Privacy Policy

Operator Manthos Tourism Enterprises SA Trading name Manthos Mountain Resort & Spa Registered details VAT 099962110 | MITE 1163752 Location Chania Pelion, Thessaly, Greece, 370 11 Contact info@manthosmountain.com | +30 24280 96402 Website https://manthosmountain.com

You can ask for access, correction, deletion, restriction or portability of eligible data, object to certain processing, and withdraw consent at any time. Marketing emails include an unsubscribe option. Privacy requests can be sent to info@manthosmountain.com.

Manthos Tourism Enterprises SA, VAT 099962110, trading as Manthos Mountain Resort & Spa, is the data controller for the processing described in this policy. The operator is established in Greece at Chania Pelion, Thessaly, Greece, 370 11. This policy is designed to reflect the EU General Data Protection Regulation (GDPR), Greek Law 4624/2019 and Greek Law 3471/2006 on privacy in electronic communications, together with other applicable requirements. Some booking channels, travel providers, payment services and other partners act as independent controllers for their own processing. Their privacy notices apply in addition to this policy.

This policy applies to personal data collected through manthosmountain.com, direct email and telephone communication, booking and enquiry forms, the hotel's reservation and guest-service processes, on-site services, social media interaction, newsletters, group and event arrangements, and related digital services. It does not replace the privacy notices of a travel agent, online travel agency, package organiser, airline, payment provider, external activity provider or linked website. Where a separate on-site notice applies to a specific activity, such as CCTV or employee processing, that notice should be read with this policy.

Depending on your relationship with us, we may collect:

● identity data, including name, title, date of birth, nationality and identity-document details where required;

● contact data, including postal address, email address, telephone number, country and communication preferences;

● reservation and stay data, including dates, room, occupancy, guest names, rate, requests, preferences, loyalty or corporate details and booking history;

● transaction data, including charges, payment status, partial card information or payment tokens, refunds, invoices and billing details;

● guest-service data, including restaurant, spa, event, activity, complaint, lost-property and customer-service records;

● technical and usage data, including IP address, device, browser, operating system, referring source, date and time, viewed pages, navigation, approximate location, cookie identifiers and security logs;

● marketing data, including newsletter status, interests, campaign interaction and consent records;

● content you provide, including messages, reviews, survey responses, photographs or social-media interaction; and

● limited sensitive data you choose to provide, such as accessibility, allergy, dietary or health information needed to arrange a safe and suitable service. We do not intentionally collect full payment card details through our own website servers. Online payment providers handle card information under their security standards. We receive transaction status, masked details or tokens where needed to administer payment.

We collect data directly from you, from a lead guest or event organiser acting for you, automatically through website and security technology, and from third parties involved in your booking or stay. These may include travel agents, online travel agencies, tour operators, payment providers, package providers, corporate clients, event organisers, social networks and public authorities. If you give us data about another person, you must be authorised to do so and should make this policy available to them.

We use personal data only where we have a lawful basis. The principal purposes and bases are: Purpose Typical data Legal basis Enquiries and reservations Identity, contact, booking, preference and payment-status data. Steps at your request and performance of a contract. Accommodation and guest services Stay, service, request, complaint and incident data. Performance of a contract; legitimate interests in service and operations. Payment, accounting and tax Transaction, invoice, identity and booking data. Performance of a contract; legal obligation; legitimate interests in debt and fraud prevention. Safety, security and misuse prevention Identity, access, technical, incident and relevant guest data. Legitimate interests; legal obligation; protection of vital interests where necessary. Service improvement and analytics Usage, feedback, booking-pattern and aggregated data. Legitimate interests; consent where non-essential cookies or similar technology are used. Direct marketing Contact, preference, consent and campaign interaction data. Consent, or legitimate interests where electronic-marketing law permits. Legal claims and compliance Relevant reservation, communication, transaction and incident data. Legal obligation; legitimate interests in establishing, exercising or defending claims. Sensitive guest needs Health, allergy, dietary or accessibility information you choose to provide. Explicit consent, or another Article 9 GDPR condition where applicable. Where we rely on legitimate interests, we balance the business need against your rights and reasonable expectations. You may request more information about that assessment.

Some data is required to enter into or perform a booking, process payment, identify guests, issue an invoice, comply with accommodation or tax rules, or keep people and property safe. If required data is not provided, we may be unable to confirm or fulfil a reservation or service. Marketing participation and most preference information are optional. You can withdraw marketing consent without affecting your reservation or stay.

Please provide only the health, dietary, allergy or accessibility information reasonably necessary for your request. We use it to make suitable arrangements, protect health and safety and deliver the requested service. Access is limited to staff or providers who need the information. Where processing relies on explicit consent, you may withdraw that consent. Withdrawal does not affect processing already carried out and may limit our ability to fulfil the related request.

We may share relevant data with:

● hotel employees, authorised contractors and companies supporting reception, reservations, housekeeping, food and beverage, spa, events, IT, security, marketing, accounting and legal services;

● booking engines, online travel agencies, travel agents, tour operators, airline package providers and event or group organisers;

● payment processors, acquiring banks, card networks, fraud-prevention services and financial institutions;

● technology providers, including hosting, cloud, cybersecurity, analytics, map, communication and email-marketing services;

● professional advisers, insurers, auditors and counterparties to a business transaction, under appropriate confidentiality; and

● police, courts, tax, tourism, health or other competent authorities where required or lawfully requested. We do not sell personal data. Service providers are permitted to use data only for the agreed service and must apply appropriate protection. Independent controllers use data under their own legal obligations and privacy notices.

