Privacy Policy
Last updated: 8 November 2026
Who we are
This website (hermesrhodes.gr) is operated by ΞΕΝΟΔΟΧΕΙΑΚΑΙ ΚΑΙ ΤΟΥΡΙΣΤΙΚΑΙ ΕΠΙΧΕΙΡΗΣΕΙΣ ΕΡΜΗΣ Α.Ε. (Hermes Hotel and Tourist Enterprises S.A.), 5 Plastira str, 85100 Rhodes, Greece, VAT No. 094038315, G.E.MI. No. 71500820000 (“we”, “the hotel”).
We are the controller of the personal data described below. Contact: reservations@hermesrhodes.gr, tel. +30 22410 27677.
What data we process and why
Booking requests and enquiries. When you send the booking form, or contact us by e-mail or phone, we process the data you give us (name, e-mail address, phone number, dates of stay, number of guests and any message) in order to reply, check availability and prepare your booking. The form sends your request to us as an e-mail through our e-mail provider, and the website itself keeps no copy. To prevent abuse, a pseudonymised form of your IP address is kept for up to one hour. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
Visiting the website. Our hosting provider automatically records technical data (IP address, date and time, page requested, browser) in server logs, to deliver the website and keep it secure. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Statistics (Google Analytics). Only if you click “Accept” in the cookie banner, we use Google Analytics and Google Tag Manager to understand how visitors use the website (pages visited, device and browser type, approximate location, referring website). Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings” at the bottom of every page.
Video and map. The YouTube video and the Google map are loaded only when you click on them. From that moment Google receives data such as your IP address, under its own privacy policy.
Facebook. The Facebook icon is a plain link; no data is sent to Facebook unless you click it.
Who receives your data
- Our hosting and e-mail service providers, who process data on our behalf.
- Google Ireland Ltd (Google Analytics, Tag Manager, YouTube, Google Maps), only as described above.
- Public authorities, when we are required to by law.
We do not sell or rent your personal data.
Transfers outside the EU
Google may process data in the United States. Such transfers are based on the EU–U.S. Data Privacy Framework and the European Commission’s Standard Contractual Clauses.
How long we keep your data
- Enquiries that do not lead to a booking: up to 2 years.
- Bookings: for as long as required by tax and accounting law.
- Server logs: for the short period set by our hosting provider.
- Google Analytics data: for the retention period set in Google Analytics (maximum 14 months).
Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability and to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal. To exercise your rights, write to reservations@hermesrhodes.gr. We will reply within one month.
You also have the right to lodge a complaint with the Hellenic Data Protection Authority, 1-3 Kifisias Ave., 115 23 Athens, www.dpa.gr.
Children
This website is not intended for children under 15. We do not knowingly collect data from children.
Security
The website is served only over an encrypted connection (HTTPS) and does not use a database or user accounts.
Changes
We may update this policy. The current version is always published on this page.