Privacy policy.

This policy explains how we handle the personal data of guests and of anyone who contacts us, when you use corfuseaview.com, send us a message or book directly. It gives the information required by Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (GDPR).

1Who is responsible for your data

Mario Baratta and Anna Zanella let the apartment jointly as private individuals and are the controllers of your personal data. Alberto answers enquiries and manages bookings on their behalf. For any question about your data, write to the email address above. We have not appointed a data protection officer, as the law does not require one for a letting of this size.

2What we collect, why, and for how long

We collect only what you give us and what is needed to run the letting.

Enquiries — the contact form, email, WhatsApp or phone

• Data: your name, email address, message and, if you give them, your dates and number of guests. The contact form sends your message to us by email through our booking service (Cloudflare and Resend, see section 3); if that service is unavailable, the form opens your own email app instead.
• Purpose: to answer you and, if you ask, prepare a quote.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); for general questions not about a stay, our legitimate interest in answering messages sent to us (Art. 6(1)(f)).
• Kept for: deleted within 12 months of our last exchange if no booking follows.

Direct bookings

• Data: name, email address, phone number, dates, number of guests, whether you travel with a pet, the amount paid and Stripe's payment reference. Your card details are entered on Stripe's checkout page and never reach us.
• Purpose: to take and confirm your booking, block the dates, arrange your arrival and look after you during your stay.
• Legal basis: performance of our contract with you (Art. 6(1)(b)).
• Kept for: the entry that blocks your dates in our booking system is deleted automatically 30 days after check-out. Your booking record and our correspondence about it are kept for five years after the end of the year of your stay, so that any question or claim about the stay can be dealt with, and are then deleted.

Legal and tax obligations

• Data: booking and payment records and receipts — including the separate receipt for the Climate Crisis Resilience Fee (ΤΑΚΚ) — and the details of each stay that Greek law requires us to declare to the Greek tax authority (AADE).
• Purpose: to meet our obligations under Greek tax law and under Article 111 of Law 4446/2016 on short-term rentals.
• Legal basis: compliance with a legal obligation (Art. 6(1)(c)).
• Kept for: five years from the end of the year in which the related tax return is due — the period in which the Greek tax authority can audit it (Tax Procedure Code, Law 4987/2022) — or longer if an audit or dispute is still open, or if the tax law of our country of residence requires it.

Security and fraud prevention

• Data: your IP address, device and browser details and payment information, as processed by Stripe and Cloudflare.
• Purpose: to protect the website and the booking system from abuse, and card payments from fraud.
• Legal basis: our legitimate interest in a secure website and secure payments (Art. 6(1)(f)).
• Kept for: only as long as those providers keep their security logs. We keep no logs of our own.

Visiting the website. We use no analytics, advertising or tracking of any kind. To deliver the pages, Cloudflare necessarily processes your IP address and technical request data (legitimate interest, Art. 6(1)(f)). Our fonts and map software are stored on this website itself, so loading a page sends nothing to Google or to any other font or code library. Only the map on the Location page loads map images from CARTO, which therefore sees your IP address when the map is displayed.

3Who receives your data

• Stripe (Stripe Payments Europe, Ltd., Ireland) — processes card payments. Stripe is also an independent controller for its own legal duties, such as anti-money-laundering and fraud checks. See Stripe's privacy policy.
• Cloudflare, Inc. — hosts the website and runs our booking functions, including the calendar of booked dates (processor).
• Resend, Inc. — sends booking confirmations and passes contact-form messages on to us (processor).
• Apple (iCloud Mail) — the mailbox we use for email correspondence (processor).
• WhatsApp (WhatsApp Ireland Ltd.) — only if you choose to message us there, under its own terms and privacy policy.
• CARTO — map images on the Location page (receives your IP address only).
• The Greek tax authority (AADE), and a tax adviser where we use one — the records and declarations the law requires.

Airbnb and Booking.com receive only the dates of a direct booking, so they can block them in their calendars — never your name or contact details. We never sell your data and never use it for marketing.

4Transfers outside the European Economic Area

Stripe, Cloudflare and Resend may process data in the United States. Each is certified under the EU–US Data Privacy Framework, which the European Commission recognised as providing adequate protection on 10 July 2023, and each also relies on the Commission's Standard Contractual Clauses. Apple and CARTO may also use servers outside the EEA, under Standard Contractual Clauses. You can ask us for details of these safeguards.

5Cookies and browser storage

This website sets no cookies and stores nothing in your browser — no analytics, no advertising, no tracking. We checked this on the live site in September 2026. That is why there is no cookie banner: none is needed.

Stripe's checkout page, which is on Stripe's own website, uses cookies that are necessary for the payment and for fraud prevention, as described in Stripe's cookie policy. If we ever add a non-essential cookie to this website, we will ask for your consent first.

6Do you have to give us your data?

Sending an enquiry is voluntary, but we need an email address or phone number to reply. To book, we need your name, email address and payment: without them we cannot conclude or perform the contract. Some details of the stay are then required by Greek law, as explained in section 2.

7Automated decisions

We make no decisions about you by automated means and do no profiling. Stripe screens card payments for fraud automatically, which can occasionally lead to a payment being declined; if that happens, contact us and we will look at it personally.

8Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectification of data that is inaccurate or incomplete;
• erasure of your data;
• restriction of processing, for example while a disputed point is checked;
• object to processing based on our legitimate interests;
• portability — to receive the data you gave us for the contract in a common machine-readable format, or have it sent to someone else.

Write to us at albertoalexandre06@icloud.com. We reply free of charge within one month and may first ask you to confirm your identity. Records we must keep by law cannot be erased until their retention period ends.

9Complaints

If you think we have handled your data wrongly, please tell us first so we can put it right. You also have the right to lodge a complaint with a data protection supervisory authority — in Greece, where the apartment is:

You may instead complain to the supervisory authority of the EU country where you live or work.

Version 2.0 · Last updated September 2026.