system * approximate location derived from technical information * pages visited * referring website * date and time of access * website interaction and usage information * cookie identifiers and similar technologies This information may be processed for security, website operation, analytics and performance purposes. --- ## 4. How we use your personal data We may process your personal data for the following purposes: ### A. Managing enquiries To respond to questions, availability requests, special requests and other communications. **Legal basis:** Taking steps at your request before entering into a contract and, where appropriate, our legitimate interests in responding to enquiries. ### B. Managing reservations To: * process and confirm your reservation; * manage availability; * communicate with you regarding your stay; * provide booking confirmations and other necessary information; * manage changes or cancellations; * provide customer support; * coordinate your arrival and departure; * provide services associated with your reservation. **Legal basis:** Performance of the contract or taking steps at your request before entering into a contract. ### C. Payments To process payments, deposits, refunds and other transactions associated with your reservation. **Legal basis:** Performance of the contract and compliance with applicable legal obligations. Payments may be processed through third-party payment providers including Stripe and PayPal. ### D. Legal and regulatory obligations We may process and retain information where necessary to comply with applicable legal, tax, accounting, regulatory or law-enforcement requirements. **Legal basis:** Compliance with a legal obligation. ### E. Website operation and security We may process technical information to maintain website security, prevent fraud or abuse, troubleshoot technical problems and ensure the proper operation of our website. **Legal basis:** Our legitimate interests in maintaining a secure and functioning website. ### F. Website analytics We use Google Analytics to understand how visitors use our website and to improve its content, usability and performance. Analytics information may include information about your device, approximate location, traffic source, pages visited and interactions with the website. Where required by applicable law, analytics cookies and similar technologies will only be used after obtaining the appropriate consent. **Legal basis:** Consent where required for non-essential analytics cookies. ### G. Marketing communications If you subscribe to our marketing communications, we may use your name and email address to send you information such as: * special offers; * discounts; * availability announcements; * holiday promotions; * news relating to Konnos Villa 1; * other relevant promotional communications. You can withdraw your marketing consent at any time by using the unsubscribe mechanism provided in our marketing emails or by contacting us at **[konnosvillas@gmail.com](mailto:konnosvillas@gmail.com)**. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. **Legal basis:** Consent, where consent is required. --- ## 5. Booking and property-management systems We use **Smoobu** as our property-management, booking and website platform. Smoobu may process guest information on our behalf in connection with reservations, availability, communications, booking management and related services. Smoobu provides a Data Processing Agreement designed to govern processing carried out on behalf of accommodation providers under Article 28 GDPR. Smoobu may also use authorised subprocessors to provide its services. For more information about Smoobu's privacy practices and data processing arrangements, please refer to Smoobu's current privacy documentation. --- ## 6. Payment providers ### Stripe We may use Stripe to process card and other electronic payments. When you choose a payment method provided by Stripe, relevant personal and payment information may be processed by Stripe in order to authenticate and complete the transaction, prevent fraud, comply with legal obligations and provide payment services. Stripe may act as a data processor or controller depending on the processing activity. Stripe's own privacy policy applies to processing carried out by Stripe. ### PayPal We may also offer PayPal as a payment method. If you choose PayPal, relevant information may be transferred to PayPal so that the payment can be processed, authenticated and completed. PayPal's own privacy policy applies to processing carried out by PayPal. --- ## 7. Cookies and similar technologies Our website uses cookies and similar technologies. Cookies may be used for: * essential website functionality; * security; * remembering preferences; * website performance; * analytics; * marketing or advertising, where applicable. Essential cookies may be necessary for the website and booking functionality to operate correctly. Non-essential cookies, including analytics or marketing cookies, will be used in accordance with applicable consent requirements. You may manage your cookie preferences through the cookie-consent mechanism provided on our website and through your browser settings. --- ## 8. Google Analytics We use Google Analytics to measure website traffic and understand how visitors interact with our website. Google Analytics may process information such as: * device and browser information; * approximate geographic information; * pages visited; * traffic sources; * interactions and events; * cookie or similar identifiers. Where required, we will request your consent before activating non-essential Google Analytics cookies. We configure our analytics implementation with appropriate privacy settings and do not intentionally use Google Analytics to collect information that directly identifies you unless such processing is specifically configured and legally permitted. --- ## 9. Google Maps Our website may use Google Maps to display the location of Konnos Villa 1 and provide useful geographical information. When Google Maps content is loaded or interacted with, Google may process technical information such as your IP address and information about your interaction with the service. Google's own privacy policy applies to Google's processing of personal data. Where required, the relevant Google Maps functionality will be activated only after the appropriate consent has been obtained. --- ## 10. WhatsApp Our website may provide a WhatsApp contact button so that visitors can contact us directly. If you choose to use WhatsApp, your interaction will take place through WhatsApp/Meta's services and will be subject to their applicable terms and privacy policies. We do not control the processing performed by WhatsApp after you leave our website and interact with the WhatsApp service. We may retain information contained in WhatsApp conversations where necessary to respond to your enquiry, manage a reservation or comply with legal obligations. --- ## 11. Who may receive your personal data? We may share personal data with trusted service providers where necessary to operate our business