Last updated: 01.05.2026
This Privacy Policy explains how Tower Villas collects, uses and protects personal data when you visit our website, contact us, send an availability request or communicate with us regarding a stay at one of our villas.
By using this website, you agree to the practices described in this Privacy Policy.
1. Who we are
This website is operated by:
Tower Villas
Vasiliki, Lefkada, Greece
Website: https://towervillas.gr
Email: office@towervillas.gr
Phone / WhatsApp: +31 6 51085106
For any questions about this Privacy Policy or your personal data, you can contact us using the details above.
2. What personal data we collect
We may collect the following types of personal data:
Information you send through forms
When you use our contact form, availability request form or booking enquiry form, we may collect:
- name
- phone number
- email address
- preferred check-in and check-out dates
- selected villa
- number of guests, if requested
- message content
- any other information you choose to send us
Communication data
If you contact us by email, phone, WhatsApp or another communication channel, we may keep the information needed to answer your request and manage the conversation.
Technical data
When you visit the website, certain technical data may be processed automatically, such as:
- IP address
- browser type and version
- device type
- pages visited
- date and time of visit
- approximate location based on technical data
- cookie identifiers, where applicable
The European Commission explains that personal data includes information that can identify a person directly or indirectly, such as an email address, IP address or cookie ID.
3. How we use your personal data
We use personal data for the following purposes:
- to respond to availability requests
- to answer questions about the villas, prices, dates or services
- to communicate with you before, during or after a potential stay
- to manage booking enquiries
- to improve the website and user experience
- to protect the security of the website
- to comply with legal or administrative obligations
We do not sell your personal data.
4. Legal basis for processing
Depending on the situation, we process personal data based on one or more of the following legal grounds:
- Consent, when you choose to send us a message, submit a form or accept optional cookies.
- Contract or pre-contractual steps, when you ask about availability, prices or a possible booking.
- Legitimate interest, when we need to operate the website, respond to enquiries, prevent abuse or improve our services.
- Legal obligation, when we are required to keep certain records under applicable law.
5. Contact and availability forms
When you submit a form on the website, the information you provide is used only to respond to your request and to manage communication related to your enquiry.
Required fields may include your name, phone number, preferred dates and selected villa. Email may be requested so we can send written confirmation or additional details.
Please do not send sensitive personal information through the website forms.
6. WhatsApp communication
If you contact us through WhatsApp, your communication will also be subject to WhatsApp’s own privacy practices. We use WhatsApp only to respond to your request and communicate about availability, prices, directions or booking details.
7. Cookies and similar technologies
Our website may use cookies or similar technologies to:
- make the website work properly
- remember user preferences
- measure website traffic
- improve performance
- support marketing or analytics tools, if enabled
Essential cookies may be used without consent because they are needed for the website to function. Optional cookies, such as analytics or marketing cookies, should only be used after your consent, where required.
You can manage or withdraw cookie consent through the cookie banner or through your browser settings.
8. Analytics and third-party tools
We may use third-party tools such as Google Analytics, Google Maps, Waze links, embedded content, security plugins or hosting services.
These services may process technical data such as IP address, device information, browser information or usage data. Some providers may process data outside the European Economic Area.
Where required, we use these tools based on consent or legitimate interest and take reasonable steps to protect your data.
9. Google Maps and Waze
The website may include links or embedded tools for directions through Google Maps or Waze. When you open these services, your interaction is governed by the privacy policies of those third-party providers.
10. Who receives your data
Your personal data may be shared only where necessary with:
- website hosting providers
- email service providers
- form and booking enquiry tools
- website maintenance providers
- analytics or security providers
- legal, accounting or administrative advisers, if required
- public authorities, if required by law
We do not allow third parties to use your personal data for their own marketing unless you have given consent.
11. International transfers
Some service providers, such as analytics, email, security or map providers, may process data outside the European Economic Area. Where this happens, we rely on appropriate safeguards required by data protection law, such as standard contractual clauses or equivalent protection mechanisms.
12. How long we keep your data
We keep personal data only for as long as needed for the purpose for which it was collected.
Typical retention periods:
- availability and contact requests: up to 24 months
- booking-related communication: for the period required for administrative, tax or legal purposes
- technical security logs: usually for a limited period, unless needed to investigate abuse or security issues
- cookie consent records: according to the cookie tool settings and legal requirements
When data is no longer needed, it is deleted or anonymised.
13. How we protect your data
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure.
These measures may include:
- HTTPS connection
- secure hosting
- limited access to website administration
- regular website updates
- security plugins or monitoring tools
- careful handling of form submissions and emails
No online system can be guaranteed to be completely secure, but we work to keep your information protected.
14. Your rights
Under GDPR, you have several rights regarding your personal data, including the right to be informed, access, rectification, erasure, restriction of processing, portability, objection and rights related to automated decision-making.
You may ask us to:
- confirm whether we process your personal data
- provide a copy of your personal data
- correct inaccurate or incomplete data
- delete your personal data, where applicable
- restrict or object to certain processing
- withdraw consent, where processing is based on consent
- receive your data in a portable format, where applicable
To exercise these rights, contact us at:
[add email address]
We may need to verify your identity before responding to a request.
15. Complaints
If you believe your personal data has not been handled properly, you have the right to contact a data protection authority.
For Greece, the competent authority is:
Hellenic Data Protection Authority
Website: https://www.dpa.gr
You may also contact the data protection authority in your country of residence within the European Union.
16. Children’s privacy
Our website is not intended to collect personal data directly from children. If you believe a child has sent us personal data without appropriate consent, please contact us and we will take appropriate steps to delete it.
17. Links to other websites
Our website may contain links to external websites, such as tourism services, activity providers, Google Maps, Waze or partner websites. We are not responsible for the privacy practices or content of external websites.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The updated version will be published on this page with a new “Last updated” date.
