Privacy
Policy

Last updated: 31 October 2026

This policy explains what personal data CITYLUXE Suites & Rooms handles when you visit this website, contact us, book a stay or check in online, and what your rights are.

1. Who we are

The data controller is CITYLUXE E.E., the company that operates CITYLUXE Suites & Rooms, 6 Kaplanon Street, Kolonaki, Athens 106 80, Greece (tax number (ΑΦΜ) 802233296, GEMI number 172648103000). You can reach us at reservations@cityluxe.gr or on +30 697 323 2263 (09:00–21:00).

2. This website

This website has no forms of its own: when you search for dates, your search goes straight to our booking engine (see Bookings below).

Our website host, Vercel Inc., processes technical connection data such as your IP address to deliver the pages and keep the site secure (legitimate interest, Art. 6(1)(f) GDPR).

Only with your consent, we measure visits with Google Analytics 4, provided by Google Ireland Limited: the pages you view, roughly where you are (country and city), your device and browser, how you reached the site, which buttons you press (for example Book or Call) and the dates and number of guests you search for. It works with a random identifier stored in a cookie and does not tell us who you are. We have switched off Google signals and ad personalisation, and we do not use this data for advertising. The data may be processed outside the EU, including in the United States, and is kept for 14 months.

If you decline, no analytics script is loaded and nothing is sent to Google. You can change your choice at any time with "Cookie settings" in the footer. The legal basis is your consent (Art. 6(1)(a) GDPR). Details are in our Cookie Policy.

3. When you contact us

If you phone or email us, we receive what you tell us, for example your name, your contact details and your question. We use it to answer you and, if you are a guest, to manage your stay (Art. 6(1)(b) and (f) GDPR). Please do not email us photos or copies of ID documents or payment cards.

4. Bookings

When you check availability or book, you are sent to our booking engine, which is run by WebHotelier. The details you enter there (name, contact details, dates, guests and payment details) are processed by the engine provider and by us to confirm and manage your booking (Art. 6(1)(b) GDPR). Your card details are entered in the booking engine, not on this website. The engine has its own privacy notice.

5. Online check-in and your room PIN

Before you arrive we email you a link to check in online. We ask only for what we are required by law to record in the hotel's guest register, such as your name, nationality, date of birth and identity document details. The check-in form is part of our hotel management system, RoomRack. The legal basis is a legal obligation (Art. 6(1)(c) GDPR) and your booking (Art. 6(1)(b)).

Your personal door PIN is created for your stay and sent to you by email. The door system may record when a PIN is used, for the safety of guests and the building. We do not ask you to send photos or copies of ID documents or payment cards by email, chat or phone.

6. During your stay

Cameras in the common areas of the building may record images for the security of guests and property (legitimate interest, Art. 6(1)(f) GDPR).

7. Marketing

We send offers or newsletters only if you have asked for them or given your consent, and you can unsubscribe at any time.

8. Who receives your data

Our staff and the providers that work for us under contract: the booking engine (WebHotelier) and payment provider, our hotel management and online check-in system (RoomRack), our website host (Vercel), our email and messaging tools and our IT support (GEO AI, Bookonme LLC). Public authorities receive data only where the law requires it, for example for the guest register and for tax. We do not sell your data.

9. Transfers outside the EU

Some providers, such as our website host Vercel Inc., are based in or may process data in the United States. Where that happens we rely on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.

10. How long we keep data

We keep personal data only as long as we need it for the purposes above or as the law requires, then delete or anonymise it. Booking, invoice and stay records are kept for the period that Greek accounting and tax law requires.

11. Your rights

You have the right to access, correct or delete your data, to restrict or object to its processing, and to data portability. Where processing is based on your consent, you can withdraw it at any time. You can also complain to the Hellenic Data Protection Authority (dpa.gr). To use your rights, write to reservations@cityluxe.gr; we answer within one month.

12. Changes

We may update this policy. The current version is always on this page.