Privacy notice

Who we are

Epavli Papadopoulou, 15 Protis Maiou, 7640 Kornos, Larnaca, Cyprus (licence AEMAK-LAR-0000626) is responsible for your personal data ("we", "us").

Email: stay@epavlipapadopoulou.com · Phone: +357 96 444 700.

What we collect

• Contact details: name, email address, phone number, country, language.
• Booking details: dates of stay, number of guests, requests, prices, receipts and invoices, payments and vouchers.
• Pre check-in answers: arrival and departure times, travelling party and the other details you give in the Pre Check-In form.
• Identity document: photos of your passport, national ID card or driving licence (and the document number and expiry date you enter).
• Your signature, drawn on the Pre Check-In form, and your acceptance of our Terms & Conditions.
• Emails we send to you and the messages you send to us (including the contact form).
• Technical data needed for security, such as an IP address in server logs when you use the Pre Check-In form.

Why we use it

• To prepare and carry out your booking (the contract between you and us): confirmations, arrival information, door codes, invoices.
• To meet legal obligations, in particular the registration of guests and keeping accounting records.
• For our legitimate interest in the safety and security of the property, our guests and our staff, and in preventing fraud and damage.
• To send our newsletter to past guests, on the basis of our legitimate interest; every email has a one-tap unsubscribe link and we stop at once when you use it.

We do not sell your data and we do not use it for advertising or profiling.

Who can see it

Only our staff who need it for their work, each with their own sign-in and permissions. The ID photos and signature are visible only to the staff members we have specifically allowed.

We use service providers who process data on our behalf:

• Hosting: DigitalOcean (the server that runs this website and our back office).
• File storage and backups: Amazon Web Services S3 (documents, ID photos, backups).
• Email sending: Brevo (newsletters) and our email service provider (booking, document and pre check-in emails).
• Google Maps: only if you tap "Show map". Until then no request is made to Google.

If you tap the WhatsApp, Instagram, Facebook or map links, you leave this website and those services apply their own privacy rules. We do not share your data with anyone else unless the law requires it.

How long we keep it

• Pre Check-In link: deleted automatically 6 months after it was created (or 6 months after your check-out date, whichever is later). Only the link is removed.
• Pre check-in answers, ID photos, signature and your guest record: at present these are not deleted automatically after a fixed period. We keep them for as long as we need them for guest registration, legal obligations and security, and we delete them earlier when you ask (see "Your rights").
• Receipts, invoices and payment records: kept as long as accounting and tax rules require; they are not deleted automatically.
• Emails we sent you (record of what was sent) and nightly backups: kept; they are not deleted automatically.
• Your guest page (arrival information and door codes): deleted automatically 48 hours after the thank-you page starts, after your check-out.
• Save the Date pages: deleted 7 days after the event.
• Stored voucher PDFs: deleted 2 years after the voucher expires.
• Newsletter: until you unsubscribe. We then keep only your address on a do-not-email list, so that we do not write to you again.

Your rights

You can ask us for access to your data, correction, deletion, restriction of processing, a copy of your data (portability) and you can object to processing based on our legitimate interest. Write to stay@epavlipapadopoulou.com and we will answer within one month. Some records (for example invoices) we must keep by law.

You can complain to the Office of the Commissioner for Personal Data Protection of Cyprus (www.dataprotection.gov.cy).

Cookies and similar storage

We use no advertising, tracking or analytics cookies. Only strictly necessary items are used:

• csrftoken (cookie, up to 1 year): protects forms such as the Pre Check-In form and the unsubscribe page against forged requests.
• sessionid (cookie, 2 weeks): used only when our staff sign in to the back office. Visitors and guests do not receive it.
• Language choice: the cookie "gpl" on the guest page (1 year) and the browser storage items "epavli_lang" and "epavli_precheckin_lang" remember the language you picked on this device.

Because these are strictly necessary or simply remember your choice, there is no cookie banner. If you tap "Show map", Google Maps loads and Google may set its own cookies.

Changes

We may update this notice. The date at the top shows when it last changed.