Privacy and cookies policy

Data controller

MetsoVillas, Vasileiou Mpousvarou 2, Metsovo 442 00, Greece · info@metsovillas.gr · +30 694 690 5096. Contact us here about anything to do with your personal data.

What we collect

With a booking request: your first and last name, email, phone number (if you give it), how you’d like us to reply, your dates, the suite, how many adults, children and infants are coming (numbers and age bands only), your message, how you found us, and invoice details if you ask for an invoice. To keep the form secure we briefly store a hashed form of your IP address and the time you sent it. We never ask for card details or for copies of an ID card or passport.

Why, and on what legal basis

To answer your request, send you an offer and arrange your stay: steps before a contract, and the contract itself (Article 6(1)(b) GDPR).

For tax records, receipts and the climate resilience fee, and for the guest register on arrival: to comply with the law (Article 6(1)(c)).

To protect the form from spam and abuse: legitimate interest (Article 6(1)(f)).

For the first-snow alert and any news from us: only with your consent, which you can withdraw at any time (Article 6(1)(a)). After a stay we may send you a thank-you with a link to leave a review; you can stop these with a link in the same message.

Who sees your data

Only we read your data. It is stored on our behalf, as processors, by the website’s host and our email provider. If you pay by card or IRIS, the payment provider and the banks process the payment as independent controllers. Where the law requires it, we share data with AADE (the tax authority), the police (guest register) and our accountant. We never sell data or use it for advertising.

Transfers outside the EU

We prefer providers inside the European Union. Where a provider processes data outside the EU, the transfer takes place only with the safeguards of Chapter V of the GDPR, such as standard contractual clauses.

How long we keep it

Requests that did not become bookings: 12 months from the last contact; after that we keep only anonymous statistics (dates, suite, total, country). Bookings: until the end of the fifth year after the tax year of the stay, as tax law requires; then they are anonymised. The guest register: 10 years, outside the website. Spam, rejected requests and the hashed IP address: 30 days. Consent for the snow alert: until you withdraw it.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, and you can withdraw any consent you have given. Write to us at info@metsovillas.gr; we reply within one month. You can also complain to the Hellenic Data Protection Authority (www.dpa.gr).

Automated decisions

We make no automated decisions and build no profiles. A person reads every request.

Security

The website runs on HTTPS only. The form is protected by checks that never ask you to solve a CAPTCHA. Only your hosts can see the requests.

Children

For children we ask only how many there are and their age band (3–12, or 0–2).

Cookies and browser storage

The website sets no cookies for visitors. We use no Google Analytics or Meta Pixel, no third-party fonts or maps and no embedded videos. While you fill in a request, the draft is kept in your browser’s sessionStorage so it isn’t lost if you press “Back”; it is deleted when you close the tab. Weather data comes from MET Norway to our own server, so your browser never contacts them. Cookies are set only for people who log in to manage the site.

First-snow alert

If you ask for the first-snow alert, by email or in your booking request, we keep your email address for that alert only (and for news, if you asked for it) until you ask us to remove you; a reply to any of our messages is enough.

Changes

If anything in this policy changes, the date at the top of the page changes with it.