Legal
Privacy Policy
Last updated: 4 October 2026
1. Introduction and Identity of the Data Controller
This Privacy Policy explains how Over The Top EE (Eterorrythmi Etaireia / Limited Partnership), trading as “Agatha Suites” (“Agatha Suites”, “we”, “us” or “our”), collects, uses, stores and otherwise processes personal data in connection with its short-term rental accommodation business and website.
For the purposes of Regulation (EU) 2016/679 (“GDPR”) and applicable Greek data protection legislation, including Law 4624/2019, the Data Controller is:
Over The Top EE (Eterorrythmi Etaireia / Limited Partnership)
Trading name: Agatha Suites
Registered address: Tinou 4, Larissa, 41334, Greece
Greek Tax Identification Number (AFM): 802711305
Privacy contact: info@ovrtp.com
Agatha Suites operates four short-term rental suites in Piraeus, Greece:
- Agatha 1 — AMA 3177551
- Agatha 2 — AMA 3177572
- Agatha 3 — AMA 3177525
- Agatha 4 — AMA 3626107
The properties are registered in the Greek Short-Term Stay Property Registry (Μητρώο Ακινήτων Βραχυχρόνιας Διαμονής) maintained by the Independent Authority for Public Revenue (“AADE”).
This Privacy Policy applies to personal data processed by Agatha Suites in connection with reservations, stays, guest communications, access to the suites, guest reviews, legal and tax obligations, and the Agatha Suites website.
Where personal data is processed by a third party acting as an independent controller, that third party's own privacy policy applies to its processing. This is particularly relevant to Airbnb, Booking.com and WhatsApp/Meta, as described below.
2. Personal Data We Collect
We process personal data that is reasonably necessary for the purposes described in this Privacy Policy.
2.1 Reservation and Booking Data
Reservations for Agatha Suites are made through Airbnb and Booking.com.
Airbnb and Booking.com operate their respective platforms and process guest personal data under their own privacy policies and legal responsibilities. They act as independent controllers for their own processing activities.
Depending on the information made available to us, Agatha Suites may receive:
- first and last name;
- contact details, including telephone number and/or email address;
- booking or reservation reference;
- arrival and departure dates;
- number of guests;
- information necessary to administer the reservation;
- guest messages and requests communicated through the platform; and
- information concerning special requests or arrangements relevant to the stay.
We do not receive or process payment-card details through our own systems where payment is handled by Airbnb or Booking.com.
We use reservation information to administer reservations, communicate with guests, arrange access to the accommodation, provide the booked accommodation, address requests or problems concerning a stay, comply with legal and tax obligations, maintain required business records, and establish, exercise or defend legal claims where necessary.
Where personal data is received from Airbnb or Booking.com rather than directly from the guest, the information in this Privacy Policy also serves to explain the source and purposes of that processing as required by Article 14 GDPR.
2.2 Smart-Lock and Access Data
Each Agatha Suites property uses a smart-lock system operated through our smart lock service provider.
For access administration, we may process:
- the guest's name or another identifier necessary to associate an access credential with a reservation;
- the relevant suite;
- an access code or access credential;
- the validity period of the access credential; and
- records showing access to and/or exit from the suite, including relevant dates and times.
Access codes are generated and delivered to guests for the purpose of enabling authorised access to the suite during the applicable stay.
Smart-lock information is used for:
- access management;
- ensuring that only authorised persons can access the accommodation;
- security of the accommodation, guests and property;
- investigating suspected unauthorised access or security incidents; and
- establishing, exercising or defending legal claims where necessary.
Smart-lock access logs are retained for a maximum of 90 days and are then deleted, except where a particular record must be preserved because of a legal obligation or an actual or reasonably anticipated legal claim.
The legal bases are Article 6(1)(b) GDPR, where processing is necessary for performance of the accommodation arrangement, and Article 6(1)(f) GDPR, where processing is necessary for Agatha Suites' legitimate interests in security, access management and protection of property and persons.