Some service providers may process data outside Greece or the European Economic Area. Where the destination does not benefit from an EU adequacy decision, we use an approved safeguard where required, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where appropriate. You may contact us for information about the relevant transfer safeguard. Commercially sensitive or third-party confidential details may be redacted where permitted.

We keep personal data only as long as reasonably necessary for the purpose collected, including legal, accounting, reporting, security and claims requirements. Typical guide periods are: Record Typical period Reservation, stay, invoice and payment records For the statutory tax and accounting period, generally at least 5 years, and longer where law or an active claim requires. Enquiries not resulting in a booking Up to 24 months after the last meaningful contact. Guest-service and complaint records Usually up to 5 years after closure, depending on seriousness and claim risk. Marketing and newsletter records Until you unsubscribe or withdraw consent; suppression records may be retained to honour the request. Website security and technical logs Usually up to 12 months, unless needed for an investigation, incident or legal claim. Cookie and analytics data For the period shown in the consent tool or relevant provider information. Record Typical period Rights-request records For the request and a reasonable period afterwards to demonstrate compliance. We may retain data longer where required by law, a regulator, litigation hold or a reasonably anticipated dispute. When data is no longer needed, it is deleted, anonymised or securely isolated.

Cookies are small text files stored by a browser. Similar technologies include pixels, local storage and device identifiers. We use them to operate the site, remember choices, protect forms and sessions, understand performance and, with your choice where required, support analytics or marketing. Category Purpose Choice Strictly necessary Core site, security, load balancing, consent memory and booking functionality. Used where necessary; disabling in the browser may break the site. Preferences and functionality Language, map, media, accessibility and remembered choices. Used with consent where required. Analytics and performance Audience measurement, navigation and service improvement. Activated after consent where required. Advertising and social media Campaign measurement, relevant promotion and embedded social content. Activated after consent where required. Depending on the features used and your choices, relevant services may include Cloudflare, Google Analytics, Google Maps, Mailchimp, social-media services, the hotel's booking engine and flight-and-hotel provider. These providers may set their own cookies or process device and usage data under their notices.

Use the website's cookie controls to accept, refuse or change non-essential categories. You can also clear or block cookies in your browser. Withdrawing consent is as easy as giving it and does not affect prior lawful processing. COOKIE-LEVEL DETAILS A current cookie-level inventory, including names, providers and durations, should be displayed in the website consent tool.

We may send news and offers if you consent or where permitted by applicable electronic-marketing law. You can unsubscribe through the message link or contact us. We may retain a minimal suppression record so that we do not send further direct marketing to that address. We may use limited interaction data to understand campaign performance. Advertising or social-media technology that is not strictly necessary is activated only in accordance with applicable consent requirements.

We use organisational and technical measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure or access. Measures may include encrypted transmission, access controls, authentication, firewalls, malware monitoring, backups, supplier review, confidentiality duties and incident procedures. No method is completely secure. Please use trusted devices, protect confirmation details and passwords, and contact us promptly if you suspect misuse. Do not send full card details by ordinary email.

Subject to the GDPR and applicable limitations, you may have the right to:

● receive information and access a copy of your personal data;

● correct inaccurate data and complete incomplete data;

● request deletion in eligible circumstances;

● restrict processing in eligible circumstances;

● receive data you provided in a structured, commonly used and machine-readable format and transmit it to another controller where portability applies;

● object to processing based on legitimate interests, including profiling, and object at any time to direct marketing;

● withdraw consent at any time, without affecting earlier lawful processing; and

● lodge a complaint with a supervisory authority and seek a judicial remedy. To exercise a right, contact info@manthosmountain.com and describe the request. We may request proportionate information to verify identity. We normally respond within one month; the GDPR allows an extension of up to two further months for complex or numerous requests, with notice and reasons. Rights are not absolute. We may retain or withhold limited information where necessary to comply with law, protect another person's rights, maintain legal privilege, or establish, exercise or defend a claim. We will explain any lawful limitation.

Please contact us first so we can try to resolve the concern. You may also complain to the Hellenic Data Protection Authority, the supervisory authority in Greece:

● Website: https://www.dpa.gr

● Address: 1-3 Kifissias Avenue, 115 23 Athens, Greece

● Telephone: +30 210 6475600

● General email: contact@dpa.gr

● English complaint email for eligible persons unable to use the Greek portal: complaints@dpa.gr

You may instead contact the supervisory authority in the EU or EEA country of your habitual residence or place of work where applicable.

Our website and booking services are directed to adults. Data about children may be processed when supplied by a parent, guardian, lead guest or organiser for a family stay, group, event or legal requirement. Please provide only what is necessary. We do not knowingly direct email marketing to children.

We do not currently make decisions that produce legal or similarly significant effects based solely on automated processing. Booking, fraud, pricing or marketing systems may use automated rules to support staff or deliver content. If this changes, we will provide the information and safeguards required by law.

The website may link to booking, travel, mapping, social-media, review, activity and other external services. When you follow a link or interact with embedded content, the third party may collect data independently. Review its privacy and cookie information before providing data.

We may update this policy to reflect changes in services, technology, providers or law. The current version and effective date will be posted on the website. If a change materially affects processing based on consent or requires further notice, we will take the steps required by law.

info@manthosmountain.com | +30 24280 96402 | https://manthosmountain.com