Privacy Policy

We care about the protection of your privacy and, in particular, the protection of your Personal Data.

We have adopted this Privacy Policy in order to inform visitors of the website https://costaofryniobooking.gr about the types of personal data that may be processed, the purposes for which such data are collected and processed, the way in which your data are processed, the recipients of such data, your rights and choices, as well as the ways in which you may contact us regarding any matter relating to your personal data.

This Privacy Policy includes information regarding:

• the Data Controller responsible for the processing of your personal data,
• the types of personal data we collect,
• the purposes for which your personal data are collected and processed and the applicable legal bases,
• the security measures we implement to protect your personal data,
• the period for which your personal data are retained,
• your rights and the way in which you may exercise them.

Data Controller

The Data Controller is the company under the corporate name:

“NIKOLAOS KOURTIDIS – CONSTRUCTION – REAL ESTATE – TOURISM ENTERPRISES S.A.”

with the distinctive title:

“NIKOLAOS KOURTIDIS S.A.”

a member of KOURTIDIS GROUP, with registered office at Paralia Ofryniou, Kavala, P.C. 64008, Greece.

Telephone: +30 25940 31500
E-mail: privacy@costaofryniobooking.gr

Information We Collect

“Personal Data” means any information that can be used to identify a natural person.

Our Company collects such information when you use or interact with us through our website.

If You Make an Accommodation Booking Through the Website

When making a booking through our website, we may ask you to provide certain personal information, including, for example:

• full name,
• e-mail address,
• telephone number,
• financial information necessary for the processing of your booking.

If you choose to make your booking through a loyalty programme or loyalty club in order to benefit from exclusive privileges, the following may apply:

Continue with Google:
You will be required to select your e-mail address and follow Google’s authentication process. For more information about the privacy practices applied by Google, you may consult Google’s respective privacy policy.

Continue with Facebook:
You will be redirected to the official Facebook service and will be required to follow the authentication process provided by that service. For more information, you may consult Facebook’s privacy policy.

Sign in with e-mail:
You will be required to provide your e-mail address.

If You Make a Booking for Both a Flight and Accommodation

When booking accommodation together with an airline ticket, you may be asked to provide personal information such as:

• full name,
• e-mail address,
• telephone number,
• date of birth,
• country,
• city,
• financial information necessary for processing the booking.

If You Wish to Participate in Suggested Activities

When booking an activity or another related service, you may be asked to provide personal information such as your full name and e-mail address, as well as financial information necessary for processing the booking.

If You Wish to Contact Us

Through the contact form available on our website, and in order for us to respond to requests or questions concerning the services we provide, you may be asked to provide:

• your name,
• your e-mail address,
• your mobile telephone number.

While browsing the website, you may also be asked to provide personal information in order to benefit from certain services or features.

For example, when you provide your consent to receive promotional communications, newsletters and updates regarding our services, you will be asked to provide your e-mail address.

In any other case, you will be appropriately informed of the purpose of the processing and, where required, your explicit consent will be requested before your personal data are collected.

Social Media

When communicating with us through the Company’s social media accounts, such as Facebook, LinkedIn, YouTube and other platforms, you may provide us with identification and contact information.

Such data are processed, as appropriate, solely for the purpose of handling and responding to your request.

Collection of Data by Automated Means

Log Files

When you visit our website, certain information may be collected automatically by our server and recorded in log files.

The purpose of storing such information is:

• to ensure the security of the information and services provided through the website,
• to investigate potential cyberattacks and security incidents,
• to support any related legal claims.

The legal basis for such processing is Article 6(1)(f) of the GDPR, as the processing is necessary for the purposes of the legitimate interests pursued by the Company.

Log files are retained for a period of 12 months and may be disclosed to third-party processors responsible for the management of the website or to the competent authorities where this is deemed necessary for the investigation of a security incident or cyberattack.

Data that are under investigation or used in connection with legal claims may be retained for as long as required for those specific purposes.

Cookies

When you interact with our website, certain data may be collected automatically from your device or browser through cookies.

Cookies are small text files used by websites and can contribute to improving the user experience.