2.3 Communications by Email and WhatsApp
Agatha Suites communicates with guests by email and WhatsApp where necessary for the administration of reservations and stays.
Communications may include:
- reservation-related information;
- arrival and departure instructions;
- access instructions and smart-lock information;
- responses to guest questions;
- information concerning problems affecting a stay;
- requests for information necessary to provide the accommodation; and
- other communications directly related to the guest's reservation or stay.
Email services are hosted by Top.Host, a Greek provider whose hosting infrastructure operates within the European Union.
WhatsApp is a third-party service operated within the Meta group. Its use may involve the processing and transfer of personal data outside the European Economic Area.
Agatha Suites uses WhatsApp as a communication channel for purposes connected with the guest's reservation and stay. We do not use WhatsApp communications for behavioural advertising, profiling or unrelated marketing.
Where communications are necessary for performance of the accommodation arrangement, the legal basis is Article 6(1)(b) GDPR. Where communications are necessary for security, administration or other legitimate operational purposes, the legal basis may be Article 6(1)(f) GDPR.
Agatha Suites does not intentionally request special categories of personal data through WhatsApp or email. Guests should avoid sending unnecessary sensitive information.
2.4 Guest Reviews
Agatha Suites may display guest review text on the Agatha Suites website.
Reviews are displayed anonymously. Agatha Suites does not display the reviewer's:
- name;
- photograph;
- email address;
- telephone number; or
- other information intended to identify the reviewer.
The purpose of publishing anonymous reviews is limited to displaying guest feedback concerning the accommodation.
The legal basis for publication of a guest review is Article 6(1)(a) GDPR — consent.
Consent may be withdrawn at any time by contacting info@ovrtp.com.
A guest may also request removal of their review by contacting info@ovrtp.com and identifying the review sufficiently for Agatha Suites to locate it. Agatha Suites will remove the review from its website following a valid removal request, subject to any overriding legal obligation or requirement to preserve evidence in connection with a legal claim.
The reviewer's identity is not displayed alongside the review.
2.5 Website Data
The Agatha Suites website is hosted by Netlify.
Agatha Suites does not use:
- Google Analytics or other analytics platforms;
- advertising pixels;
- behavioural advertising technologies;
- social-media tracking pixels;
- retargeting technologies; or
- other non-essential tracking tools.
When a visitor accesses the website, technical information may be processed by the hosting infrastructure for the purposes of delivering, securing and maintaining the website. Such information may include an IP address, date and time of a request, browser or device information, requested resources and technical security information.
The website uses only cookies that are strictly necessary for its operation, security or functionality.
Strictly necessary cookies are used only where required for the technical operation or security of the website and are not used for advertising, analytics, profiling or behavioural tracking.
If Agatha Suites introduces non-essential cookies or tracking technologies in the future, this Privacy Policy will be updated and an appropriate consent mechanism will be implemented where required by applicable law.
2.6 Legal, Tax and Regulatory Data
Agatha Suites processes personal data where necessary to comply with legal obligations applicable to its short-term rental business.
This includes, where applicable:
- maintaining records required by Greek tax and accounting legislation;
- maintaining the properties in the AADE Short-Term Stay Property Registry;
- submitting Short-Term Stay Declarations to AADE;
- retaining supporting accounting and tax documentation;
- responding to lawful requests from tax, judicial, regulatory or other competent public authorities; and
- establishing, exercising or defending legal claims.
Agatha Suites will not collect or retain personal data merely because it might be useful in the future. Personal data is retained only to the extent necessary for a specific legal, contractual, security or operational purpose.
