This Privacy Policy explains how Baklava Villa (“we”, “us”, or “our”) collects, uses, and protects personal data obtained through our contact form and booking calendar in accordance with the European Union General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).

1. Data Controller

Baklava Villa is the Data Controller responsible for your personal data.

• Controller Name: Baklava Villa

• Email: baklavavilla@hotmail.com

• Address: Baklava Villa, Erisos 280 84, Greece.

• Phone: +13033556488

2. Personal Data We Collect

When you interact with our website, submit an inquiry, or book an appointment or reservation through our booking calendar, we collect the following personal information:

• Identity Data: First name, last name.

• Contact Details: Email address, phone number.

• Booking & Inquiry Data: Reservation date and time, party size/service requested, special requests, and any details entered into message or notes fields.

• Technical Metadata: IP address, browser type, device information, and submission timestamps (captured automatically for fraud prevention and website security).

We do not knowingly collect any special categories of personal data (such as health details, religious beliefs, or biometric information).

3. Legal Bases and Purposes of Processing

Under Article 6 of the GDPR, Baklava Villa processes your personal data on the following legal grounds:

• Managing Bookings & Inquiries

  • Data Used: Name, email, phone number, booking slot, notes.

  • GDPR Legal Basis: Article 6(1)(b) – Contract (Necessary to execute a booking or take steps at your request prior to a reservation).

• Customer Support & Communications

  • Data Used: Name, email, phone number, message text.

  • GDPR Legal Basis: Article 6(1)(b) – Contract or Article 6(1)(f) – Legitimate Interest (Directly addressing your incoming inquiries).

• Service Reminders & Updates

  • Data Used: Email, phone number.

  • GDPR Legal Basis: Article 6(1)(b) – Contract (Essential non-promotional alerts concerning your reservation).

• Marketing & Follow-Up Emails

  • Data Used: Name, email.

  • GDPR Legal Basis: Article 6(1)(a) – Consent (Only sent when you affirmatively check our optional opt-in box).

• Security & Statutory Obligations

  • Data Used: IP address, timestamp, transaction logs.

  • GDPR Legal Basis: Article 6(1)(c) – Legal Obligation & Article 6(1)(f) – Legitimate Interest (Maintaining audit trails and protecting against spam).

4. Third-Party Service Providers (Data Processors)

Baklava Villa does not sell or rent your personal information. We share data only with selected processors necessary to deliver our website services, each operating under a Data Processing Agreement (DPA):

• Calendar & Scheduling Providers: [e.g., Calendly, Cal.com, or your reservation system] for scheduling and slot allocation.

• Email & CRM Platforms: [e.g., Mailchimp, Brevo, ActiveCampaign] for dispatching automated confirmations and marketing newsletters.

• Hosting & Infrastructure: [e.g., Cloudways, AWS, DigitalOcean] for secure web hosting and database backups.

International Transfers

Where any third-party processor operates outside the European Economic Area (EEA), transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission or valid certifications under the EU-U.S. Data Privacy Framework.

5. Data Retention

We retain your personal data only as long as necessary to achieve the original collection purposes:

• Booking Records: Retained for the duration of the reservation process, plus 24 months to address any follow-up inquiries or accounting requirements.

• Marketing Lists: Retained until you withdraw your consent or click unsubscribe. Profiles showing no activity for 24 months are purged.

• Server Logs: Retained for technical diagnostics and spam prevention for up to 90 days.

6. Your Rights Under GDPR

Under EU data protection legislation, you possess the following rights regarding your data:

• Right of Access (Art. 15): Request a copy of the personal information Baklava Villa holds on you.

• Right to Rectification (Art. 16): Request corrections to outdated or incomplete details.

• Right to Erasure (Art. 17): Request the permanent deletion of your data when retention is no longer legally required.

• Right to Restriction of Processing (Art. 18): Restrict how your personal records are processed.

• Right to Data Portability (Art. 20): Obtain your information in a structured, commonly used machine-readable format.

• Right to Object (Art. 21): Object to data processing based on legitimate interests or direct marketing.

• Right to Withdraw Consent (Art. 7(3)): Revoke your marketing consent at any time without retroactive penalties.

To exercise any of these rights, contact our privacy team at baklavavilla@hotmail.com We will process your request within 30 days without cost. You also reserve the right to submit a complaint to your local EU Data Protection Authority.