Detailed information regarding cookies, their categories, purposes, duration and your consent choices is available in our Cookie Policy.

Information Concerning Minors

Our website and services are not intended for use by persons under the age of 15.

The Company does not collect Personal Data from persons under the age of 15 without the consent of a parent or legal guardian.

If you are the parent or legal guardian of a minor and believe that your child may have provided us with personal data without the required consent, please contact us at:

privacy@costaofryniobooking.gr

Why We Use Your Personal Data

We use your personal data for the following purposes:

• To respond to your contact requests and provide information regarding our services.
• To manage, process and complete bookings.
• To manage payments and ensure the security of financial transactions.
• To issue invoices, where applicable.
• To manage user requests and preferences.
• To handle complaints.
• To manage participation in loyalty or membership programmes.
• To manage the earning and redemption of points, where applicable.
• To understand and analyse the results of our advertising and promotional activities.
• To respond to and fulfil requests concerning your rights in relation to personal data.
• To ensure the security of transactions.
• To carry out business analysis and improve our services and business activities.
• To optimise your experience and the service we provide.
• To detect, prevent and address fraud or other unlawful activities.
• To protect the rights and property of the Company or third parties.
• To send personalised commercial communications by electronic or other means where you have expressly consented to receive them, such as when subscribing to our newsletter.
• To manage the provision of contractual accommodation services and additional services.

We may also use your data for other purposes. In such cases, you will be provided with specific information at the time the data are collected and, where required, your consent will be obtained before the relevant processing takes place.

For the purposes described above, we collect and process only the personal data that are appropriate and necessary for the relevant purpose.

To Whom We Disclose Your Personal Data

The personal data we collect may be disclosed to third parties where necessary.

In particular, personal data may be disclosed:

• To competent supervisory, public or judicial authorities where required by applicable law or pursuant to a court decision.
• To third-party external partners who process personal data on our behalf and are required to implement an appropriate level of data protection, such as law firms, financial advisers and accountants, advertising companies, IT service providers, providers of technical support for information systems and networks, courier companies, travel agencies and other partners necessary for the provision of our services.

When booking accommodation and/or airline tickets, the information necessary for completing the booking may be disclosed to the relevant partners involved in the booking process, including for the purpose of modifying or cancelling a booking.

Financial information may be disclosed to the appropriate payment service provider or another third party solely for the purpose of verifying and completing the payment.

Transfers of Personal Data Outside the European Economic Area

We may transfer personal data to processors or sub-processors located outside the European Economic Area.

Where such transfers take place, we implement the appropriate safeguards to ensure that the transfer is carried out in accordance with applicable data protection legislation.

Your data may also be stored or processed through the infrastructure of third-party cloud service providers, subject to the technical and organisational measures implemented by the Company and the safeguards required by applicable law.

Legal Bases for the Processing of Your Personal Data

The Company relies on the following legal bases when processing your personal data:

Performance of a Contract

Where the processing of your personal data is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract.

Legal Obligation

Where we are required to process your personal data in order to comply with a legal obligation, including:

• keeping records for tax purposes,
• responding to requests from public or governmental authorities,
• complying with court orders or other lawful procedures.

Legitimate Interests

We may process your personal data where such processing is necessary for the purposes of a legitimate interest pursued by the Company, provided that such interests are not overridden by your interests, fundamental rights or freedoms.

Examples of such legitimate interests may include:

• protecting our business activities,
• ensuring the security of our systems,
• enforcing our terms and conditions,
• protecting the rights, privacy, security and property of the Company, our users or third parties.

Consent

Where required, we may ask you to provide specific consent for the processing of certain personal data.

Such processing will take place only if you agree to it.

You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

To withdraw your consent, you may contact us at:

privacy@costaofryniobooking.gr

Your Rights

Under the General Data Protection Regulation, and subject to the conditions provided by law, you have the following rights:

Right of Access

You have the right to request information about whether we process your personal data and, where applicable, which personal data we process.

Right to Rectification

You have the right to request the correction of inaccurate personal data or the completion of incomplete personal data.

Right to Erasure

You have the right to request the deletion of your personal data where the conditions provided by law are met.

