Privacy Policy

Who we are

This website is operated by Legacy Suites, an accommodation business at Despotika, 846 00 Mykonos, Greece, registered with the Greek National Tourism Organisation under MHTE 1173K134K1365601.

For anything concerning personal data, including the requests described under Your rights, contact info@legacy-mykonos.com or telephone +30 22890 28003.

Definitions

Personal Data

any information relating to an identified or identifiable natural person.

Processing

any operation or set of operations performed on Personal Data or on sets of Personal Data.

Data subject

a natural person whose Personal Data is being Processed.

Child

a natural person under 16 years of age.

We / us

Legacy Suites, as described above.

Data protection principles

We follow these principles:

• Processing is lawful, fair and transparent. Our processing has lawful grounds, we consider your rights before processing, and we will tell you about our processing on request.
• Processing is limited to its purpose. What we do with personal data fits the purpose it was gathered for.
• Processing uses minimal data. We gather only what a purpose actually requires.
• Processing is limited in time. We do not keep personal data for longer than it is needed.
• We do our best to keep data accurate.
• We do our best to keep data confidential and intact.

What we collect

This site has no user accounts, no shop, no shopping cart and no comments. There is nothing to log in to. Personal data reaches us in three ways.

What you send us through the enquiry form

your name and email address, which the form requires; your telephone number, your message, your preferred arrival and departure dates, the resulting number of nights, and the suite you are asking about, each where you choose to provide it; and the language you were using, so we can reply in it.

What your browser sends when you submit the form

your IP address, used at the moment of submission to limit how often the form can be sent from one source. It is used to count requests and is not stored with your enquiry.

What is stored in your own browser

your cookie choice and your language preference. These stay on your device, are read only by this site, and are not personal data we hold.

We do not ask for payment details on this website. Reservations are completed on an external booking platform — see Other services.

How we use it

We use the personal data described above to:

• read and answer your enquiry, and continue that correspondence with you;
• send you an acknowledgement that your enquiry arrived;
• keep a record of enquiries so that we can find an earlier conversation when you write again;
• protect the form against automated abuse.

We process this data to take steps at your request before entering into a contract and to answer you; to protect the website against abuse, which is our legitimate interest; where consent applies, on that consent, which you may withdraw at any time; and where the law obliges us, to meet that obligation.

We do not use enquiry data for automated decision-making or profiling.

How long we keep it

Enquiries are kept while they are still useful for the correspondence they belong to, and are removed when they are no longer needed. They are not deleted automatically on a fixed schedule: they remain until they are deliberately removed.

You can ask us to erase an enquiry at any time — see Your rights.

Other services this site uses

Some parts of this website are provided by other companies. Where that means your data reaches them, it is set out here.

Email delivery

your enquiry is sent to us, and your acknowledgement is sent to you, through an email service acting on our instructions. The content of your enquiry passes through it.

RateParity — only after you accept

a rate-comparison widget. When it loads it contacts RateParity, receives the address of the page you are on, and sets an identifier in your browser. It does not load at all unless you accept the booking, rate comparison and analytics category.

Google Maps — only after you accept

the map on the contact page is embedded from Google. Loading it sends your IP address to Google. It is not loaded until you accept the same category, and until then you see a placeholder in its place.

Google Analytics — only after you accept, and only when enabled

measures how the site is used and sends usage events to Google. It is part of the same category. It is not enabled on this site at the time of writing, so it currently loads for nobody.

The booking platform

“Book Now” and the availability links open an external booking service in a new tab. We do not pass your personal data to it. Once you are there you are on their website, under their own terms and their own privacy policy.

Social links

links to our Instagram and Facebook pages are ordinary links. Nothing from those networks is loaded into this site, and following one takes you to them under their own terms.

Apart from the services above and anyone we are legally obliged to inform, we do not share your personal data with third parties, and we do not sell it.

Cookies and similar technologies

A cookie is a small file stored by your browser. This site also uses your browser's local storage, which works in much the same way. There are two categories, and you choose between them the first time you visit.

Necessary

your language choice and the record of the cookie decision itself. Without these the site cannot remember what you chose. They cannot be switched off and they are not used to track you.

Booking, rate comparison and analytics

RateParity, the Google Maps embed and Google Analytics, as described above. Nothing in this category loads before you accept it.

You can change your decision whenever you like through the cookie preferences link in the footer of every page. Withdrawing this consent removes the identifiers those services placed in your browser and stops them loading on the pages you open afterwards. Your browser also lets you delete cookies and local storage yourself.

General information about cookies is available at allaboutcookies.org. Google publishes its own privacy policy and an opt-out for Google Analytics.

Your rights

As a data subject you have the right to:

• be informed — to know whether your personal data is being processed, what is held, where it came from, why, and by whom;
• access — to obtain a copy of the personal data we hold about you;
• rectification — to have inaccurate or incomplete data corrected;
• erasure — in certain circumstances, to have your data removed from our records;
• restrict processing — where certain conditions apply, to limit how your data is used;
• object to processing — in certain cases, including direct marketing;
• object to automated processing, including profiling, and not to be subject to a decision based solely on it;
• data portability — to receive your data in a machine-readable format, or have it transferred directly where that is feasible;
• withdraw consent — at any time, for anything you consented to;
• complain — if we refuse a request we will explain why, and you may take the matter to a supervisory authority and seek other legal remedies.

How to make any of these requests is set out on Privacy Rights.

Children

We do not intend to collect, and do not knowingly collect, personal data from children. This website is not directed at them.

How we protect your data

The site is served over HTTPS, so what you send through the enquiry form is encrypted in transit. Enquiries are stored in an access-controlled system, and the form is protected against automated submission.

No website can promise perfect security. If a breach affects your rights we will notify you and the appropriate authority, and we will do what we reasonably can to prevent breaches and to assist any investigation.

Changes to this policy

We may update this policy. The date at the top of the page tells you when it last changed. This version replaces the policy published on 1 June 2018.