Privacy

The controller is the owner of Seaflows Apartments, at the property itself: 8 Eleftheriou Venizelou, Paralia Katerinis 601 00, Pieria, Greece.

For anything about your personal data, write to seaflows@fijisolutions.net. That is the mailbox every booking and every enquiry from this site arrives in; it sits on the domain of Fiji Solutions, the company that built and runs the site on the owner's behalf.

• Postal address: 8 Eleftheriou Venizelou, Paralia Katerinis 601 00, Pieria, Greece
• Email for anything about your data: seaflows@fijisolutions.net

Only two places on this site ask for personal details: the enquiry form and the booking. Nowhere else are you asked for anything.

On the enquiry form only your name and your email are required. You can also give a phone number, a message of up to 2,000 characters, which apartment you are asking about, dates and how many of you there are. The enquiry becomes one email to the owner and nothing is stored; the reply comes from her, not from a machine.

To make a booking we ask for your name, email and phone number. The phone number is required here because it is how the owner reaches you on the day you arrive. The stay you picked travels with it — apartment, dates, number of guests — along with the language you are reading the site in, so that we answer you in the same one.

Payment happens on Stripe's own page, not here. Your card number, expiry date and CVC never pass through this site or our servers at any point.

If card payment is not switched on, the booking page says so and no booking is completed through the site; nothing is sent anywhere.

When you pick dates, the site asks our own API for a price and for availability. The apartment, the dates and the number of guests travel in that request — nothing that identifies you.

The confirmation page asks you for nothing: it reads the booking back from Stripe using the code that is in the link.

• Enquiry: name and email required; phone, message, apartment, dates and guests optional
• Booking: name, email, phone, the language you are reading in, and the stay you picked
• Payment: taken by Stripe; no card details reach us
• Browsing: apartment, dates and guest count in the price and availability requests

The code of this site does not read or store your IP address, your browser or the page you came from. The companies that host the site and the API keep their own request records, as every hosting provider does; nothing in the code we wrote switches those on or off.

No profiling of visitors is carried out and no decision is made automatically on the basis of who you are. Whether a date can be booked is decided from the dates and the apartment themselves, never from anything about you.

• Card details — number, expiry date or CVC
• Home address, date of birth, ID card or passport
• A user account and a password — there is no login on this site
• Analytics or tracking scripts, pixels, advertising networks
• A newsletter list — we send no marketing messages and there is no such field anywhere
• Special-category data, such as anything about your health

For both the enquiry and the booking the basis is Article 6(1)(b) of the General Data Protection Regulation: performing the accommodation contract, and the steps taken before it at your own request. Without a name, an email and a phone number a booking cannot be made; without a name and an email an enquiry cannot be answered.

To the extent that Greek law obliges the owner to keep records of the income from your stay, that is done under Article 6(1)(c), compliance with a legal obligation. No such records are kept on this site: they live in the payment records and in the owner's tax return.

We do not ask for your consent anywhere, because we do not rely on it anywhere: there are no cookies, no analytics and no marketing messages that we would have to ask you about.

• Answering an enquiry: Article 6(1)(b)
• Booking, payment and confirmation: Article 6(1)(b)
• Records the law requires, to the extent it requires them: Article 6(1)(c)

We do not sell your details and we do not trade them with anyone. They reach only the companies that do the work of a booking, and only for that:

Booking.com receives nothing from this site. Bookings made there and bookings made here are not connected in any automatic way.

One thing we owe you plainly: the Stripe account in use today is not the owner's but Fiji Solutions', the company that runs the site. Until her own account is open, the record of your booking — with your name, email and phone number — sits in an account Fiji Solutions controls.

• Stripe — takes the payment on its own page and holds the record of the booking: name, email, phone, the stay and the amounts. Policy: stripe.com/privacy
• Resend — sends the two booking emails, yours and the owner's. The owner's email carries your name, email and phone number. Policy: resend.com/legal/privacy-policy
• Vercel — hosts the site. It sees the address of every page you open, so the apartment and dates on the booking page and the payment code on the confirmation page. It does not receive your name, email or phone: those go straight from your browser to our API. Policy: vercel.com/legal/privacy-policy
• AWS — runs the API that receives your details, in Frankfurt (eu-central-1). Policy: aws.amazon.com/privacy
• The owner's mailbox — where the booking and enquiry emails stay. Which company hosts it is not stated here, because we have not confirmed it

The API that receives your name, email and phone number runs on AWS servers in Frankfurt, inside the European Union.

