Privacy Policy
Last Updated: November 2026
Welcome to Aura Otto Luxury Living. We are fully committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, process, and protect your personal data when you visit our website auraotto.com, make a direct booking, fill out our contact form, or submit an availability inquiry (Request Booking Form).
Our processing operations are carried out in strict compliance with the General Data Protection Regulation (EU 2016/679 - GDPR) and the applicable Greek data protection legislation.
1. Data Controller & Contact Details
- Data Controller: Aura Otto Luxury Living
- Registered Office / Address: Paralia Mesimvrias, Paralia Dikellon, 681 00, Greece
- VAT Number: 139435167
- Tax Authority: Alexandroupolis
- Contact Telephone: +30 690 611 8567
- Email: info@auraotto.com
2. What Personal Data We Collect
We collect and process different types of personal data depending on how you interact with us:
- Booking, Inquiry & Pre-Check-in Data: When you make a booking (via VikBooking), submit an inquiry, or complete our online pre-check-in process prior to your arrival, we collect your full name, email address, contact telephone number, check-in/check-out dates, and billing information. Additionally, via online pre-check-in or upon arrival at the property, we collect identification data (ID card or passport details) as mandated by Greek law for guest registration.
- Technical & Operational Data: Technical information such as server logs, IP address, and browser type may be recorded automatically for web security, system maintenance, and operational integrity.
- Minors' / Children's Data: We accommodate families with minors. We collect personal data of children (such as full name, age/date of birth, and identification details where required by registration laws) exclusively provided by their parents or legal guardians during the booking or pre-check-in process for lawful accommodation and security purposes.
2A. Local Fonts & Cookies
- Local Google Fonts: To respect visitor privacy, all fonts used on this website are hosted locally on our own servers. Browsing our site does not transmit your IP address or personal data to Google or any third-party font network.
- Cookies & Analytics: Our website uses strictly technical and necessary cookies only (such as session management and language preferences). We do not use third-party tracking cookies (e.g., Google Analytics). Website usage statistics are monitored locally using a privacy-friendly, cookieless server analytics tool (WP Statistics) that stores no personal data. For a detailed list of cookies, please refer to our Cookies Policy.
3. Purposes and Legal Bases for Processing
We process your personal data under the following legal foundations:
- Performance of a Contract (GDPR Art. 6(1)(b)): To process, manage, and complete your accommodation booking or respond to your availability requests, and to validate booking dates and transaction payments. Providing this information is mandatory to fulfill your booking.
- Legitimate Interests (GDPR Art. 6(1)(f)): To optimize web security, system integrity, and overall user experience. Furthermore, for the safety and security of our guests, staff, and property, selected common and external areas of the property are monitored by a closed-circuit television (CCTV) system. Cameras are strictly excluded from guest accommodations or private areas. CCTV recordings are retained for a limited period unless required for an incident investigation.
- Compliance with a Legal Obligation (GDPR Art. 6(1)(c)): To comply with Greek and European legal, tax, police, and financial regulations governing the hospitality industry (including maintaining an official guest registry and issuing tax receipts).
- Consent (GDPR Art. 6(1)(a)): To send you direct communication or newsletters, but strictly if you have provided explicit opt-in consent. You may withdraw consent at any time.
4. Sharing and Disclosure of Personal Data
We do not sell, rent, or trade your personal data. We only share data with trusted partners strictly under the following conditions:
- Authorized Processors: Includes web hosting providers, reservation system providers (VikBooking), technical support, and IT infrastructure operators acting strictly under our instructions and confidentiality obligations.
- Payment Processing (Stripe): Online credit/debit card payments are securely processed via our partner payment gateway, Stripe, acting as an independent data controller. Aura Otto Luxury Living does not store or process credit/debit card numbers directly on its servers. You can review Stripe's Privacy Policy on its official website (stripe.com).
- Legal & Law Enforcement Authorities: When mandated by law, we will disclose personal data to competent tax, police, or judicial authorities.
- International Transfers: Where personal data is processed or transferred outside the European Economic Area (EEA) via global technical providers (such as Stripe), we ensure that appropriate safeguards (such as Standard Contractual Clauses - SCCs) are in place to guarantee that your data remains fully protected under GDPR standards.
5. Data Retention Period
We retain personal data only for as long as necessary to fulfill the operational purposes for which it was collected and to comply with legal obligations:
- Booking and Tax Records: Retained for up to ten (10) years in accordance with Greek tax legislation.
- Contact & General Inquiries: Retained for up to twenty-four (24) months following the last communication.
- CCTV Recordings: Generally retained for up to fifteen (15) days, after which they are automatically overwritten, unless required for an incident investigation.
- Technical Server Logs: Retained only as long as necessary for web security and diagnostic performance.
- Pre-Check-In Identification Documents (ID/Passports): Securely deleted or purged within thirty (30) days following your check-out date, unless longer retention is required by law or an active dispute.
Upon expiration of the applicable retention period, personal data is securely deleted or anonymized.
6. Your Rights Under the GDPR
As a data subject under the GDPR, you possess the following rights:
- Right of Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete data.
- Right to Erasure ("Right to be Forgotten"): Request deletion of your data, subject to statutory tax or legal retention duties.
- Right to Restrict Processing: Request restriction of processing under specific legal conditions.
- Right to Data Portability: Request your data in a structured, commonly used format.
- Right to Object: Object to data processing based on our legitimate interests.
- Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
To exercise any of your rights, please contact us at info@auraotto.com. We will respond free of charge within one (1) month.
- Right to Lodge a Complaint: You have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) via their official portal: www.dpa.gr
7. Data Security
We implement strict technical and organizational security measures (including SSL/TLS encryption protocols, firewalls, and server access controls) to protect your personal data against unauthorized access, loss, alteration, or disclosure.
8. Changes to This Privacy Policy
We reserve the right to amend this Privacy Policy from time to time in response to legal or technical updates. Any modifications will be published on this page with an updated revision date.
9. Contact Information
For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:
Aura Otto Luxury Living
Paralia Mesimvrias, Paralia Dikellon, 681 00, Greece
Email: info@auraotto.com
Telephone: +30 690 611 8567
