Privacy and Cookie Policy

1. Hotel details and scope

This policy concerns Lazareto Hotel in Monemvasia, Greece, and the processing described below. For information about your personal data or to exercise your rights, please contact the hotel:

Hotel: Lazareto Hotel.

Address: 230 70 Monemvasia, Laconia, Greece.

Email for hotel enquiries and privacy requests: info@lazareto.gr.

Reservations and Reception Department: +30 27320 61991.

Opening Hours: 08:00 - 20:00.

Time zone: Greece — Europe/Athens (UTC+02:00 in winter / UTC+03:00 in summer).

Emergency Number: 6986757511.

This notice covers our public website and related enquiries. Where you follow a link to an external service, its own privacy information also applies. It is not a description of every operational record that may be held in connection with a hotel stay.

2. Principles and lawful processing

Personal data means information relating to an identified or identifiable person. Processing includes collecting, using, storing, sharing and deleting that information.

Data protection principles require processing to be lawful, fair and transparent; limited to specified purposes and the data necessary for those purposes; accurate; retained no longer than necessary; and appropriately protected. Please let us know if information you have provided needs correcting.

Different activities have different legal bases. Browsing this website does not amount to consent to all processing, and accepting optional cookies is not a condition of contacting the hotel or using booking links.

3. Personal data and how it is collected

Enquiries and communications: when you contact reception by telephone or email, we receive the information you provide, which may include your name, contact details, travel dates, party size, room preferences and the content of your request.

Booking search: the website lets you select dates, adults, children or infants, and a room category. These selections are kept in session storage in your browser tab so that they remain available as you move between pages. The search does not ask you to enter a name, email address or payment-card details.

Technical information: hosting infrastructure receives information needed to deliver and protect the website, such as your IP address, requested page, time of request and browser or device information supplied with the request. This information may be personal data even when it does not identify you by name.

Please provide only information needed for your enquiry. Do not send payment-card details or unnecessary sensitive information by ordinary email. If you contact us on behalf of other guests, make sure you are entitled to share their details and make this policy available to them.

4. Reservations and the external booking engine

Reserve and room Book buttons open the hotel's official WebHotelier booking engine in a new tab. Where known, the selected dates, guest counts, room code and language are passed to that service so you do not need to enter them again.

Rates, availability and completion of a reservation are handled in that external booking environment, not by the public website's search form. Information requested there, including guest and any payment information, is subject to the notices displayed by the booking service and the arrangements relevant to your reservation.

If you contact the hotel about a booking, we may use the reservation information you provide to identify the request and assist you. Do not assume that this public website receives or stores payment-card data entered on the external service.

5. Purposes and legal bases

Enquiries and reservation assistance: to answer questions, provide information about accommodation and take steps at your request before entering into a contract, or to assist with an existing reservation (GDPR Article 6(1)(b)).

Website operation and security: to serve pages, diagnose technical failures and help prevent misuse (our legitimate interest in providing a functioning and secure website, Article 6(1)(f)). The interests and rights of affected individuals must also be considered.

Legal obligations and claims: where applicable, to comply with a legal obligation (Article 6(1)(c)) or establish, exercise or defend legal claims on the appropriate legal basis, including legitimate interests where relevant.

Optional embedded services: to load interactive maps or the optional booking widget only after your consent (Article 6(1)(a) and applicable rules on cookies and similar technologies). You can withdraw that consent without affecting the lawfulness of earlier processing.

No newsletter sign-up, advertising tracker or analytics tool is currently installed on this public website. We do not treat a hotel enquiry or cookie acceptance as permission to send marketing.

6. Recipients and external services

Information may be handled by hotel personnel involved in responding to your request and by service providers supporting website hosting and email. Their role and obligations depend on the service and processing involved.

WebHotelier provides the external booking environment. OpenStreetMap provides optional map content. Deliberately opening links to Google Maps, TripAdvisor or other websites takes you to services governed by their own privacy and cookie notices.

Information may also need to be disclosed to competent authorities, professional advisers or other recipients where there is a lawful requirement or a need to establish or defend a legal claim. This does not authorize unrestricted disclosure.

Contact info@lazareto.gr for information about the recipients relevant to your particular enquiry or reservation.

