Statement of Personal Data Protection Policy of the Company EMM. VARDAKIS – ALIANTHOS S.A.
Last updated: 22/9/2026
This personal data protection statement applies to the company EMM. VARDAKIS – ALIANTHOS S.A., its subsidiaries, and all hotels within its roster of companies.
At ALIANTHOS ESTATE RESORT Hotel, we strive to provide exceptional products, services, and experiences throughout the world. We recognize that personal data protection is an important issue. We have drafted this Statement to explain our practices regarding the personal details we collect from you or about you, on the website https://www.alianthosestate.com or through our applications, when you communicate with us in writing or verbally, and the information we collect when you visit one of our facilities, or information derived from other sources. While this statement describes the practices we have adopted based on European Law and our National Legislation.
By using any of our products or services and/or by giving your consent to this Statement, e.g., in the context of registering for one of our products or services, you understand and acknowledge that we collect and use Personal Data as described in this Statement.
It should be noted that this Statement does not apply to the processing of personal details that may be carried out by us on behalf of and according to instructions from third parties, such as airlines, car rental companies, and other service providers, companies organizing or offering travel packages, marketing partners, or corporate clients. In such cases, your consent will be requested anew according to the instructions of the third parties.
The Data Controller – Data Protection Officer
The company under the name "EMMAN VARDAKIS ALIANTHOS S.A.", based in Rethymno, Crete, in the area of Plakias, P.C. 74060, Municipality of Agios Vasileios, with Tax Identification Number (TIN): 094118026, Tax Office: RETHYMNO, is the data controller for the processing of your data for the purposes detailed herein.
The contact details of the legal entity are as follows:
ALIANTHOS ESTATE RESORTTelephone: +30 28320 31280
info@alianthosestate.com
Plakias 74060, Rethymno, Crete
https://www.alianthosestate.com
The Data Protection Officer is Konstantinos Vardakis, son of Emmanouil and Maria, resident of Plakias, P.C. 74060, with Tax Identification Number (TIN) 058661740.
The contact details of the Data Protection Officer are as follows:
Plakias 74060, Rethymno, Crete
Telephone: (+30) 2832031280 / (+30) 6976880660
Email: kvardakis@alianthosestate.com
As the data controller, the Company bears all obligations arising from the GDPR, Law 4624/2019, and the Directives of the Hellenic Data Protection Authority.
We ensure that we collect only your absolutely necessary Data, which is appropriate and clear for its intended purpose. This Data includes the following:
2.1. Data collected during booking, the check-in process, your stay, and the organization of events on hotel premises
During the booking process, we collect the following necessary information:
During your visit to our website, the web Server automatically records details regarding your visit (indicatively the type of browser you use, the pages of the website you visit, the date and duration of your visit, location information), while with your consent cookies are placed on your computer or smart device every time you visit us online.
In the event that personal data concerns individuals under 16 years of age, the latter are disclosed to us by parents/guardians and are processed only upon the express free consent of the latter.
If your booking is made through our website, we will collect your full name, address, city, country, telephone, e-mail address, as well as any special request you may have, your credit card details (card type, card number, security code, expiration date, cardholder details), arrival and departure dates, as well as flight details in case of a request for your transfer to and from the airport.
In cases of electronic bookings through third parties and/or travel agents, the details we will receive about you are the email confirming your booking, containing information such as your full name, country, arrival and departure date, flight information in case of transfer to and from the airport, accompanying members (e.g., family), and special requests (e.g., airport transfer request, statement of preferences and/or allergies you wish us to know).
Upon your arrival at our Hotel, you will provide us with all the following necessary information to complete the check-in process:
Your title, full name, communication language, address (street, P.C., city, country), nationality, telephone number, e-mail address, names of any (family) members accompanying you and their date of birth, your date of birth, passport/ID number, as well as copies of relevant documents, provided you use the online check-in platform with your explicit consent, credit card details, arrival and departure dates, and room number.
Your allergies and preferences. We collect such data if you voluntarily disclose it to us with your explicit consent. If you wish to share data with us such as your allergies or other preferences, in order to log the relevant information and inform the relevant departments of the hotel during your stay at our premises, in this case, we will ask you to provide us with your consent to store this data and inform our restaurants and/or housekeeping departments accordingly for your safety, comfort, and the provision of personalized services. In this case, we will collect your full name, date of birth, arrival and departure date, and room number, as well as any allergy or preference you state to us.
If you are planning an event with us, we collect meeting and event specifications, the date of the event, number of guests, details regarding guest rooms, and for corporate events, details about your company if you are a legal entity, aimed at best serving you. We also collect details about guests who are part of your group or event.
With your explicit consent, we collect your e-mail in order to carry out promotional activities and communicate with you, so as to provide services exclusively for you and send you special offers for our services and products, or updates on upcoming events or offers that may interest you.