3. Purposes and Lawful Bases
| Purpose | Personal data | Legal basis under Article 6 GDPR |
|---|---|---|
| Administering reservations and stays | Name, contact details, reservation details, dates, number of guests, booking reference and relevant requests/messages | Article 6(1)(b) — performance of a contract or steps at the guest's request before entering into a contract |
| Communicating with guests regarding reservations and stays | Name, telephone number, email address, reservation information and messages | Article 6(1)(b) and, where appropriate, Article 6(1)(f) |
| Providing check-in and access | Name or identifier, suite, access code and access validity | Article 6(1)(b) |
| Security and access management | Access credentials, entry/exit dates and times and suite information | Article 6(1)(f) — legitimate interests in security and protection of property and persons; and, where applicable, Article 6(1)(b) |
| Investigating unauthorised access, security incidents or disputes | Reservation information, communications and smart-lock logs | Article 6(1)(f) and, where applicable, Article 6(1)(c) |
| AADE reporting and tax compliance | Guest and reservation information required for reporting, transaction information and accounting records | Article 6(1)(c) — compliance with a legal obligation |
| Maintaining legally required accounting and tax records | Reservation, transaction and accounting information | Article 6(1)(c) |
| Responding to lawful requests from public authorities | Relevant personal data required by the request | Article 6(1)(c) and, where applicable, Article 6(1)(f) |
| Establishing, exercising or defending legal claims | Relevant reservation, communication, access and transaction records | Article 6(1)(f) and, where applicable, Article 6(1)(c) |
| Publishing anonymous guest reviews | Review text | Article 6(1)(a) — consent |
| Operating and securing the website | Technical information such as IP address and security information | Article 6(1)(f) where necessary for security and operation |
| Strictly necessary cookies | Technical identifiers required for website functionality and security | Legitimate interests and applicable ePrivacy rules permitting strictly necessary cookies without consent |
Where processing is based on legitimate interests under Article 6(1)(f), Agatha Suites considers the legitimate interest pursued, the necessity of the processing and the interests and fundamental rights and freedoms of the individual concerned.
Agatha Suites does not use personal data for unrelated advertising or behavioural profiling.
4. Recipients, Processors and Other Third Parties
Personal data may be disclosed to or processed by the following categories of recipients where necessary for the purposes described in this Privacy Policy.
Airbnb
Airbnb is an independent controller for its own processing of personal data. Agatha Suites receives certain reservation and guest information from Airbnb for the administration of stays.
Airbnb's own privacy policy governs its independent processing of personal data.
Booking.com
Booking.com is an independent controller for its own processing of personal data. Agatha Suites receives reservation and guest information from Booking.com for the administration of stays.
Booking.com's own privacy documentation governs its independent processing.
Smart Lock Service Provider
Our smart lock service provider processes information necessary to operate the smart-lock system, generate and manage access credentials and maintain access logs.
Top.Host
Top.Host provides email and/or hosting services used by Agatha Suites. To the extent it processes personal data on behalf of Agatha Suites, it does so under the applicable contractual arrangements.
Netlify
Netlify provides hosting infrastructure for the Agatha Suites website. Netlify may process technical website information in connection with hosting, security and operation of the website.
WhatsApp/Meta
WhatsApp is used as a third-party communications service. WhatsApp/Meta is responsible for its own processing under its applicable privacy terms. Agatha Suites does not control the independent processing carried out by WhatsApp/Meta.
Accountant and Professional Advisers
Personal data may be provided to Agatha Suites' accountant and, where necessary, lawyers or other professional advisers for accounting, tax, legal or compliance purposes.
Public Authorities
Personal data may be disclosed to AADE, tax authorities, courts, law-enforcement authorities, regulatory authorities or other public bodies where disclosure is required or permitted by law.
Agatha Suites limits such disclosures to the information required or legally permitted.
5. International Data Transfers
Agatha Suites takes appropriate measures to ensure that personal data transferred outside the European Economic Area (“EEA”) is processed in accordance with Chapter V GDPR.
WhatsApp/Meta
Use of WhatsApp may involve transfers of personal data to countries outside the EEA, including the United States.
Where applicable, such transfers may rely on an adequacy decision, including the EU-U.S. Data Privacy Framework, or on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs).