7. International transfers

Some external services or providers may process information outside the European Economic Area. A transfer must meet the applicable GDPR requirements, which may include an adequacy decision or appropriate safeguards such as standard contractual clauses.

You can contact info@lazareto.gr to request information about the processing locations, transfer arrangements and safeguards relevant to your data. This policy does not imply that every external provider stores data exclusively in Greece or the European Union.

8. Retention of personal data

Enquiry records are kept for the time needed to respond and manage the matter, taking account of any resulting reservation, applicable obligations and the periods needed to establish or defend legal claims. The relevant period depends on the nature of the record and the purpose.

Technical records are subject to the hosting service's arrangements and the operational or security purpose for which they are retained. Ask the hotel for information about the retention applicable to a particular record.

Booking-search selections are held in session storage for the browser-tab session; browser session-restoration features may preserve them when a session is restored. You can remove them using your browser's site-data controls.

The website remembers acceptance or rejection of optional services for approximately six months. On a later visit after expiry, or if you clear that storage, it asks for your choice again. The booking service and other external websites have their own retention arrangements.

9. Data security

Protecting personal information requires technical and organisational measures appropriate to the nature of the data and the risks involved. The website uses HTTPS to protect information in transit between your browser and the website. No internet transmission or storage system can be guaranteed completely secure.

Please avoid including unnecessary personal or sensitive information in messages. If you believe that your information has been exposed or misused in connection with our website or an enquiry, contact info@lazareto.gr promptly.

Where a personal-data breach triggers a legal obligation to notify an authority or affected individuals, the GDPR requirements apply. This notice does not replace those obligations.

10. Cookies and similar browser storage

Strictly necessary storage: lz_booking uses session storage to remember the booking search you request in the same browser tab. lz_cookie_consent uses local storage to record your optional-service choices, their version and expiry for approximately six months. These functions do not require optional-cookie consent.

Interactive maps: OpenStreetMap content on the contact and sightseeing pages is blocked until you allow maps. Loading it shares your IP address and browser request information with the provider. You can choose maps independently of the booking widget.

External booking widget: this optional embedded WebHotelier search is currently switched off. If enabled, it is blocked until you allow it. The provider may then use its own cookies or similar technologies under its notice. Ordinary Reserve and Book links work without this permission.

Fonts are hosted locally. No analytics or advertising tools are currently installed. We do not enable optional categories simply because you continue browsing.

11. Managing and withdrawing cookie choices

The banner offers Accept all, Reject optional and Customize. Optional choices start off, and you may continue using the website without accepting them. You can reopen Cookie preferences from the footer to save a different choice or withdraw permission.

Withdrawing a choice stops the relevant embedded content from loading on this website. It does not undo earlier processing or remove cookies or records already held by another service. Browser settings and the provider's own privacy controls may be needed to remove those.

Your browser may block local storage or delete it automatically. In that case the website may be unable to remember your decision and may ask again; optional content remains blocked until permitted.

12. Your data protection rights

Subject to the conditions and exceptions in the GDPR, you may request information about processing, access to your data and a copy, correction of inaccurate or incomplete data, erasure, restriction, and portability where the legal requirements are met.

You may object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time without affecting processing that was lawful before withdrawal. These rights do not always require deletion of records that must lawfully be retained.

This public website does not use personal data to make solely automated decisions producing legal or similarly significant effects, and it does not currently run advertising profiling.

13. Requests and complaints

Send requests to info@lazareto.gr, or contact the Reservations and Reception Department at +30 27320 61991 or the hotel address above. Describe the request and the relevant interaction so that we can locate the information. Only information proportionate to verifying your identity should be requested where verification is necessary.

Under the GDPR, a response is generally due within one month of receiving a request. For complex or numerous requests the period may be extended by up to two further months; you must be told within the first month about the extension and the reasons. Requests are normally free, subject to the GDPR rules on manifestly unfounded or excessive requests.

You may lodge a complaint with the Hellenic Data Protection Authority at https://www.dpa.gr/en, or with another competent supervisory authority. You do not have to give up that right by contacting the hotel first.

14. Changes to this policy

We may revise this policy to reflect changes to the website, our practices or legal requirements. The date above identifies the current version. Material changes to optional processing may require a new consent choice.

An updated policy provides information; continued use of the website is not, by itself, consent to new optional processing.