Privacy Policy
What personal data Stay Koufonisia collects, why, who receives it and your rights.
Version 2026-11-01
Who is responsible
Stay Koufonisia is run by the host, George Simos, a private individual in Greece, who is the controller of your personal data. For anything about your data, write to geosimos91@gmail.com.
What we collect
| Data | Where it comes from |
|---|---|
| Your dates, number of guests, name and email, and your phone number and message if you add them | You, when you send a booking request |
| Our email conversation with you, and the details we agree for your stay | You and us, by email |
| Your IP address | Your browser, with every visit; our host logs it, and we count booking requests by it to stop abuse |
The site has no accounts, no analytics and no advertising. We don't take payments on the site or ask for card numbers. Cookie Policy lists what the site keeps in your browser.
If you book on Airbnb instead, Airbnb collects your details and shares what we need with us as your hosts, under Airbnb's Privacy Policy. We receive what Airbnb shares with hosts (your name, messages and dates), use it only to host you, and keep it as described below.
Why we use it
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Answering your request, confirming your stay and hosting you | Steps you asked for before a contract, and the contract itself (Art. 6(1)(b)) |
| Keeping booking records that tax and accounting law requires | Our legal obligation (Art. 6(1)(c)) |
| Counting booking requests per IP address to stop abuse, and keeping the site secure | Our legitimate interest in a site that works (Art. 6(1)(f)) |
| Showing the Google Map, if you allow it on the map or in Manage cookies | Your consent (Art. 6(1)(a)) |
| Emailing you an occasional offer for a future stay, after you have stayed with us on a direct booking | Our legitimate interest in inviting past guests back, as the law allows for existing customers (Art. 6(1)(f); Greek Law 3471/2006, Art. 11(3)) |
We send offers only to guests who booked directly with us, never to details we receive through Airbnb, and never if you tick “Don't email me offers” on the booking form. Every offer says how to stop them: reply and say so, or use its unsubscribe link, and we won't send another.
We make no decisions about you based only on automated processing. You need to give your name and email for us to answer a request; the phone number and message are up to you.
Who receives it
- Our providers, who process data for us under contract. They are listed, with what each one receives, on the service providers page.
- Google, which runs our email (Gmail). Your request and our emails with you are stored there, worldwide, and Google uses them under its own privacy policy.
- Google, for the map, only if you allow it. Google receives your IP address and browser details and uses them under its own privacy policy. We are responsible only for passing them on, which happens only with your consent.
- Authorities, only when the law requires it.
Where it is stored
Some of our providers are in the United States. Each of them is certified under the EU-US Data Privacy Framework or bound by the EU Standard Contractual Clauses in its data processing agreement.
How long we keep it
- Requests that don't become a stay: 12 months after our last email.
- Confirmed stays: as long as Greek tax law requires us to keep records, generally 5 years after the end of the tax year of the stay, and longer while a tax audit is open.
- Your name and email for offers: until you ask us to stop, and no longer than 3 years after your last stay.
- The count of booking requests per IP address: up to 20 minutes.
- The request logs of our host, Vercel: up to 30 days.
- If you allow the map: 1 year in your browser (7 days in Safari).
Your rights
You can ask us for a copy of your data, to correct it, delete it, limit how we use it, or send it to you or another service in a portable format. You can object to uses based on our legitimate interest, and withdraw consent at any time. Write to geosimos91@gmail.com; we answer within one month.
You can complain to the Hellenic Data Protection Authority (dpa.gr) or the authority in the EU country where you live.
Changes to this policy
When we change this policy, we update it here and change the version at the top.