2.1.1. Purposes of processing – legal basis
We collect the above booking data for the purpose of:
2.2. Data collected during your stay and use of our services
Dialed telephone numbers through the call center,
Information/images obtained through the use of closed-circuit television (CCTV), lawfully operating on our premises for reasons of security and protection of persons and goods, about which you are informed upon entering them via posted signs.
In case you wish to submit a request for "room service meals", we will collect your order data (including dietary preferences and allergies, if mentioned) alongside your name and room number.
If you make a restaurant reservation through the central reservations call center, we collect your full name and any other special request you may disclose to us.
Additionally, if you purchase products from us, we will process retail sales data.
When you visit gym/spa facilities, we collect the personal information necessary for providing our services. Specifically, upon your registration for the relevant services, we collect and process: full name, e-mail address, signature, and room number. If you wish to enjoy spa treatments, you will need to provide us with all the above-mentioned data and necessary health information by filling out the treatment questionnaire (such as medical treatments, allergies, possible pregnancies, etc.) in order for us to safely provide you with our Services.
With your explicit consent, we collect your e-mail to send you updates, electronic correspondence (emails), and news regarding new spa products and related offers.
2.2.1. Purposes of processing – legal basis
We collect data you provide when using one of our above services for the purpose of:
2.3. Data collected upon registration and use of the ALIANTHOS ESTATE RESORT LOYALTY CLUB
If you choose to become a member of the ALIANTHOS ESTATE RESORT LOYALTY CLUB, we collect the following necessary information for the following purposes:
2.3.1. Purposes of processing – legal basis
We collect member data for the purpose of:
2.4. Personal data collected from guest questionnaires
Your remarks are important to us as they allow us to improve the services provided to you. You can submit your observations and comments at any time by completing the guest questionnaires. If you wish to fill it out, providing personal information (e.g., full name, room number, e-mail address, address, country, occupation, arrival details, length of stay, date of birth) is optional.
2.4.1. Purposes of processing – legal basis
We collect the data you provide in guest questionnaires for the purpose of:
2.5. Data collected from social media and participation in contests
If you choose to participate in social media activities or offers, we will collect, with your permission, certain information from your social media account, such as location, check-ins, activities, interests, photos, status updates, and your friend list. You may also be allowed to participate in contests to provide photos, such as from your stay with us, which you can share with your social media contacts for voting, shared offers, or other advertisements. If you emerge as a winner, the Company will collect additional details, such as your contact details (full name, full address, ID number, and contact telephone) and any other information required for delivering the Contest prize.
2.5.1. Purposes of processing – legal basis
We collect data you provide during social media activities or offers for the purpose of:
Regarding the Contest winner and any runners-up, the Company processes their personal data collected from them for the purpose of informing them and publishing Contest results, as well as carrying out all necessary actions to deliver the Prize. Legal basis is performance of the contract (Art. 6 par. 1 item b GDPR) as well as consent to contest terms (Art. 6 par. 1 item a GDPR).
2.6. Personal data collected for security reasons
We collect, process, and store images and videos through the video surveillance system (closed-circuit television, hereinafter CCTV), where installed, for the safety of persons and goods, in accordance with the requirements and standards set by national and EU legislation for data, audio, and image processing. You can find detailed information about the video surveillance system policy at http://www.alianthosestate.com/ as well as from the relevant informational signs that our Company has posted before entry to any of its premises where the closed-circuit television system operates.
The security department drafts reports containing personal data for security reasons (e.g., incident reports, lost property reports, safe list, etc.). Such reports contain personal information, such as full name, room number, and are recorded for security reasons.
In the event an accident occurs on our premises, you will be asked to provide information such as your full name, date of birth, room number, length of stay, as well as supplementary information regarding the accident, such as the location where the incident occurred, date and time of the incident, nature of the incident, and relevant further information.
2.6.1. Purposes of processing – legal basis
The security department collects data for the purpose of:
2.7. Personal data collected from your subscription to the update list (newsletter).
When you subscribe to receive informational material (newsletter), we collect and store your e-mail address and, if you wish, you may enter your full name and country.
2.7.1. Purposes of processing – legal basis
We use data you provide when subscribing to the update list (Newsletter) for the purpose of:
Data collected through the use of internet technologies
We use cookies and other technologies (such as "pixel tags", "web beacons", "clear GIFs", links in e-mails, JavaScript, Google or Apple device IDs, or similar technologies) to collect this information. If you wish to remove or block cookies from your device at any time, you can update your browser settings (consult your browser's "Help" menu to learn how to remove and block cookies). The Company bears no responsibility for your browser settings. You can find simple and useful instructions for managing cookies across various browser types at: www.allaboutcookies.org
2.8. Profiling
With your consent, if you are a member of our Company's reward program or have declared that you wish to receive updates for personalized offers, we will use your information to evaluate certain personal aspects about you as our customers. However, we do not make decisions affecting you based solely on automated processing, including profiling, which could produce legal effects concerning you or similarly significantly affect you.
