Privacy policy
Last updated: 2026-05-01
At SCALA boutique hotel and suites (“we”, “our”, or “us”), we respect your privacy and are committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Greek data protection laws.
This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website or make a reservation with us.
2. What Personal Data We Collect
When you make a reservation through our website, we may collect the following personal data:
- Full name
- Email address
- Phone number
- Postal address (optional)
We only collect the information necessary to process and manage your reservation.
3. Purpose and Legal Basis for Processing
We process your personal data for the following purposes:
Reservation Management: To create, confirm, manage, and communicate regarding your booking.
Legal basis: Performance of a contract under Article 6(1)(b) GDPR.
Legal and Tax Obligations: To comply with accounting, tax, and hospitality regulations applicable under Greek law.
Legal basis: Compliance with a legal obligation under Article 6(1)(c) GDPR.
4. Payment Processing
Payments are processed securely through Viva.com (Viva Wallet).
When you proceed to payment, you are redirected to Viva’s secure payment environment. We do not collect, store, or have access to your payment card details or payment credentials.
For more information about how Viva processes personal data, please refer to their privacy policy on their website.
5. Data Retention
We retain customer reservation, invoicing, and related records for a period of seven (7) years, as required by applicable tax, accounting, and legal obligations under Greek law.
Personal data will not be retained longer than necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.
After the applicable retention period expires, personal data is securely deleted or anonymized.
6. Data Sharing
We do not sell, rent, or share your personal data with advertisers or marketing companies.
Your personal data may be accessed by authorized hotel personnel solely for purposes related to:
- Reservation management
- Guest communication
- Check-in and accommodation services
- Issuing invoices and receipts
- Compliance with legal and accounting obligations
Your personal data may also be shared with:
- Payment service providers (such as Viva.com) for payment processing
- Accountants, legal advisors, or public authorities where required by law
- IT or hosting providers strictly for website operation and security purposes
All persons and third parties handling personal data are required to process it securely and in accordance with GDPR requirements.
7. Cookies and Tracking
Our website does not use advertising cookies, profiling tools, or third-party tracking technologies for marketing purposes.
We only use strictly necessary technical cookies required for the proper operation and security of the website, if applicable.
8. Data Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, disclosure, or alteration.
9. Your Rights Under GDPR
Under GDPR, you have the right to:
- Access your personal data
- Correct inaccurate or incomplete data
- Request deletion of your data where legally permitted
- Restrict or object to processing in certain circumstances
- Request data portability
- Lodge a complaint with the Hellenic Data Protection Authority
To exercise your rights, please contact us using the contact details above.