This Privacy Policy explains in simple terms how OKTO collects, uses, and protects personal data when you visit the oktoreal.gr website, contact us, or make a reservation.

The oktoreal.gr website and OKTO services are managed by “REAL GREEK ESTATE S.A.” (hereinafter “OKTO,” “we” or “us”), which acts as the Data Controller for the personal data collected through the website and related services. For questions regarding this Policy or to exercise your rights, please contact us at reservations@oktoreal.gr or (+30) 273 1131 197. The company’s full details are provided in the website’s Terms of Use.

Data processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR), applicable Greek law, and the rules governing privacy in electronic communications.

1. When Does the Policy Apply?

This Policy applies when you browse the website, use a contact or booking form, contact us via email or phone, make a payment or settle a booking, and generally when you provide us with data in connection with OKTO’s hosting services.

2. What data do we collect?

Depending on how you use our website and services, we may collect the following categories of data:

• Reservation details: full name, email address, phone number, selected accommodation, dates of stay, number of guests, accommodation preferences, and any additional information you send us.
• Contact information: name, contact details, message content, and communication history with us.
• Payment and billing details: transaction amount, payment status, transaction date, transaction ID, billing information, and information necessary to confirm a prepayment or full payment.
• Technical data: IP address, browser, device, operating system, date and time of visit, technical logs, and cookie data.
• Statistical or analytical data: information regarding website usage, preferably in aggregated or anonymized form, to the extent permitted by law and the user’s consent preferences.

We do not ask you to send us special categories of personal data, such as health data, religious or political beliefs. If you choose to disclose such information to us—for example, a special accommodation need—we will use it only to the extent necessary to fulfill your request. website, preferably in an aggregated or anonymized form, to the extent permitted by law and the user’s consent preferences.

3. How We Use the Data

We use personal data to manage requests and reservations, check availability, send confirmations, provide accommodation services, process payments or settlements, respond to messages, and comply with our legal tax and accounting obligations.

In addition, we use technical data to ensure website security, prevent fraud, provide technical support, troubleshoot issues, and improve the user experience, always to the extent permitted by law and your choices.

4. Legal Bases for Processing

The processing is based, as applicable, on the performance of a contract or on taking steps prior to entering into an accommodation contract, when you submit a reservation request or make a payment. It is also based on a legal obligation for tax, accounting, and regulatory purposes; on your consent where required, such as for non-strictly necessary cookies or informational communications; and on OKTO’s legitimate interest in website security, customer service, fraud prevention, and the protection of its legal rights.

5. Payments via Stripe

The website may offer the option of online payment through the payment provider Stripe. Depending on the timing of the reservation, payment may be a deposit, full payment, or payment of the balance via a secure payment link sent to the customer’s email address.

OKTO does not collect or store full credit or debit card details on its own servers. Card information is processed and transactions are completed through Stripe, in accordance with Stripe’s terms, security measures, and privacy policy.

6. Cookies and Similar Technologies

This website uses cookies and similar technologies to ensure its proper functioning, to preserve basic settings, to ensure security, to provide the services requested by the user, and—provided the necessary consent has been given—for statistical analysis or other optional features.

Strictly necessary cookies are used without prior consent when they are essential for the website to function or for a service you have requested. For all non-strictly necessary cookies, consent is requested through the cookie management mechanism. Detailed information about the categories, duration, and management of cookies is provided in the website’s Cookie Policy.

7. Who receives the data

OKTO does not sell or rent personal data. Data is shared only when necessary for the operation of our website and services, or when required by law.

• To payment providers, particularly Stripe, for the secure processing of payments and refunds.
• To providers of web hosting, technical support, reservation systems, email, or tools that support our operations.
• To accountants, tax advisors, legal advisors, or other professionals, when necessary for legitimate professional purposes.
• To public, regulatory, or judicial authorities, when required by law or to protect our legal rights.

Our partners acting on our behalf are required to process data only in accordance with our instructions and to implement appropriate security and confidentiality measures.

8. Transfers Outside the European Economic Area

Some technology providers or payment providers may process data outside the European Economic Area. Where required, appropriate safeguards are implemented in accordance with the GDPR, such as standard contractual clauses, adequacy decisions, or other lawful means of transfer.

9. Retention period

We retain personal data only for as long as is necessary for the purposes for which it was collected, unless a longer retention period is required by law or to protect our legitimate rights.

• Communication requests are retained for as long as necessary to process the request and, as a general rule, for up to 24 months from the last communication, unless there is a legitimate reason to retain them for a longer period.
• Reservation, payment, and document data are retained for as long as required by tax, accounting, and other applicable laws.
• Τα τεχνικά δεδομένα και τα δεδομένα cookies διατηρούνται σύμφωνα με τη διάρκεια που αναφέρεται στην Πολιτική Cookies ή στις ρυθμίσεις του μηχανισμού συγκατάθεσης.

10. Your Rights

Under the GDPR, you have the right to be informed, to access your data, to have it corrected, to have it deleted, to restrict processing, to data portability, to object, and to withdraw your consent when processing is based on consent. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you.

To exercise your rights, please contact us at reservations@oktoreal.gr. We will respond to your request within the timeframe specified by applicable law.

11. Data Security

We take appropriate technical and organizational measures to protect personal data from unauthorized access, loss, alteration, disclosure, or misuse. Data transmission via the website is carried out using secure SSL/TLS encryption, where applicable. Although we make reasonable efforts to protect data, no method of transmission or storage over the internet can be considered completely secure.

12. Policy Updates

OKTO may amend this Privacy Policy as necessary, including, but not limited to, due to changes in legislation, services, the website, or the providers used. Each new version is published on this page.