Privacy Notice
Villa Lithos Porto Rafti · Effective 22 September 2026In short: this website collects personal data only when you send us an inquiry, and sets analytics and marketing cookies only if you accept them. We do not sell personal data. Bookings are made through booking platforms that have their own privacy terms. You can contact us at any time at info@villalithos.com.
1. Who is responsible
This website, villalithosgreece.com, and Villa Lithos Porto Rafti (Vravronos 70, Porto Rafti 19003, Attica, Greece) are operated by Goldenberg Luxe, the property management company ("we", "us"). Goldenberg Luxe is responsible for the personal data described in this notice: it handles inquiries, proposals, guest communication, check-in, housekeeping and concierge services.
For any question or request about your personal data, write to info@villalithos.com.
2. What we collect, why, and on what legal basis
2.1 Inquiry form
When you use the inquiry form we collect the details you enter: your name, email address, phone number (optional), your message (which may include travel dates, group size and other details you choose to share), together with the page you sent it from and the time of sending. The form is delivered to our team by email through our email service provider.
Purpose: to answer your inquiry, check availability and prepare a proposal or a booking. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and, for follow-up about your inquiry, our legitimate interest in responding to people who contacted us (Article 6(1)(f) GDPR).
Retention: inquiry emails that do not lead to a booking are kept for 24 months from the last contact, then deleted. If you book, the booking records are kept for as long as Greek tax and accounting law requires.
2.2 Bookings
Bookings are made through Guesty (our direct booking system), Booking.com or Airbnb. When you book on one of these platforms, that platform is responsible for the data you provide to it under its own privacy policy, and shares with us the booking details we need to host you (names, contact details, dates, party size, and any special requests). Greek law also requires accommodation providers to record guest identity details and to report certain data to the authorities; we process those details to meet these legal obligations (Article 6(1)(c) GDPR).
2.3 Analytics and marketing cookies (only with your consent)
With your consent we use Google Analytics 4 to understand how visitors use the site (pages viewed, approximate location derived from a truncated IP address, device and browser type, how you arrived), the Meta Pixel to measure whether visitors who saw our Instagram or Facebook content later visited the site, and Google Ads measurement tags. All of these are loaded through Google Tag Manager, which we start only after you click "Accept all" in the cookie banner. If you choose "Essential only", Google Tag Manager and the Meta Pixel are not loaded at all, and Google's measurement runs without cookies or identifiers. Legal basis: your consent (Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive as implemented in Greece by Law 3471/2006). You can withdraw consent at any time through "Cookie settings" in the footer.
2.4 Embedded Google Maps
The location section embeds a map from Google Maps. When the map loads, your browser connects to Google, which may set its own cookies and receives your IP address. Google's use of this data is described in the Google Privacy Policy.
2.5 Technical data and security
Our hosting provider records standard server logs (IP address, time, requested page, browser) to run the site securely and to prevent abuse. Legal basis: our legitimate interest in keeping the site available and secure (Article 6(1)(f) GDPR). Logs are kept for a short period by the hosting provider and are not used to profile visitors.
3. Who receives your data
- Our email service provider: delivery of inquiry form messages to our mailbox.
- Vercel Inc. (hosting, USA): serves the website and keeps server logs.
- Google (Google Ireland Ltd and Google LLC, USA): analytics with your consent, embedded maps.
- Meta Platforms Ireland Ltd: Meta Pixel measurement, only with your consent.
- Booking platforms (Guesty, Booking.com, Airbnb): only if you book through them, under their own terms.
- Public authorities where Greek law requires it (for example guest registration and tax reporting).
We do not sell personal data and do not share it with advertisers.
4. Transfers outside the EEA
Some of the providers above process data in the United States. Where this happens we rely on the EU-US Data Privacy Framework for providers certified under it and otherwise on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for details of the safeguards in place.
5. Your rights
Under the GDPR you may ask us to access the personal data we hold about you, to correct it, to delete it, to restrict its use, to receive it in a portable format, and you may object to processing based on our legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting what was done before. To exercise any right, email info@villalithos.com. We reply within one month.
You also have the right to complain to a supervisory authority. In Greece this is the Hellenic Data Protection Authority, Kifissias 1-3, 115 23 Athens, www.dpa.gr. You may instead contact the authority of the EU country where you live or work.
6. Cookies
The table lists the cookies this site can set. Analytics cookies are set only after you accept them.
| Cookie | Set by | Purpose | Duration | Category |
|---|---|---|---|---|
| vl_consent | This site | Remembers your cookie choice so the banner does not reappear | 12 months | Essential |
| _ga | Google Analytics | Distinguishes visitors | 2 years | Analytics (consent) |
| _ga_* | Google Analytics | Keeps session state (one cookie per GA4 property) | 2 years | Analytics (consent) |
| _fbp | Meta Pixel | Distinguishes visitors for Meta ad measurement | 3 months | Marketing (consent) |
| _gcl_au | Google Ads | Conversion linker used by Google Ads measurement | 3 months | Marketing (consent) |
| test_cookie | Google (doubleclick.net) | Checks whether the browser accepts cookies | 15 minutes | Marketing (consent) |
| Google Maps cookies | Set by the embedded map according to Google's policy | Varies | Third party |
To change your choice, use "Cookie settings" in the footer of any page, or delete cookies in your browser settings.
7. Children
This website is intended for adults planning a stay. We do not knowingly collect personal data from children through the site. Details of children in a travelling party are collected only as part of a booking, from the adult making it.
8. Changes
We update this notice when our practices or the law change. The effective date at the top tells you when it was last revised. Material changes will be announced on this page.
See also our Website Terms of Use.