Netlify
Netlify is a U.S.-based provider and may process website-related information outside the EEA.
Where personal data is transferred to a country without an applicable adequacy decision, appropriate safeguards, including Standard Contractual Clauses where applicable, are used in accordance with Chapter V GDPR.
Other Providers
Where another service provider processes personal data outside the EEA, Agatha Suites will use an appropriate transfer mechanism permitted under Chapter V GDPR, such as an adequacy decision, Standard Contractual Clauses or another lawful safeguard.
Airbnb and Booking.com are independent controllers and are responsible for the international transfers associated with their own processing activities under their respective privacy policies.
6. Data Retention
Agatha Suites does not retain personal data for longer than necessary for the purpose for which it was collected, except where a longer period is required by law or necessary for the establishment, exercise or defence of legal claims.
Reservation and Tax/Accounting Records
Reservation and transaction information forming part of legally required accounting, tax or other statutory records is retained for the applicable statutory period.
Under Article 13 of Greek Law 5104/2024, relevant accounting records are generally retained for at least five years from the end of the relevant tax year, subject to circumstances requiring a longer retention period under applicable law, including certain circumstances concerning tax assessment or ongoing tax disputes.
Where another applicable legal requirement requires a longer period, the longer period applies.
AADE Short-Term Stay Records
Information required for Short-Term Stay Declarations and the AADE Short-Term Stay Property Registry is retained for the period required by applicable tax and accounting legislation.
Guest Communications
Ordinary guest emails, WhatsApp messages and other operational communications are retained for 30 days after checkout, after which they are deleted or anonymised, unless they are required for a legal obligation, complaint, dispute, security incident or actual or reasonably anticipated legal claim.
Where necessary for a legal claim, relevant communications may be retained for as long as reasonably necessary for that claim.
Smart-Lock Logs
Smart-lock entry and exit logs are retained for a maximum of 90 days and are then deleted.
A particular record may be preserved beyond 90 days only where a specific legal obligation or legal claim requires its preservation.
Guest Reviews
Anonymous review text is retained while it remains published on the website unless the guest requests removal or the review is otherwise removed.
Where consent is withdrawn or a valid removal request is received, the review will be removed without undue delay, subject to any overriding legal obligation or need to preserve evidence for a legal claim.
Website Technical and Security Logs
Website technical and security information is retained only for as long as reasonably necessary for website operation, cybersecurity, troubleshooting and the establishment, exercise or defence of legal claims.
Deletion
At the end of the applicable retention period, personal data is securely deleted, anonymised or otherwise rendered no longer identifiable unless continued retention is required by law or necessary for a legal claim.
7. Data Security
Agatha Suites takes appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
These measures include, as appropriate:
- restricting access to personal data to persons who require it for legitimate business purposes;
- using access controls and authentication;
- using reputable third-party service providers subject to appropriate contractual and security arrangements;
- using encrypted communication channels where provided by the relevant service;
- limiting personal data to what is reasonably necessary;
- deleting information when applicable retention periods expire; and
- taking reasonable measures to identify and respond to suspected security incidents.
No method of electronic transmission or storage can be guaranteed to be completely secure. Agatha Suites nevertheless maintains security measures proportionate to the nature and risks of the processing.
8. Data Subject Rights
Subject to the conditions and limitations established by the GDPR and applicable law, individuals have the following rights.
Right of Access — Article 15 GDPR
You may request confirmation as to whether Agatha Suites processes personal data concerning you and, where applicable, obtain access to that data and information concerning its processing.
Right to Rectification — Article 16 GDPR
You may request correction of inaccurate personal data and completion of incomplete personal data.
Right to Erasure — Article 17 GDPR
You may request deletion of your personal data where the conditions of Article 17 GDPR apply.
This right is not absolute. Agatha Suites may be required to retain information to comply with a legal obligation or establish, exercise or defend legal claims.
Right to Restriction — Article 18 GDPR
You may request restriction of processing where the conditions of Article 18 GDPR apply.