When we use profiling to provide personalized offers and services (not a fully automated decision-making process), you always have the right to object to such processing (including profiling) relating to direct marketing by submitting your request at any time to the Data Protection Officer using the contact details provided below (in the "Your Rights" section).
2.8.1. Purposes of processing – Legal basis
We may use your personal data for the purpose of:
Data Storage & Retention
We will retain and process your Personal Data for the purposes mentioned above only for as long as necessary for the purpose for which it was collected, or for as long as required by contract or applicable law. To determine the appropriate retention period, we also take into account the amount, nature, and sensitivity of personal data, as well as the periods for which we might need to retain it to respond to any requests / disputes / audits and to protect our legal rights in the event of any claims.
Data Transfer
It is possible, in the context of conducting our corporate activity, that limited provision of personal data to third-party partners becomes necessary, strictly for a specified exclusive purpose. These pertain to cases where third parties provide specialized services to the hotel, specifically for implementing mass communication of our promotional activities to you—our customers—via e-mails. For informing you about offers, etc., you will have granted your explicit consent, as stated above. Therefore, this does not concern cases of providing all personal data, especially data that is not necessary for providing the above service requested from these third parties. The provision of data is governed by a prior written agreement between the hotel and the third-party partner, subject to their commitment to implement a personal data protection policy and assume liabilities arising from our legislation.
Furthermore, the hotel, like any other enterprise, may be obliged to provide personal data to competent Public, Judicial, Police Authorities, etc., in cases of summons, search warrants, other judicial processes, compliance with court, regulatory, or administrative decisions, in cases of protecting and defending the enterprise itself, its executives, directors, and employees, as well as to its partner lawyers when lawsuits, claims, or disputes arise. We also collaborate with third-party partners (website management service providers, call center maintenance, IT system audit and management, etc.), all of whom ensure data confidentiality and provide relevant guarantees for its protection and security through written contracts between us. To third parties providing services to the Company, such as human resources service companies, lawyers/law firms (in case of out-of-court or court actions regarding contracts and legal claims of or against the Company), financial advisors-accountants, etc. These persons, acting as processors on behalf of our Company, are bound by guarantees of absolute compliance with applicable legislation (European and National) for personal data, and (c) Before courts for exercising and defending Company rights. Under no circumstances do we disclose your personal data to third parties for product or service promotion purposes.
Transfer of information concerning you to third parties and/or exchange of information is possible within the framework of managing your booking, in cases involving travel agencies, tour operators, or online accommodation booking service providers through which you make an electronic/online room reservation.
Data Security
Personal data provided by customers to the hotel is entered into computer systems that provide sufficient assurance and are operated by specially trained and authorized employees (users) under full confidentiality, achieving the maximum possible protection of recorded data in today's digital environment.
The security and protection of all data is enhanced by the use and coexistence of additional security software.
Taking into account the latest developments, implementation costs, nature, scope, context, and purposes of processing, as well as potential risks of varying origin and severity to your rights and freedoms, our Company implements appropriate technical and organizational measures to ensure an appropriate level of security, integrity, and confidentiality of your personal data, in accordance with applicable legislation. Specifically, we enforce strict organizational measures and procedures to protect personal data from potential alteration, loss, unauthorized or unlawful processing, on the one hand by installing server computers in facility spaces with restricted and controlled access, and on the other hand by granting user rights limited to the strictly minimal necessary access level.
Your Rights
Under existing legislation and particularly the General Data Protection Regulation, to the extent your data is processed by the Company, you maintain the following rights:
You may exercise your rights by sending an e-mail to kvardakis@alianthosestate.com or a letter to our postal address or by submitting the request in person at our address.
We will respond to all requests free of charge within the statutory 30-day timeframe. In case of inability to respond to your request or need for delay due, for example, to complexity or volume of the request, we will inform you in writing within 30 days of receiving your request of the reasons leading to delay or inability to respond. In this case, you will receive an answer to your request within sixty (60) days. The Company may request additional information necessary to confirm your identity/authorization. These rights may be restricted due to an obligation to apply national law or other law or specific overriding statutory provision. If your requests are manifestly unfounded or excessive, particularly due to their repetitive nature, we may either: a) charge a reasonable fee, taking into account administrative costs for providing information, or b) refuse to follow up on the request.
If you have questions regarding our practices concerning personal data or exercising your rights, you can contact our company at kvardakis@alianthosestate.com and submit any relevant inquiry.
Right to Lodge a Complaint
In case you consider that the processing of data concerning you violates Regulation (EU) 2016/679, you have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for Greece is the Hellenic Data Protection Authority, Kifissias 1-3, 115 23, Athens, https://www.dpa.gr/, tel. 2106475600.
Amendments to this Statement
This Statement may be amended periodically to respond to any changes in our company's policy and practices. When we make changes to this Statement, we will publish a link to its revised version.
