Who operates Lithos
Lithos by Spyros & Flora is operated by MARIOS SPYRIDONA XYDAKIS, a sole trader established at Agios Ioannis, Mykonos, 84600, Greece. This business is the controller of personal data it receives through enquiries and reservation-related communication.
For questions about your personal data, contact info@lithos-mykonos.com or call +30 22890 78989.
Enquiries and communication
When you contact us, we receive the details you choose to send, such as your name, email address, requested dates and message. We use them to answer you, discuss availability and handle your requested stay. The legal basis is taking steps at your request before a contract, or performing a contract (Article 6(1)(b) GDPR). General correspondence and handling complaints may also rely on our legitimate interest in managing our business and responding to you (Article 6(1)(f)).
The contact form prepares a draft in your email application. Completing it does not submit information to a separate form database; the email is sent only when you send it. Your email provider also processes the message under its own terms. Please do not include payment-card details, identity documents or sensitive health information in the form. Contact us first if a request involves sensitive information.
Reservations and external services
The booking links lead to our external WebHotelier booking engine. Before booking, please read its booking privacy notice and the terms displayed there. The hotel uses the reservation details it receives to arrange and deliver your stay, communicate with you and meet applicable legal and accounting obligations (Articles 6(1)(b) and 6(1)(c) GDPR). This website does not itself collect or store payment-card details.
Google Maps directions and social-media links open external websites when you follow them. On our Location page, an embedded Google map loads only after you select “Load Google map”. Loading it connects your browser to Google, which receives technical data such as your IP address and processes data under its own privacy and cookie policies. No social-media feed is embedded.
Website operation and traffic information
This website is hosted through OpenAI Sites with Cloudflare infrastructure. Serving and protecting the website involves technical request data, such as IP addresses, browser information, requested pages and timestamps. The hosting platform also provides aggregate page-view and unique-visitor counts. These platform statistics are distinct from Google Analytics; we have not installed Google Analytics, advertising pixels or a remarketing tool on this version.
For the hotel, delivering a reliable website and preventing misuse serve our legitimate interests (Article 6(1)(f) GDPR). The cookies policy explains the security cookie and language preference. The hosting providers also describe their processing in the OpenAI privacy policy and Cloudflare privacy policy.
Recipients and international processing
Website enquiries are handled by Marios Xydakis personally. Access by email and hosting providers is limited to what is needed to deliver and protect their services. If an enquiry becomes a reservation, the relevant details may also be handled by people and service providers involved in arranging and delivering your stay. Relevant records may be disclosed to professional advisers or competent authorities where required by law. An enquiry does not subscribe you to a marketing mailing list.
Some technology providers operate internationally and processing may take place outside the European Economic Area. Their linked policies describe their international-transfer arrangements. You may contact us for information about the providers involved in your request and the applicable transfer safeguards.
Retention and security
For ordinary website enquiries that do not result in a reservation, we apply a retention period of 12 months after the last substantive communication, after which the correspondence is deleted. This period may be extended where a continuing matter, dispute, legal claim or legal obligation requires retention. If an enquiry becomes a reservation, the relevant records are retained according to the applicable booking, legal and accounting purposes rather than this 12-month enquiry rule. Hosting providers apply separate retention arrangements for technical data; this website does not control those periods.
We use access controls and appropriate organisational and technical measures to protect the information we handle. No internet transmission can be guaranteed entirely risk-free.
Your rights
Subject to the conditions of the GDPR, you may request access, correction, deletion, restriction or portability of your personal data and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. We may need to verify your identity before responding. We normally respond within one month; where a lawful extension is necessary, we will explain it.
For questions about your personal data, contact info@lithos-mykonos.com or call +30 22890 78989.
You may lodge a complaint with the Hellenic Data Protection Authority or another competent supervisory authority.
Updates
We will update this notice when the website or its processing changes. Any future optional analytics or marketing tools will require an updated notice and the appropriate consent controls before activation.