and provide our services. These may include: * Smoobu and its authorised subprocessors; * Stripe; * PayPal; * website and technology service providers; * email and communication service providers; * analytics providers such as Google; * professional advisers where necessary; * financial, accounting or auditing providers; * public authorities, government bodies or law-enforcement authorities where legally required; * other service providers necessary to fulfil your reservation. We do not sell your personal data. We only disclose personal data where there is a legitimate and lawful reason to do so. --- ## 12. International transfers Some of the service providers used by us may process personal data outside Cyprus or the European Economic Area (EEA). Where personal data is transferred outside the EEA, we will take appropriate steps to ensure that the transfer is carried out in accordance with applicable data-protection law, including the use of an adequacy decision, appropriate safeguards or another lawful transfer mechanism where required. Third-party providers may have their own international data-transfer arrangements and privacy policies. --- ## 13. How long do we keep your personal data? We do not keep personal data for longer than reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by law. Our intended retention periods are generally as follows: ### Booking and guest records We generally retain reservation, guest and transaction records for **up to 7 years after the relevant transaction or end of the business relationship**, or longer where required by applicable tax, accounting, legal or dispute-resolution requirements. ### Enquiries that do not result in a booking Generally, we retain enquiry information for **up to 12 months after the last meaningful communication**, unless it is reasonably necessary to retain it for a longer period because of an ongoing matter. ### Marketing information If you have consented to marketing communications, we may retain your marketing contact information until: * you withdraw your consent; * you unsubscribe; * we determine that the information is no longer relevant; or * another applicable legal requirement requires its deletion. We may retain a minimal record of your withdrawal or objection to ensure that we do not send you marketing communications again. ### Website analytics Analytics information is retained according to the configuration and retention settings of the relevant analytics service. ### WhatsApp and other communications Communication records may be retained for as long as reasonably necessary to manage an enquiry, reservation, dispute or legal obligation and, where applicable, in accordance with the retention period applicable to the underlying booking. At the end of the applicable retention period, personal data will be securely deleted, anonymised or otherwise rendered non-identifiable where reasonably practicable. --- ## 14. Your rights under GDPR Subject to applicable legal conditions and limitations, you have rights including: * the right to be informed about how your personal data is processed; * the right to access your personal data; * the right to correct inaccurate or incomplete information; * the right to request erasure of your personal data; * the right to request restriction of processing; * the right to object to certain processing; * the right to data portability where applicable; * the right to withdraw consent where processing is based on consent; * the right to object to direct marketing at any time. You may exercise your rights by contacting: **[konnosvillas@gmail.com](mailto:konnosvillas@gmail.com)** We may need to verify your identity before completing certain requests in order to protect your personal data from unauthorised disclosure. We will normally respond to a valid request within the timeframe required by applicable data-protection law. --- ## 15. Direct marketing You may unsubscribe from promotional emails at any time. Every marketing email should provide an easy way to stop receiving further marketing communications. You may also contact us directly at: **[konnosvillas@gmail.com](mailto:konnosvillas@gmail.com)** If you object to direct marketing, we will stop using your personal data for that purpose, subject to any lawful exception. --- ## 16. Data security We take reasonable technical and organisational measures to protect personal data against: * unauthorised access; * accidental loss; * destruction; * alteration; * disclosure; * misuse. Access to guest information is limited to people and service providers who reasonably need the information to perform their responsibilities. However, no method of transmission or electronic storage can be guaranteed to be completely secure. --- ## 17. Data breaches If we become aware of a personal-data breach, we will assess the incident and take the measures required under applicable data-protection law, including notifying the competent supervisory authority and/or affected individuals where legally required. --- ## 18. Children's data Our accommodation may be suitable for families, but our website is not intended to knowingly collect personal data directly from children. Where information about children is required for a reservation or legally required guest-registration purposes, such information should normally be provided by a parent, guardian or responsible adult. --- ## 19. Third-party websites Our website may contain links or integrations to third-party services, including payment providers, Google services, WhatsApp and booking platforms. We are not responsible for the privacy practices, security or content of third-party websites or services. We encourage you to review the privacy policies of those services before providing them with personal information. --- ## 20. Changes to this Privacy Policy We may update this Privacy Policy from time to time to reflect changes in: * our services; * the technologies we use; * our booking or payment systems; * applicable legislation; * regulatory requirements; or * our data-processing practices. The latest version will always be published on our website with the relevant "Last updated" date. --- ## 21. Complaints If you have concerns about how we process your personal data, we encourage you to contact us first at: **[konnosvillas@gmail.com](mailto:konnosvillas@gmail.com)** You also have the right to lodge a complaint with the competent data-protection supervisory authority in Cyprus: **Office of the Commissioner for Personal Data Protection** Kypranoros 15 1061 Nicosia, Cyprus Email: [commissioner@dataprotection.gov.cy](mailto:commissioner@dataprotection.gov.cy) Website: [www.dataprotection.gov.cy](http://www.dataprotection.gov.cy) The Cyprus supervisory authority provides procedures for complaints concerning GDPR rights, unlawful processing and unsolicited electronic communications. --- ## 22. Contact For any privacy or data-protection question, please contact: **S.Krasas Ltd** Ayias Elenis 12 Cyprus **Email:** [konnosvillas@gmail.com](mailto:konnosvillas@gmail.com) **Website:** [www.konnosvillas.com](http://www.konnosvillas.com)