Privacy Policy

1. DATA CONTROLLER

Anesis Living I.K.E. (trading as Ena & Ena), Militou, Kos 85300, Greece · VAT EL802986257 · GEMI 186812720000. Contact: info@oneandone.gr · +30 22420 583490. We have not appointed a Data Protection Officer; enquiries go to the address above.

2. WHAT WE COLLECT

• Booking data. Name, email address, phone number, country, arrival and departure dates, number and age bracket of guests, sleeping-setup and cot preferences, special requests, and the rate plan you chose.
• Payment data. Payment confirmation, amount, currency and the last four digits and brand of the card, as returned to us by Stripe. We never receive your full card number or security code.
• Guest-registration data. Full name and identity or passport details of each guest, collected before or at arrival because Greek law requires accommodation providers to register guests.
• Portal data. A signed access token stored in your browser so you can open your booking portal, plus a log of the changes and cancellations you request there.
• Correspondence. Messages you send through the contact form, by email, phone or WhatsApp.
• Website data. IP address, device and browser type, pages viewed and referral source, collected through cookies and similar technologies as described in our Cookie Policy. Analytics and marketing data is collected only after you consent.

3. WHY WE PROCESS IT & LEGAL BASIS

• To answer your enquiry, process your payment and arrange your stay — performance of a contract (Art. 6(1)(b) GDPR).
• To comply with tax, accounting and guest-registration obligations — legal obligation (Art. 6(1)(c) GDPR).
• To send booking confirmations, pre-arrival instructions and, where a checkout was started but not completed, a single reminder email — performance of a contract and our legitimate interest in completing the reservation you began (Art. 6(1)(b) & (f) GDPR).
• To measure website traffic and to run and optimise advertising on Google and Meta — your consent given through the cookie banner (Art. 6(1)(a) GDPR).
• To prevent fraud, secure the site and establish or defend legal claims — our legitimate interest (Art. 6(1)(f) GDPR).

4. WHO RECEIVES YOUR DATA

We do not sell your data. We share the minimum necessary with the following categories of recipient:

• Stripe Payments Europe, Ltd. — payment processing and fraud prevention. Stripe acts as an independent controller for those transactions.
• Hosthub — our channel manager, which synchronises availability, rates and reservation details across our booking channels.
• Hosting, database and email infrastructure providers — who store the site and our booking records and deliver our transactional emails, strictly on our instructions.
• Google and Meta — analytics and advertising measurement, only where you have consented to those cookie categories.
• Our accountant and the Greek tax and tourism authorities — where required by law, including statutory guest registration.
• When you book through Booking.com or Airbnb, their own privacy policies also apply to that reservation.

5. INTERNATIONAL TRANSFERS

Some of our processors — notably Stripe, Google and Meta — are established in or transfer data to the United States. Those transfers rely on the European Commission’s Standard Contractual Clauses and, where applicable, on the EU–US Data Privacy Framework, together with additional technical safeguards such as encryption in transit and at rest.

6. HOW LONG WE KEEP IT

• Enquiries and abandoned bookings that do not lead to a stay — up to 24 months.
• Completed stays and financial records — as long as Greek tax law requires, currently 5 to 10 years.
• Guest-registration records — for the period prescribed by the applicable Greek legislation.
• Booking-portal tokens — until they expire, and in any case no longer than the stay plus 90 days.
• Cookie-based analytics and advertising data — for the durations listed in the Cookie Policy.

7. YOUR RIGHTS

Under the GDPR you have the right to access, rectify, erase, restrict or port your personal data, to object to processing based on our legitimate interest, and to withdraw consent at any time without affecting processing already carried out. There is no automated decision-making or profiling with legal effect. To exercise any right, email info@oneandone.gr; we answer within one month. You may also lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

8. SECURITY

We apply reasonable technical and organisational measures to protect your data from unauthorised access, loss or disclosure, including TLS encryption of all traffic, access control on our booking records, signed portal tokens and encrypted payment processing through Stripe.

9. CHILDREN

This website is not directed at children. Data about minors is processed only as part of a booking made by an adult lead guest, and only to the extent required for occupancy and statutory guest registration.

10. CHANGES & CONTACT

We update this policy when our tools or obligations change and publish the new version here with a fresh date. See also our Cookie Policy and Terms & Conditions. Anesis Living I.K.E. · Militou, Kos 85300, Greece · info@oneandone.gr.