Information on the processing of personal data
S. AND A. MAMADAS HOTEL AND TOURISM ENTERPRISES S.A. (the “Company”), as data controller for Aegli Hotel Volos, 24 Argonauton Street, Volos, informs guests, visitors, employees, job applicants, partners, suppliers and website users about the processing of their personal data under the General Data Protection Regulation 2016/679 (GDPR) and applicable Greek law. Contact: info@aegli.gr, +30 24210 24471.
I. DATA WE PROCESS AND PURPOSES
Personal data is information that identifies or can identify a natural person. We process only the information needed for the following purposes.
I.1. Employees and job applicants
For employees, we process identity and contact details; contract, attendance, remuneration, payroll, tax and social security information; and other information needed to administer employment. The legal bases are performance of the employment contract and compliance with legal obligations. More specific notices are provided where required.
For applicants, we process application and CV information, including contact details, education and professional experience, to assess the application and communicate about the role. Retention for future vacancies requires an appropriate legal basis and notice. For trainees, we process the information necessary for the placement and related obligations.
I.2. Guests and prospective guests
To handle bookings, stays, service and billing, we process identity and contact details, booking and stay information, identity documents where required, service requests and preferences, payment and billing details, and correspondence. The legal bases are performance of a contract, compliance with legal obligations and, where applicable, our legitimate interests in operating and protecting the business. Where a booking is made through a third party, we receive the necessary information from that booking channel.
I.3. Communications and requests
When you contact us by phone, email, form or another available channel, we process your contact details and the content of your request to respond, assist with a booking or handle a complaint. The legal basis depends on the request and may be a contract, legal obligation or our legitimate interests.
I.4. Website and marketing communications
When you visit the website, technical data such as IP addresses and connection information may be processed for security and operation. Separate information is provided for non-essential cookies and similar technologies, and consent is sought where required. News or marketing messages are sent only where there is an appropriate legal basis. You may object or withdraw consent at any time.
I.5. Events and business meetings
For business meetings, corporate events and other activities, we process information about organisers and contact persons, such as name, role, organisation, phone number, email, address, and billing or payment details. We generally do not collect ordinary attendees’ data unless needed for a particular service or supported by another legal basis. Where a third-party organiser takes photographs or videos, that organiser is responsible for the related notice and lawful processing to the extent it determines the purposes and means.
I.6. Suppliers and partners
We process names, contact details, roles, companies, tax identification numbers, billing details and bank account information where required. The purposes are performing contracts, managing relationships and complying with tax and other legal obligations.
II. SPECIAL CATEGORIES OF PERSONAL DATA
We do not generally seek to collect special categories of data. We may, however, need to process information you provide about allergies, dietary restrictions, health, disability or accessibility needs where necessary to provide services safely, or data arising in employment. We do so only where a condition under Article 9 GDPR applies, such as explicit consent or another condition provided by law.
III. RETENTION PERIODS
We retain data only as long as necessary for its purpose. Where there is a legal obligation, the periods prescribed by tax, accounting or employment law apply. Contract data is retained during the relationship and afterwards as needed for legal duties or legal claims. Data processed on the basis of consent may be kept until consent is withdrawn, unless another legal basis applies. After the applicable period, data is securely erased, destroyed or anonymised.
IV. RECIPIENTS AND TRANSFERS
Access is limited to authorised staff and partners who need the data for their duties and are bound by confidentiality. Data may be shared with competent public or judicial authorities; booking, software, IT and website hosting providers; accounting or legal advisers; banks and payment providers; or service providers you ask us to use. We do not disclose data to third parties for their own marketing without an appropriate legal basis. For transfers outside the European Economic Area, we apply safeguards required by the GDPR.
V. PRINCIPLES AND SECURITY
We follow the principles of lawfulness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability. We implement and review appropriate technical and organisational measures against loss, alteration, unauthorised access and other unlawful processing.
VI. VIDEO SURVEILLANCE
VI.1. Purpose and legal basis
We use video surveillance at Aegli Hotel Volos solely to protect people and property and secure the premises. Its legal basis is our legitimate interest (Article 6(1)(f) GDPR) in protecting guests, employees, visitors, property and premises against theft, damage and other unlawful acts.
VI.2. Scope of surveillance
Cameras are limited to locations necessary for security and monitoring entrances and exits. There are no cameras in guest rooms, toilets or other areas with a heightened expectation of privacy. The system records images only, not sound. Camera positioning limits capture of areas that are not needed.
VI.3. Recipients of footage
Only authorised staff with relevant responsibilities can access footage. It may be provided to judicial, prosecutorial or police authorities where legally required or needed to investigate a criminal offence, and to a victim or perpetrator where legal conditions are met.
VI.4. Retention
Footage is kept for seven (7) days and then automatically deleted. If a security incident or unlawful act is identified, the relevant extract may be isolated and kept longer, only as needed for investigation, legal proceedings, or the establishment, exercise or defence of legal claims.
VI.5. Rights concerning video surveillance
Subject to GDPR conditions, you have rights of access, restriction, objection and erasure. To locate footage of you, we may ask for the date, approximate time and location where you appeared, while protecting the data of other people shown in the footage.
VII. YOUR RIGHTS
Subject to the GDPR, you have rights of access and to a copy, rectification, erasure, restriction, portability where applicable, and objection to processing based on legitimate interests. You may always object to direct marketing. Where processing is based on consent, you may withdraw it without affecting processing that was lawful before withdrawal. Erasure may be limited by legal obligations or legal claims.
To exercise your rights, contact Aegli Hotel Volos at info@aegli.gr, 24 Argonauton Street, Volos, +30 24210 24471. We respond without undue delay, generally within one month. Where the GDPR permits, this period may be extended by two months, with notice within the first month.
VIII. RIGHT TO LODGE A COMPLAINT
You may complain to the Hellenic Data Protection Authority, 1–3 Kifisias Avenue, 115 23 Athens, +30 210 6475600, contact@dpa.gr, www.dpa.gr. This does not affect any other administrative or judicial remedy.
IX. CHANGES TO THIS POLICY
The Company may update this Policy due to changes in law, regulations, technology or operations. The current version is published on the Aegli Hotel Volos website.
Last updated: September 2026
