Privacy
What this site knows about you
Almost nothing, and none of it leaves the house.
Alkyon is a fictional hotel built as a portfolio piece, so there is no reservation system behind the booking form and nothing you type into it is sent anywhere or stored. This page says plainly what the site does today, and then what a real build of it would do — because a privacy page written after the fact is a privacy page nobody trusts.
There are no analytics, no advertising pixels, no cookie banner and no third-party fonts: the typefaces are served from this domain, so loading a page does not tell anyone else you were here.
Who is responsible
The data controller
Sample details: the business below is fictional, and its numbers, addresses and accounts belong to no one. On a real site this is the hotel's own company.
Alkyon Hotel Enterprises Single-Member P.C.
Firopotamos, 848 00 Milos, Cyclades, Greece
Controller
000000000
VAT no.
info@alkyon.example
For anything on this page, including the requests under your rights below.
Privacy questions
Telephone
What this site does today
The booking steps carry the stay in the address bar: arrival and departure, number of guests and rooms, the room and any extras. That is how a static site passes them from one step to the next, and those addresses reach the server like any other page request. They say nothing about who you are.
Your name, email, telephone, arrival time and notes on the last step never leave your browser. Pressing the button discards them and shows a message saying nothing was sent. The newsletter box in the footer does the same: there is no list.
The site is hosted on Cloudflare Pages. To deliver pages and keep the site safe, Cloudflare handles your IP address, the address you asked for, your browser's user-agent and its language setting (read once, to send you to the Greek or English site, and not stored by us). We do not receive these as a list of visitors and keep no logs of our own. Also, if a page fails to load, your browser may send Cloudflare a short error report (Network Error Logging): the page address, the type of error and your IP address.
Nothing is written to your browser: no cookies, no local storage, no session. The links to Google Maps, Wikimedia Commons, Instagram and Facebook load nothing until you click them; after that, those sites' own policies apply.
On a real build
What a booking would collect, why, and for how long
Holding the room
Name, email, telephone, dates, party size, room, extras and your notes. Needed to hold the room, confirm it, and ring you if the ferry is cancelled. Legal basis: taking steps towards and performing a contract, GDPR Art. 6(1)(b).
Until the stay ends
Invoices and the guest register
What Greek tax law and the police guest register require, and only that. Legal basis: a legal obligation, Art. 6(1)(c).
As long as the law requires
Server and security logs
IP address, requested address, time and browser, kept by the host to stop abuse. Legal basis: legitimate interest in a working, safe site, Art. 6(1)(f).
Days, under the host's policy
Letters from the house
Your email address, only if you ask for the letters; one link in each letter takes you off the list. Legal basis: consent, Art. 6(1)(a), withdrawable at any time.
Until you leave the list
Who else sees it
Cloudflare, Inc. hosts the site and acts as our processor under its data processing agreement. It is a US company, so some processing may happen outside the EU; it is certified under the EU–US Data Privacy Framework and also uses the Commission's standard contractual clauses.
On a real build, booking details would also go to the reservation system the hotel uses and to its accountant for invoices, each under a processing agreement. Nothing is sold, shared with marketing partners or used to build a profile of you.
Your rights, in plain terms
Can I see what you hold about me, or correct it?
Yes: access and rectification, GDPR Articles 15 and 16. Email us and we will reply within a month, at no charge.
Can I have it deleted, or stop you using it?
Yes: erasure, restriction and objection, Articles 17, 18 and 21. Records the tax office requires us to keep are the one exception, and we will tell you exactly which those are.
Can I take it elsewhere?
Yes: portability, Article 20. We send it in a common format (CSV or JSON). We make no automated decisions about you (Article 22).
Do you use cookies?
No. This site sets nothing in your browser — no cookie, no local storage, no counter. That is why there is no banner asking you to accept anything.
Is the site meant for children?
No. Rooms are booked by adults, and we do not knowingly collect anything about anyone under fifteen.
Where can I complain?
To us first, if you like, at the address above. You can always go to the Hellenic Data Protection Authority, www.dpa.gr, Kifissias 1–3, 115 23 Athens.
When did this page last change?
4 October 2026. If it changes, the date here changes with it.