For the website itself we cannot say the same with certainty: the region in which Vercel runs the pages is not pinned in our configuration, and its network is global.

Stripe and Resend are US companies, so details of yours do reach a place outside the European Union. Those transfers happen under the safeguards their own data-processing terms set out — EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as each of them states. We claim no particular certification here: read what each provider says in its own policy.

So we are not telling you that your details never leave Europe. That would not be true. The data-processing paperwork with each provider has not been gathered yet and is not cited here.

The site stores nothing: no database, no files, no copies. What is kept is kept elsewhere:

The booking or enquiry emails are kept for twenty-four months after your stay and are then deleted. That is long enough to answer a complaint or settle a dispute, and no longer than it needs to be.

Two exceptions, both outside the mailbox: the payment record in Stripe is a tax and accounting record and stays for as long as the law requires, which is longer; and Resend keeps its own records of the messages it sent for as long as its own policy says.

You can ask for erasure whenever you want, at the contact address above. Deleting is done by hand — in Stripe and in the mailbox — because there is no admin panel and no automatic process. What the law requires to be kept is not deleted: the record of a completed payment in Stripe, for one, is a tax and accounting record and stays for as long as the law says.

• In Stripe, the payment record with the booking details on it
• In Resend, for as long as it keeps its own records of the messages it sent
• In the owner's mailbox and in yours, the booking or enquiry emails

The Regulation gives you the following rights over your details:

To use any of them, write to us at the contact address. We may need to be sure you are the person the details are about — writing from the email address you booked or enquired with is usually enough. We answer within one month at the latest, as the Regulation requires, and using your rights costs you nothing.

• Access: to know what details of yours exist and to get a copy
• Rectification: to correct anything wrong or incomplete
• Erasure: to have them deleted when there is no reason to keep them
• Restriction: to have them left alone while a disagreement is settled
• Portability: to receive them in a machine-readable form
• Objection: to object to processing that rests on a legitimate interest — we do not rely on one here, so the case does not arise

If you think your details were not handled properly, you can complain to the Greek supervisory authority. You can also go to court.

• Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα)
• Leoforos Kifisias 1-3, 115 23 Athens, Greece
• www.dpa.gr · complaints@dpa.gr

This site sets no cookie, on any page and in either language, and writes nothing to your browser's storage. That is why you see no consent banner: there is nothing to ask you about.

Whatever you type into a form lives as long as the page is open and is gone when you reload it.

Two things do stay in your browser: the history of the addresses you visited — the booking page carries your apartment and dates, the confirmation page carries the payment code — and the ordinary cache of images and design files, which holds no personal details.

When you press to pay, you leave seaflows.gr and go to Stripe's page. Stripe sets its own cookies there, on its own site. The cookie page sets this out in full.

The link to the confirmation page carries the payment code. Anyone holding that link can see the name, email and phone number on the booking — so anyone who has it can see them.

• Everything you send travels encrypted (HTTPS) to our server
• The site and the API are two separate services: your details go from your browser straight to the API and never through the page
• There is no login, so there is no password of yours to lose
• Card details never reach us — you give them on Stripe's page
• The API's logs are written so that they hold no name, email, phone number or payment code; email addresses are stripped automatically before anything is written
• The booking form is built so that your details cannot end up in the address of a page

This site is not aimed at children and we do not knowingly collect children's details.

The forms ask how many of you there are; they ask for no ages and for no details of the other people travelling with you. If you believe a child has sent us details, write to us and we will delete them.

This page was written before some of the things a privacy notice normally states had been confirmed. Rather than fill them in with guesses, they are left open and written down here:

• The payment account: the one in use today is Fiji Solutions', not the owner's
• The data-processing paperwork with each provider
• Which company hosts the mailbox the bookings arrive in

When something about the way we work changes, this page changes first and the practice second — not the other way round. If you read something here that is not true, that is our mistake; write to us and we will correct it.