Hostions Privacy Notice

This Privacy Notice explains how Hostions processes personal data in connection with its application, web platform, website, and related services.

This Notice applies to users of the Platform, Hostions customers and partners, and other individuals whose data is lawfully entered into the Platform, such as property owners, partners, personnel, cleaners, guests, or other contacts.

Confirming that you have read this Notice records that the information has been provided to you. It does not constitute general consent to every processing activity involving personal data.

The role of Hostions depends on the specific processing activity.

For data that Hostions processes for its own purposes, such as account administration, Platform security, abuse prevention, legal record keeping, and compliance with its own obligations, Hostions may act as a data controller.

Where a customer or organization uses the Platform to manage personal data relating to third parties for its own purposes, Hostions may process that data on its behalf.

Where required, the respective allocation of roles and obligations may be governed by a separate data processing agreement.

Depending on how the Platform is used, we may process:

• identity, account, and contact details, such as name, email address, telephone number, and profile photo;
• information relating to user participation, authorizations, and assignments;
• information relating to property owners, partners, personnel, cleaners, guests, and other contacts;
• information about properties, listings, reservations, calendars, and tasks;
• instructions, messages, notes, photographs, files, and other content submitted to the Platform;
• tax and financial information, such as tax identification numbers, VAT information, IBAN, beneficiary name, amounts, and payment information, where required for the relevant function;
• technical information necessary for the operation, security, and support of the Platform;
• records relating to notices or acceptance of legal documents.

Data may be obtained directly from you, from an authorized user or customer who enters it into the Platform, or from a service that has been lawfully connected to the Platform.

Personal data may be used for:

• creating and managing accounts;
• authentication and access control;
• organizing properties, reservations, tasks, calendars, and working relationships;
• communication and content sharing between authorized users;
• managing operational and financial activities;
• sending necessary notifications;
• operating services enabled by authorized users;
• securing the Platform and preventing abuse;
• technical support and improving reliability;
• maintaining records and evidence of actions;
• complying with legal, tax, or accounting obligations;
• establishing, exercising, or defending legal claims.

Where Hostions acts as a data controller, processing may, depending on the circumstances, be based on the performance of a contract, compliance with a legal obligation, legitimate interests, or consent where consent is specifically required.

Where Hostions processes personal data on behalf of a customer or organization, the relevant controller is responsible for determining the appropriate legal basis for that processing.

Personal data may be accessible:

• to appropriately authorized users with relevant access;
• to Hostions and persons supporting its operation, only to the extent necessary;
• to providers of hosting, storage, communications, authentication, payment, and other technical services;
• to professional advisers;
• or to competent public, tax, regulatory, or judicial authorities where required by law.

Access within the Platform is determined by the relevant authorizations and assignments. A user is not entitled to access data for which they do not have appropriate authorization.

Access by Hostions for operational purposes is limited to what is necessary for operation, security, technical support, incident investigation, or compliance with a legal obligation.

Hostions does not sell personal data.

Where electronic payments are made, full card details, such as the complete card number and security code, are handled by an external payment provider and are not stored by Hostions.

Personal data is retained only for as long as necessary for the purposes for which it is used and to meet applicable obligations.

When determining retention periods, relevant factors may include:

• the duration of the account or working relationship;
• the need to retain operational or financial history;
• tax, accounting, and other legal obligations;
• security and abuse-prevention requirements;
• and the need to protect legal claims.

Deleting an account does not always result in the immediate deletion of every related record where continued retention is legally necessary.

Records relating to legal documents may be retained as evidence. Where appropriate and permitted, their link to a specific identity may be reduced or pseudonymized.

Hostions applies appropriate technical and organizational measures to protect personal data, taking into account the nature of the data and the relevant risks.

Some service providers may process personal data outside Greece or the European Economic Area.

Where required by applicable law, such transfers are carried out using an appropriate lawful safeguard or transfer mechanism.

Depending on the circumstances and subject to applicable law, you may have the right to:

• access your personal data;
• correct inaccurate or incomplete information;
• request deletion;
• restrict processing;
• receive data in a portable format;
• object to processing;
• withdraw consent where processing is based on consent.

These rights are not absolute and may be restricted where permitted by law or where conflicting legal obligations, third-party rights, or the need to protect legal claims apply.

Where Hostions processes personal data on behalf of another controller, it may cooperate with that controller in handling your request.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority or another competent supervisory authority.

This Notice may be updated when the Platform, processing activities, or applicable legal framework changes.

The current version will be available through the Platform and the official Hostions legal-document page.

Where required, you may be asked to confirm that you have been informed of a new version.

Such confirmation records that the relevant information has been provided and does not convert processing based on another legal basis into consent.

The Greek version is the primary version in the event of a translation discrepancy, to the extent permitted by applicable law.

For questions about this Notice, data protection matters, or the exercise of your rights:

Data controller: Redon Louga, sole proprietor
Address: 99 Mesogeion Avenue, Ampelokipoi, Athens, Greece
Email: info@hostions.com