Right to Restriction of Processing

You may request the restriction of the processing of your personal data in the circumstances provided by applicable law.

Right to Data Portability

Subject to the applicable legal conditions, you may receive personal data that you have provided to us in a structured, commonly used and machine-readable format and request that such data be transferred to another controller.

Right to Object

You have the right to object at any time to the processing of your personal data where such processing is based on legitimate interests.

The Company may continue the processing where it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where processing is necessary for the establishment, exercise or defence of legal claims.

Right to Lodge a Complaint

If you believe that your rights have been infringed, you have the right to lodge a complaint with the:

Hellenic Data Protection Authority

Address: 1-3 Kifisias Avenue, P.C. 115 23, Athens, Greece
Telephone: +30 210 6475600
E-mail: contact@dpa.gr

Exercising Your Rights

For any additional information or in order to exercise the rights described above, you may contact us in writing at:

NIKOLAOS KOURTIDIS S.A.
Paralia Ofryniou, Kavala
P.C. 64008, Greece

or by e-mail at:

privacy@costaofryniobooking.gr

As a general rule, your request will be handled within one month from the date of receipt.

Information and actions carried out pursuant to Articles 15 to 22 and 34 of the GDPR are provided free of charge, except where otherwise permitted by applicable law.

User Responsibility

The User warrants that the information provided is true, accurate and up to date.

The User is responsible for keeping the personal data provided to us accurate and current.

Where the User provides personal data concerning third parties, the User confirms that they have an appropriate legal basis for providing such information and that the relevant individuals have been appropriately informed.

The User is responsible for any false or inaccurate information provided and for any damage arising as a result of such information.

Security and Retention of Your Personal Data

We retain your personal data only for as long as necessary for the purposes for which they are processed.

The applicable retention period depends, where relevant, on:

• the duration of our contractual relationship,
• the duration of your consent,
• our legal obligations,
• our tax and accounting obligations,
• the legitimate interests of the Company.

The processing of personal data is carried out in a manner that ensures appropriate confidentiality and security.

The Company implements appropriate technical and organisational measures to ensure a level of security appropriate to the relevant risks and to protect personal data against:

• accidental or unlawful destruction,
• loss,
• alteration,
• unauthorised disclosure,
• unauthorised access,
• other forms of unlawful processing.

We also require third parties that may receive personal data to implement appropriate technical and organisational security measures in accordance with applicable Greek and European data protection legislation.

Special Categories of Personal Data

Unless expressly requested and necessary for the provision of a particular service, please do not send or disclose sensitive personal data through the website.

Such data may include information relating to:

• racial or ethnic origin,
• political opinions,
• religious or philosophical beliefs,
• health,
• biometric or genetic characteristics,
• trade union membership,
• other special categories of personal data protected by applicable law.

Financial or banking information should be provided only where necessary for processing the relevant service or booking and only through the secure fields and procedures provided for this purpose.

Links to Other Websites

Our website may contain links to third-party websites.

This Privacy Policy does not apply to those third-party websites.

Please refer to the privacy policies of those websites for more information about how they process your personal data.

The Company is not responsible for the content, availability, services or data protection practices of third-party websites that may be accessed through links, hyperlinks or banners.

These may include websites and services such as Facebook, YouTube, LinkedIn, Tripadvisor and other third-party platforms.

Our website may also include links to websites operated by other companies that are members of KOURTIDIS GROUP. Each website is governed by its own Privacy Policy.

Updates to This Privacy Policy

This Privacy Policy was last updated on 10 September 2026.

This Privacy Policy may be amended from time to time.

If we decide to amend this Privacy Policy, we may inform you by means of appropriate notices displayed on our website.

If we materially change the manner in which your personal data are processed, you will be informed in advance and, where required by law, your consent will be obtained before the new processing activities are implemented.

Contact

For any questions or comments regarding this Privacy Policy or our practices relating to the processing of personal data, you may contact us at:

NIKOLAOS KOURTIDIS S.A.
Paralia Ofryniou, Kavala
P.C. 64008, Greece

Telephone: +30 25940 31789
E-mail: privacy@costaofryniobooking.gr