Privacy policy

Who is responsible for your data

The data controller for loenasuites.com is ΧΡΗΣΤΟΣ ΑΘΑΝ. ΠΕΤΚΑΚΗΣ ΚΑΙ ΣΙΑ Ε.Ε. (Christos Athan. Petkakis & Co. E.E.), the company operating Loena Luxury Suites, five serviced suites at 13 Ernestou Emprar, in Ladadika, Thessaloniki, registered under AMA number 00002825758. We are a small team: the people who answer your messages are the same people who hold your booking details. This policy explains what we collect, why we collect it, and how to exercise your rights. It covers this website; the booking engine and the platforms you may have booked through publish their own policies.

What we collect, and why

We process only what a stay requires, plus what you allow us to measure. Nothing on this site collects data for resale or profiling, and only Meta receives data for advertising, only if you allow Advertising. Reservations are handled by our booking engine, reserve-online.net (WebHotelier). Rates, availability, and the cancellation terms of each rate live there, and so do the personal details you enter when booking direct. Around the booking itself we hold a small set of information, listed below.

• Booking details, the name, contact information, stay dates and rate you selected, received from reserve-online.net or from the platform you booked through
• Messages, the WhatsApp and email conversations kept so the team replying to you has the context of your stay
• Contact form submissions, the name, email address and text you send from the contact page, delivered to our inbox by Resend
• Your IP address at the moment you submit that form, read so repeat submissions can be blocked, and held in the server's memory for sixty seconds
• Request logs, the IP address, browser, page and time of each request to the site, recorded by Vercel, which hosts it
• Usage statistics through Google Analytics 4, only if you allow Measurement
• Recordings of how you move through the pages, meaning clicks, scrolling and pointer movement, through Microsoft Clarity, only if you allow Measurement. Nothing you type into a field is recorded
• Visits, enquiries and steps into the booking engine that came from our ads on Facebook and Instagram, through the Meta pixel, only if you allow Advertising. No name, email or phone number
• Arrival details, the contact information we use to send photo directions for self check-in before you arrive
• Legal records, whatever Greek tax and accommodation law requires us to keep

What loads before and after your consent

Before you answer the cookie banner, no Google, Microsoft or Meta script loads and no request goes to any of them. Your choice is split into two purposes, and you give or refuse each one separately. Measurement loads Google Analytics 4 (property G-5FQSEW25BY), which counts visits and pages and records clicks on our phone, WhatsApp, email and booking links, never with a name, a phone number or anything you type. The click that hands you to the booking engine carries the Google Analytics identifier across, so one visit and one reservation count as one person and not two. The same choice loads Microsoft Clarity (project srk4t42xua), which records clicks, scrolling and pointer movement for heatmaps and replays of a visit. Nothing you type into a field, the contact form included, is recorded. We tell Clarity you consented to measurement and never to advertising. Advertising loads the Meta pixel (1517600079262936) and nothing else. Google receives nothing for advertising, and the ad_storage, ad_user_data and ad_personalization categories stay denied whatever you choose. It sends Meta the page view, a tap on the phone or WhatsApp, a sent contact form and the step into the booking engine, with no name, email, phone number or stay details and no advanced matching. Your choice is saved in your browser, and the Cookie choices link in the footer of every page lets you change or withdraw it whenever you want. Refusing changes nothing about how the site works.

Our own booking statistics

Without asking for consent, our own server counts each search for dates on this site, each time you move on from our pages to the booking engine, and each message sent from the contact form. For a search or a move to the engine we keep the dates, the number of guests, the language of the page, the part of the page it came from, the price the booking engine answered and whether it had a suite free, your country as your network reports it, and whether you used a phone, a tablet or a computer. For a contact message we keep only its language and whether it carried dates, never what you wrote. We also count each tap on a button that leads to a booking or to us, such as call, WhatsApp, email or Book. For each tap we keep its kind, the page and the part of it, the language, whether you had chosen dates, how many nights and guests, your country and the kind of device, and never the dates themselves, your number or anything you typed. We never keep your IP address, the description your browser sends of itself, a cookie or any other identifier, and the time is kept to the hour, so these records cannot be linked to each other or to you. Nothing is stored on your device. When you move on to the booking engine, your browser tells our server about the step and you continue straight to reserve-online.net. An old /booknow/ link passes through our own address on the way. The legal basis is our legitimate interest in knowing which nights guests ask for and which we could not offer (GDPR article 6(1)(f)). Neon keeps the records on servers in Frankfurt, and they are deleted after 25 months.

