Privacy Policy
Last updated: 24 September 2026
1. Who is responsible for your data
The data controller is Maria Vithleemidou, a private individual, of Praxitelous 4a, 19004 Christoupoli, Attica, Greece, letting the property under the trading name Athens Airport Stay (Property Registry Number 00003651586).
Contact for any privacy matter: info@athensairportstay.com, +30 6947 166251.
We are not required to appoint a Data Protection Officer, and have not appointed one. All privacy requests are handled at the address above.
2. What we collect, why, and on what legal basis
| Data | Why we need it | Legal basis (GDPR Art. 6) |
|---|---|---|
| Name, email, phone | To take and manage your booking | Performance of a contract |
| Lead guest’s name, dates of stay, agreed price | Short-Term Stay Declaration filed with the Greek tax authority (AADE) | Legal obligation |
| Billing address, last four digits of the card, transaction reference | To process payment and issue the receipt | Contract + legal obligation (tax records) |
| Arrival and departure dates, party size, special requests | To prepare the apartment for you | Performance of a contract |
| Message you send through the contact form | To answer you | Performance of a contract, or our legitimate interest in replying to enquiries |
We do not use your data for automated decision-making or profiling, and we do not send marketing email unless you ask us to. We run no website analytics at all — we collect no statistics about your visit.
3. Full payment card details
We never see or store your full card number. Payment is processed by Stripe Payments Europe, Ltd., which we ask you to pay through a secure payment link. Stripe acts as an independent controller for the card data and handles it under its own privacy policy.
4. Who else sees your data
| Recipient | What they receive | Why |
|---|---|---|
| Netlify (website hosting and forms) | What you type into a form on this site, plus server logs | To run the website and deliver your message to us |
| Beds24 GmbH (booking and channel management, Germany) | Your booking details, and the review you leave on a platform | To manage the booking and to show recent guest reviews on this site |
| Stripe (payments) | Payment data | To take payment for a booking |
| Google Ireland Ltd (YouTube) | Your IP address and device data — only if you press play on the apartment tour | To play the video you asked for |
| Greek authorities | Lead guest’s name and stay dates | Where the law requires it |
| Our accountant | Invoice data | Tax compliance |
Guest reviews. A review you publish on Airbnb is public on that platform. We show recent ones on this website, together with the month of your stay and, where the booking records it, your country. We do not publish your name, your contact details or your booking reference.
We do not sell, rent or trade your data. Everyone above is bound by contract or by law to keep it confidential.
Transfers outside the EEA. Some of our processors may transfer data outside the European Economic Area — in particular Netlify (website hosting, United States), Stripe’s group companies and Google. Each does so under a recognised transfer mechanism: the European Commission’s Standard Contractual Clauses or, where certified, the EU–US Data Privacy Framework. The specific mechanism for each is set out in that processor’s data processing agreement, available on request.
5. How long we keep it
| Data | Retention |
|---|---|
| Booking and contact records | Two years after the stay |
| Invoices and accounting records | As required by Greek tax law |
| Short-Term Stay Declaration data | As required by the tax legislation that mandates the declaration |
| Enquiries that do not become bookings | Twelve months |
When the period ends, the data is deleted or irreversibly anonymised.
6. Your rights
Under the GDPR you have the right to:
- Access — get a copy of the data we hold about you
- Rectification — have inaccurate or incomplete data corrected
- Erasure — have your data deleted, where no legal obligation requires us to keep it
- Restriction — have us pause processing while a dispute is resolved
- Data portability — receive your data in a machine-readable format, or have it sent to another controller
- Object — object to processing based on our legitimate interests
- Withdraw consent — at any time, where processing rests on consent. Withdrawing does not affect what was lawful before
- Complain — to the Hellenic Data Protection Authority (Kifissias 1-3, 115 23 Athens, dpa.gr), or to the authority where you live
To exercise any of these, email info@athensairportstay.com. We answer within one month.
7. Video surveillance
Security cameras with recording operate in the outdoor shared areas of the property — the entrance, the parking and the garden — to protect people and property. There is no camera inside the apartment. No audio is recorded. The areas are signposted. Footage is kept for seven days and then deleted; only the person responsible for the property has access to it, and it is not passed to third parties unless a competent authority requests it. Legal basis: legitimate interest (Article 6(1)(f) GDPR). For any question about the cameras, email info@athensairportstay.com.
8. Security
We use appropriate technical and organisational measures to protect your data: encrypted connections, access limited to those who need it, and reputable processors. No system is completely secure, and we do not claim otherwise.
9. Cookies
See our Cookie Policy.
10. Changes
We will post any change on this page and update the date at the top. Material changes affecting your rights will be notified by email to guests with an active booking.