Privacy & cookie policy

Who is responsible

The controller is ΛΙΩΡΗΣ ΣΠΥΡΙΔΩΝ ΤΟΥ ΚΩΝΣΤΑΝΤΙΝΟΥ (Corfu Guest App), Παράσχου 48, Νίκαια Αττικής 18454, Greece, VAT no. EL112980329.
For anything about your data: info@corfuguestapp.gr · +30 698 578 3099.

What we keep, why, and on what legal basis

When you order

• Name, e-mail, phone, property name, notes and — if you ask for an invoice — company name and VAT number; the rest of the invoice details (tax office, address, business activity) we take from the Greek tax authority (ΑΑΔΕ) records using the VAT number. To perform the contract (GDPR art. 6(1)(b)) and to issue the tax document the law requires (art. 6(1)(c)).
• Payment details: amount, date, the Viva.com order and transaction codes and the last 4 digits of the card. You type the full number, expiry date and CVV only on Viva's page; we never see or store them.
• IP address and browser at the time of the order, to prevent fraud and to be able to show what happened if a charge is disputed (legitimate interest, art. 6(1)(f)).
• The date you accepted the terms and, if you ticked it, that you asked us to start straight away — because the law makes us prove what we told you before you bought (art. 6(1)(c)).

Name, e-mail and phone are required: without an e-mail we cannot send you the confirmation or the app, and we need the phone to reach you quickly if something is missing from your property details or the delivery. The other fields are optional.

When you send us your property details

The text, photos, property contact details and anything else you put into your owner portal or the property form, so that we can build your app and keep it online (performance of the contract, art. 6(1)(b)). Whatever you put in the app is seen by your guests — that is what it is for.

When you use your property's owner portal

Your e-mail, your password (kept only in a non-reversible form), which property you manage, whatever you write or upload, when you accepted which version of the terms and, if you turn on notifications, a notification identifier for your device. To run the owner portal (performance of the contract, art. 6(1)(b)) and to be able to prove what you accepted (legitimate interest, art. 6(1)(f)). Your guests' data that passes through the owner portal we process on your behalf, as set out in the terms.

When you report content to us

Where the content is, what it is about and why you consider it illegal, your name and e-mail, and when you reported it. To review the report and reply to you, as the Digital Services Act, Regulation (EU) 2022/2065, requires (legal obligation, art. 6(1)(c)). We give your name to the owner of the guide only where strictly necessary, for example in a copyright report.

When you withdraw

Name, e-mail, order reference (if you give it), your comment, date and time, IP and browser. We keep them as proof of your statement and to refund you (legal obligation, art. 6(1)(c) — Greek law 2251/1994).

When you write to us through the contact form

Name, e-mail and your message, only to reply to you (art. 6(1)(b) and (f)). Against spam the form uses Google reCAPTCHA, which loads only once you start filling it in (legitimate interest). If you would rather not use it, e-mail us directly at info@corfuguestapp.gr.

When you visit the site

• Like any web server, ours logs the IP, page, time and browser of each request, for security and to keep it running (legitimate interest).
• Visitor statistics (Google Analytics) only if you press “Accept” in the cookie notice (consent, GDPR art. 6(1)(a) and Greek law 3471/2006 art. 4(5)). Without it, not even Google's script is loaded.

We do not sell data, we do not send marketing you did not ask for, and we take no decisions about you based solely on automated processing or profiling.

Who else sees it

• Viva.com (Viva Payment Services, Greece) — processes the payment as an independent controller under its own privacy policy, published on viva.com.
• Contabo GmbH (Germany) — our server, e-mail and backup provider, acting on our behalf.
• DeepL SE (Germany) — translates into the guide's other languages the texts owners write in the owner portal; not the chat messages.
• Google (Google Ireland Ltd / Google LLC) — Google Analytics (consent only), reCAPTCHA on the contact form, and Google Fonts, which receives your IP address when it serves the fonts.
• jsDelivr (content delivery network) — serves two libraries used by the contact form and receives your IP address.
• Our accountant and our e-invoicing provider, to issue the tax documents, and the Greek tax authority AADE (myDATA), as the law requires.
• Public authorities, only where the law requires it.

Transfers outside the European Union

Google LLC and jsDelivr may also process data in the USA. For Google the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Decision (EU) 2023/1795). Notifications from the owner portal and the chat are delivered through the browser's push service (Google, Apple, Mozilla or Microsoft), which receives only a device identifier and an encrypted message and may be located outside the EU. Everything else is stored in the EU.

How long we keep it

• Paid orders and tax documents: 5 years from the end of the tax year of the purchase, as tax law requires — longer only while a tax audit or a dispute is open.
• IP, browser and the data Viva returns to us: 18 months from payment, which covers the window for disputing a charge; then we delete them.
• Orders that were never paid: 6 months.
• Withdrawal statements: as long as the order they refer to. If you withdraw, we close your owner-portal account and delete the property within 30 days, keeping only what tax law requires.
• Content reports: 2 years from our decision.
• Owner-portal account: for as long as you have access; the record of your acceptance of the terms, 5 years from the end of our cooperation, in case of a dispute.
• Contact-form messages: 2 years from the last contact, unless they led to an order.
• Your property material: while your app is active and 3 months after, so you can ask for a copy.
• Google Analytics statistics: 2 months.
• Server backups rotate within about 2 weeks.

Your rights

You can ask for access to your data and a copy of it, rectification, erasure, restriction of processing and portability (getting it in a machine-readable format). Where we rely on your consent you can withdraw it at any time, without affecting what happened before — for cookies, from “Cookie settings” at the bottom of every page. Some records cannot be erased before the period set by tax law has passed.

For any of these, write to info@corfuguestapp.gr. We reply within one month, free of charge.

You also have the right to lodge a complaint with the Greek Hellenic Data Protection Authority: Kifisias 1-3, 115 23 Athens, tel. +30 210 6475 600, www.dpa.gr.

Security

The whole site runs over an encrypted connection (HTTPS) only. Card details never reach us. The order records cannot be reached from the internet and only we open them.

Cookies

These are all the cookies on this site. The essential ones are needed for the forms and the payment to work and do not require consent. The statistics ones are not loaded at all — not even Google's script — until you press “Accept”.

You can change your choice at any time. If you withdraw consent, we delete the Google Analytics cookies from your browser.

Cookie settings

Last updated: 31/10/2026