Other third parties inside our pages

Two more services load content inside our own pages. The Trustindex review wall appears on the reviews page, and its script is requested from cdn.trustindex.io only if you have allowed Measurement. The map showing where we are appears on the home page, the suite page and the contact page, and draws its tiles from tiles.openfreemap.org. That map loads the moment you scroll it into view and does not wait for your answer to the banner, so OpenFreeMap receives your IP address and your browser. If you never scroll that far, no request goes out. Neither service gets your name, phone number or email from us.

Purposes, legal bases, and how long we keep things

Every processing operation has a purpose and a legal basis under the GDPR, and data is deleted once that purpose no longer needs it.

• Answering questions and being in touch about your stay, by phone, email, WhatsApp or the form, on the basis of performing a contract or steps taken before one (GDPR article 6(1)(b)). Messages are kept while the conversation and your stay last, and after that for as long as we may need them to answer a claim arising from the stay
• Running and securing the site, meaning the hosting logs and the IP check on the form, on the basis of our legitimate interest in a site that works and is not abused (GDPR article 6(1)(f)). The form's IP address stays in server memory for sixty seconds, and Vercel deletes its logs automatically after the period its plan sets
• Our own booking statistics, the counts of searches, moves to the booking engine, contact messages and button taps described above, on the basis of our legitimate interest in knowing the demand for our suites (GDPR article 6(1)(f)). They carry no identifier and are deleted after 25 months
• Visit measurement with Google Analytics 4 and Microsoft Clarity, and advertising measurement with the Meta pixel, only with your consent, given separately for each (GDPR article 6(1)(a) and article 4(5) of Greek Law 3471/2006). Their cookies expire as the cookie policy lists, and Google Analytics 4 keeps the statistics for at most 14 months. Microsoft Clarity keeps recordings for 30 days, and the ones we mark or Microsoft samples at random for up to 9 months. Meta keeps what it receives under its own privacy policy (facebook.com/privacy/policy)
• Meeting tax and other legal obligations, on the basis of a legal obligation (GDPR article 6(1)(c)). Booking and invoicing records are kept for as long as Greek tax law requires
• Recording your cookie choice, so we can show you consented (GDPR article 7(1)). It stays only in your browser, until you clear it

The booking engine and other recipients

When you press Book, you leave this website for reserve-online.net, the WebHotelier booking engine, where availability, rates, and the cancellation terms of each rate are shown and your reservation details are entered. Cancellation terms vary by season and rate; the terms displayed for your rate at booking are the ones that apply, so read them there and not here. Beyond the booking engine there are nine other companies and one category of recipient. Vercel hosts the site and receives every request to it. Google receives the Google Analytics statistics, only if you allowed Measurement. Microsoft receives the Microsoft Clarity recordings, only if you allowed Measurement, and for Clarity in the EU the contracting party is Microsoft Ireland Operations Limited. Meta Platforms Ireland Limited receives the pixel's events, only if you allowed Advertising. For collecting them and passing them to Meta we are joint controllers with Meta (GDPR article 26), and Meta alone answers for what it does with them afterwards. Trustindex serves the review wall, OpenFreeMap serves the map tiles, and Resend delivers contact form messages to our inbox. Neon keeps our own booking statistics on servers in Frankfurt. Hotelizer provides our property management system (PMS), where bookings and guest details are kept to run your stay and look after you during it. The site's server reads bookings from it to count the free suites, keeps only dates and numbers, and never stores or shows a guest's name. Greek authorities receive what the law requires of us and nothing more. We never sell personal data. Google, Microsoft, Meta, Vercel and Resend are US companies or part of US groups, so data may be transferred outside the European Economic Area. Those transfers rely on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), under which all five groups are certified, and on the standard contractual clauses in their data processing terms. Neon is a US company too, and any access to the statistics from outside the European Economic Area relies on the standard contractual clauses in its data processing agreement. Reviews you write on Booking.com, Google, or Airbnb remain governed by those platforms' own policies.

Your rights

Under the GDPR you may ask what we hold about you, correct it, have it deleted, restrict or object to its processing, or receive it in a portable format. You may withdraw consent at any time through the Cookie choices link in the footer, without affecting what was processed before. Message us on the channel you already use with us, WhatsApp included, or write to christos@loenasuites.com, and the same small team that manages your stay will answer. We reply without undue delay and within one month of receiving the request. If a request is complex, that period can be extended by up to two further months, and we tell you why within the first month. Before we act on a request we may ask you to confirm that you are the person the data concerns, for example by writing from the email address or phone number on the booking, so that nobody else can obtain or delete your data. If you believe we have handled your data wrongly, you can complain to the Hellenic Data Protection Authority (dpa.gr). And if your question is about the stay itself and not about data, the FAQ answers most of it, and the suite page shows exactly what you are booking.

• FAQ
• The suites