Right to Data Portability — Article 20 GDPR
Where the legal conditions are satisfied, you may request personal data that you have provided to Agatha Suites in a structured, commonly used and machine-readable format, or request its transmission to another controller where technically feasible.
Right to Object — Article 21 GDPR
Where processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR, you may object to processing on grounds relating to your particular situation.
Agatha Suites will stop processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
You may object to direct marketing at any time. Agatha Suites does not use guest personal data for direct marketing.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw your consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
For example, you may withdraw consent for publication of an anonymous guest review by contacting info@ovrtp.com.
Automated Decision-Making and Profiling
Agatha Suites does not carry out automated decision-making within the meaning of Article 22 GDPR and does not carry out profiling that produces legal effects or similarly significant effects.
Third-party platforms may independently carry out automated processing within their own services. Such processing is governed by the relevant platform's privacy policy.
Exercising Your Rights
To exercise any of your rights, contact:
Please identify the right you wish to exercise and provide sufficient information to enable Agatha Suites to identify the relevant records.
Agatha Suites may request reasonable additional information where necessary to verify identity and protect personal data against unauthorised disclosure.
Requests will normally be answered without undue delay and, in any event, within one month of receipt, subject to the conditions and extensions permitted by Article 12 GDPR.
9. Right to Lodge a Complaint with the Hellenic Data Protection Authority
You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement.
For matters falling within the jurisdiction of Greece, the competent supervisory authority is:
Hellenic Data Protection Authority (HDPA)
1–3 Kifisias Avenue
115 23 Athens
Greece
Telephone: +30 210 6475600
Email: contact@dpa.gr
Website: www.dpa.gr
You are not required to contact Agatha Suites before lodging a complaint with the HDPA.
10. Cookies
The Agatha Suites website uses only cookies that are strictly necessary for its operation, security or functionality.
Such strictly necessary cookies do not require consent where their use is permitted without consent under applicable ePrivacy legislation.
Agatha Suites does not use cookies for:
- advertising;
- behavioural tracking;
- cross-site tracking;
- analytics;
- remarketing; or
- profiling.
If non-essential cookies or tracking technologies are introduced in the future, Agatha Suites will update this Privacy Policy and implement an appropriate consent mechanism where required by law.
11. Children's Data
Agatha Suites' accommodation services are arranged through the applicable booking platforms.
Children may stay at the accommodation as part of a guest group. Where information concerning a child is provided by an adult guest or booking platform and is necessary for administration of the stay, access arrangements, safety or compliance with a legal obligation, Agatha Suites may process that information for those limited purposes.
Agatha Suites does not knowingly use children's personal data for behavioural advertising, profiling or unrelated marketing.
Guests should not provide personal data concerning children unless it is necessary for the reservation, stay, access arrangements, safety or compliance with a legal obligation.
Where consent is relied upon for processing involving a child and parental or guardian authorisation is legally required, the applicable authorisation will be obtained.
12. Changes to This Privacy Policy
Agatha Suites may update this Privacy Policy where necessary to reflect:
- changes in applicable legislation or regulatory guidance;
- changes to services or systems used by Agatha Suites;
- changes to the purposes or legal bases of processing;
- introduction or removal of third-party service providers;
- changes to international data-transfer arrangements; or
- changes to website cookies or tracking technologies.
The “Last updated” date at the beginning of this Privacy Policy will be amended whenever the Policy is materially revised.
Where required by applicable law, Agatha Suites will provide additional information concerning material changes.
13. Contact Details
For questions concerning this Privacy Policy or the processing of personal data by Agatha Suites, please contact:
Over The Top EE (Eterorrythmi Etaireia / Limited Partnership)
Trading as Agatha Suites
Tinou 4
41334 Larissa
Greece
AFM: 802711305
Privacy contact: info@ovrtp.com
This email address may be used for privacy requests, including requests for access, rectification, erasure, restriction, objection, portability or withdrawal of consent.