Privacy & Data Protection Policy

At Jollyporchbackstag Ltd. ("Jollyporchbackstag", "we", "our", or "us"), we are committed to safeguarding the privacy and personal data of our guests, villa owners, and website visitors. This comprehensive Privacy Policy outlines how we collect, store, process, and protect your information in compliance with the European General Data Protection Regulation (EU GDPR 2016/679), the Greek Data Protection Law (Law 4624/2019), and the California Consumer Privacy Act (CCPA).

1. Data Controller Information

The entity responsible for processing your personal data is:

• Legal Entity: Jollyporchbackstag Ltd.
• Registration Number: HE-8941029-GR
• Physical Headquarters: 28 Leoforos Posidonos, Glyfada, 16674 Athens, Greece
• Data Protection Officer (DPO): [email protected]

2. Categories of Information We Collect

We collect personal information directly from you when you submit booking inquiries, contact our concierge, or browse our interface:

• Identification Data: Full name, passport number, nationality, and date of birth for Greek municipal guest registry requirements.
• Contact Information: Email address, mobile telephone number, and residential billing address.
• Stay & Itinerary Preferences: Requested islands (e.g. Santorini, Mykonos, Paros), dates of stay, party size, dietary requirements, and concierge transport requests.
• Technical & Telemetry Data: IP address, device type, browser specifications, WebGL hardware capabilities, and cookie identifiers.

3. Legal Bases for Data Processing

Under GDPR Article 6, we process your personal data under the following legitimate grounds:

• Performance of a Contract: To arrange, confirm, and manage your luxury villa reservations and local services.
• Legal Obligation: To comply with Hellenic tax reporting, tourist tax documentation, and security protocols.
• Legitimate Interests: To improve website performance, protect against fraudulent inquiries, and elevate customer service.
• Consent: For marketing newsletters, tailored seasonal invitations, and non-essential analytical cookies.

4. Third-Party Processors & Data Sharing

We do not sell, rent, or trade your personal data to third parties. We share information only with strictly vetted service providers bound by Data Processing Agreements (DPAs):

• Local villa property managers and registered Greek hospitality operators.
• Secure PCI-DSS certified payment processors (e.g. Stripe, bank wire escrows).
• Cloud hosting providers and infrastructure partners maintaining EU-based server centers.

5. Your Rights Under GDPR & CCPA

As a data subject, you hold distinct statutory rights regarding your personal data:

• Right to Access: Request a full copy of the data we hold concerning your person.
• Right to Rectification: Request correction of incomplete or erroneous personal records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal records, subject to statutory tax retention periods.
• Right to Restriction of Processing & Data Portability: Obtain your data in a structured, machine-readable format.
• Right to Object: Withdraw marketing consent at any given time without charge.

To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We respond to all verified inquiries within 30 calendar days.