Villa Da Lula – Privacy Notice

Last updated: 11 July 2026

1. Data Controller

P. Fetsis and S.I.A. E.E. (“we”, “us”, “our”)
Tax Identification Number (TIN): 801056831
General Commercial Registry (GEMI): 148034443000
Registered office: Agios Nikitas, Lefkada, 31100, Greece
Email: info@villadalula.com
Telephone: [telephone number]

We operate the website www.villadalula.com and Villa Da Lula, a short-term rental property in Lefkada, Greece (EOT Licence No. 1122049).

We have not appointed a Data Protection Officer (DPO), as we are not required to do so under Article 37 GDPR.

Booking requests submitted through our website are collected by P. Fetsis and S.I.A. E.E., acting as data controller, for the purposes of handling booking requests and fulfilling accounting and tax obligations.

For booking management and communication, certain information may also be shared with FUTURE GROUP E.E., Lefkada, 5 Str. Tsegou, TIN 801671723, which acts as an independent data controller for its own processing activities. Its privacy policy is available at https://whatsongreece.com/privacy-policy/.

Each controller is responsible for the processing carried out through its own systems.

2. Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

Identification and contact information: name, email address, telephone number and country of residence.
Booking information: requested or confirmed dates, number of guests, age category where relevant, special requests and information contained in communications with us.
Payment information: amount, date and payment method. For bank transfers, we may process the name of the person making the payment and, where displayed, the relevant bank account information. We do not collect or store card details.
Technical information: IP address, device and browser information, and information collected through cookies, as described in our Cookie Policy.
Information voluntarily provided by you: if you voluntarily provide information concerning a health condition or other special requirement in order to help us adapt your stay, such information will only be processed where legally permitted and, where required, on the basis of your explicit consent.

We do not intentionally collect special categories of personal data unless you voluntarily provide such information and there is an appropriate legal basis for processing it.

3. Purposes and Legal Bases

We process your personal data for the following purposes:

PurposeLegal basis

Handling booking requests, communicating with you and performing the rental agreementArticle 6(1)(b) GDPR – performance of a contract or steps taken at your request before entering into a contract

Issuing invoices and fulfilling accounting, tax and other legal obligationsArticle 6(1)(c) GDPR – compliance with a legal obligation

Website security, fraud prevention and establishment, exercise or defence of legal claimsArticle 6(1)(f) GDPR – legitimate interests

Sending newsletters, offers or promotional communicationsArticle 6(1)(a) GDPR – consent

Use of non-essential cookiesConsent, in accordance with applicable Greek and EU legislation

The provision of the personal data necessary for a booking is required in order for us to process and manage your request. If you do not provide such information, we may not be able to process your booking.

4. Who We Share Your Data With

Your personal data may be shared, where necessary, with:

Service providers acting as processors, such as Wix.com Ltd. for website hosting and forms, our email provider and any calendar or booking-management software we may use. Where required, appropriate data processing agreements under Article 28 GDPR are in place.
Cleaning or reception personnel, where necessary, and limited to information required for the practical management of your stay, such as your name, number of guests and arrival/departure details.
Our accountant, tax adviser or legal advisers, where necessary.
Public authorities, where disclosure is required by law.
Banks and payment service providers, where necessary for processing payments. Banks act as independent data controllers for their own processing activities.

We do not sell or rent your personal data to third parties.

5. Transfers Outside the European Economic Area

Some of our service providers, such as website, email or technology providers, may process personal data outside the European Economic Area (EEA).

Where this occurs, we rely on an applicable adequacy decision, such as the EU–US Data Privacy Framework where the relevant provider is certified, or on appropriate safeguards such as Standard Contractual Clauses (SCCs) under Article 46 GDPR.

You may contact us to request further information about the safeguards applicable to any international transfer.

6. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with legal obligations.

In general:

Unconverted booking requests: up to 6 months after our last communication with you.
Booking information and related communications: up to 24 months after the end of your stay, unless a longer period is necessary for legal or contractual reasons.
Accounting and tax records: for the period required by applicable tax and accounting legislation.
Newsletter and marketing data: until you withdraw your consent or otherwise object to receiving such communications.
Cookies and technical data: for the periods specified in our Cookie Policy.

Where personal data is no longer required, it will be securely deleted or anonymised, where appropriate.

7. Your Rights

Under the GDPR, you may have the right to:

request access to your personal data;
request correction of inaccurate or incomplete data;
request erasure of your personal data;
request restriction of processing;
request data portability, where applicable;
object to processing based on legitimate interests;
withdraw your consent at any time where processing is based on consent.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) if you believe that your personal data has been processed unlawfully.

Hellenic Data Protection Authority (HDPA)

We will normally respond to requests concerning your rights within one month, subject to the conditions and exceptions provided by law.

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you within the meaning of Article 22 GDPR.

8. Cookies

Our website uses cookies that are necessary for its operation.

Where we use non-essential analytics, advertising or similar cookies, these will only be activated where required after obtaining your consent through our cookie banner.

You may change or withdraw your cookie preferences at any time through the cookie settings available on the website.

Further information is provided in our Cookie Policy.

9. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, disclosure or destruction.

These measures may include HTTPS encryption, two-factor authentication where available, restricted access to personal data and the deletion of documents and information when they are no longer required.

In the event of a personal data breach, we will take the measures required under Articles 33 and 34 GDPR, including notification to the competent supervisory authority and, where legally required, to affected individuals.

10. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our services, applicable legislation or our data-processing practices.

The most recent version will always be available on www.villadalula.com.