Last updated · 14 October 2026
This policy describes the current arrangements and identifies matters still under review. Publication does not mean that the retention procedure, provider safeguards or cookie-consent checks described below have been verified.

This Privacy Policy explains how MR Group IKE, trading as Villas Katsiki, handles personal information connected with this website and accommodation inquiries.

Who is responsible for your information?

Data controller: MR Group IKE
Trading name: Villas Katsiki
Registered address: Lefkada 0, 31100, Lefkadas, Greece

For privacy questions or requests about your personal information, contact info@villaskatsiki.com. For reservation inquiries, contact reservations@villaskatsiki.com.

Information you give us

When you make an inquiry, we collect your first and last name, email address, international phone number, preferred villa, arrival and departure dates, and number of guests. If you select both villas, we collect the guest count for each villa. You may also provide an optional message or notes.

The required fields help us respond to your request and assess availability. The inquiry form cannot be submitted without them. You do not need to include payment-card details, identity documents, health information or other sensitive information in the message field.

We also receive information you provide in later correspondence about your inquiry or stay.

Why we use this information

Responding to inquiries and arranging accommodation. We use your information to communicate availability and pricing, answer your questions and take steps at your request towards a reservation. Where a reservation is agreed, we use relevant information to arrange and provide the stay. The legal basis is taking steps before entering into a contract and performing that contract, under Article 6(1)(b) GDPR.
Legal requirements. Information relating to confirmed reservations may need to be kept or disclosed to meet applicable accounting, tax or other legal obligations, under Article 6(1)(c) GDPR. The applicable records and retention periods must be confirmed with the company’s accountant or legal adviser.
Website security and operation. Technical information, such as IP addresses, request details and security events, may be processed by the hosting and security services to operate the website, detect misuse and protect it. This serves our legitimate interests in maintaining a secure and reliable service, under Article 6(1)(f) GDPR.
Optional analytics and similar technologies. Non-essential cookies and similar tracking require consent. The cookie controls and services are described below; the current consent verification is not yet complete.

MR Group IKE does not use guest inquiry information for marketing, newsletters or promotional mailing lists. Inquiries are handled by our team. The form’s validation checks do not confirm or refuse a booking automatically.

How inquiries are handled and who receives them

The website processes inquiries through WPForms. A website database component records the submitted details, and an inquiry notification is delivered through Brevo to our reservations mailbox. Incoming email for villaskatsiki.com is routed through Hostinger. Website database backups are made through UpdraftPlus to Google Drive.

The company uses these services for website hosting, inquiry processing, email delivery, mailbox services and backup storage. Authorised company personnel use inquiry information to respond and arrange stays. MR Group IKE has confirmed that no separate booking CRM or customer-management system receives these inquiries.

Website visitors may also interact with Google Analytics, Google Maps, website translation services and CookieYes as described below. These services have different purposes from processing a reservation inquiry. A locally installed WordPress plugin does not by itself mean that its developer receives every form submission.

Verification pending: mailbox forwarding and access arrangements, provider log retention, and the relevant provider contracts and processing locations still need confirmation. No claim is made here that all information stays within Greece or the European Economic Area.

Cookies and third-party website services

CookieYes provides the website’s cookie banner, with options to accept, reject or customise optional cookies. The ability to reopen preferences and the effective blocking of optional analytics are still under review. Consent improvements prepared on the staging site have not been deployed to this website. Essential technologies may remain active where they are needed to provide a requested function or remember the choice.

CookieYes: records cookie preferences. The current CookieYes configuration uses cookieyes-consent to remember preferences, with a configured duration of 365 days.
Google Analytics: measures website usage. The existing production inventory lists _ga and _ga_* in the Analytics category. This inventory is based on the September 2024 scan and is not current; actual cookies and browser expiry remain to be verified.
WordPress: the historical production inventory from September 2024 identifies wpEmojiSettingsSupports, used for emoji-display support, in the necessary category. That scan is not a current inventory.
Google Maps: the Contact page embeds a map. When the map loads, the browser connects to Google, which receives technical request information such as the IP address and browser details.
Translation: the language selector uses GTranslate/Google translation services when a translation is requested.

For information about Google’s handling of data, see Google’s Privacy Policy. CookieYes publishes its own Privacy Policy.

Verification pending: the complete cookie inventory, actual durations, third-party consent categories and effective blocking of optional analytics still require verification. Anonymous browser cookie and network verification is incomplete. No fresh CookieYes scan has been completed, and the September 2024 scan must not be treated as current. This website continues to use its existing CookieYes cloud configuration; the consent corrections prepared on staging are not live.

How long information is kept

Proposed rule for unsuccessful booking inquiries: MR Group IKE has provisionally approved retention for 12 months after the last substantive communication. This period applies to an inquiry that does not become a reservation, subject to any specific legal requirement or justified dispute-related hold.

Implementation is still pending. The current website recorder stores the submission date, not the date of the last email conversation. A coordinated review of website records, received and sent email, archives and any exports is therefore needed before this rule can be described as operating. No automatic deletion has been implemented under this proposed rule.

Confirmed reservations may require longer retention under applicable Greek accounting, tax and other legal obligations. The specific periods and any exceptions require confirmation; no specific statutory retention period has yet been confirmed.

The verified backup settings retain 14 scheduled daily database backups and four scheduled weekly file backups. These are backup counts, not guaranteed expiry periods measured in days. Missed runs, manually retained checkpoints and separate downloaded recovery archives can persist longer. The treatment of these exceptions and the process for reapplying deletions after a restoration remain to be agreed.

International processing

Some of the service providers used by the website may process information outside the European Economic Area. Where a restricted transfer occurs, the GDPR requires an applicable transfer mechanism and safeguards. The account-specific processing locations, transfer arrangements and means of obtaining a copy of the relevant safeguards remain to be confirmed. This policy does not assert that a particular safeguard has already been adopted by MR Group IKE.

Your privacy rights

Depending on the circumstances and legal basis, you can request access to your personal information, correction of inaccurate information, erasure, restriction of processing, or portability of information you provided. You can object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent without affecting the lawfulness of processing before withdrawal.

Contact info@villaskatsiki.com to exercise these rights. We may need reasonable information to verify your identity. The GDPR normally requires a response within one month; where a permitted extension is necessary, you must be informed within that first month. Rights are subject to the conditions and exceptions in the GDPR.

You may also lodge a complaint with the Hellenic Data Protection Authority, or the competent supervisory authority in the place where you live or work or where an alleged infringement took place.

Review and updates

The controller details and inquiry purposes above are owner-confirmed. Retention implementation, provider safeguards and complete cookie information remain under review. The footer-only placement of this policy is pending review by a qualified Greek GDPR/privacy lawyer and is not described as legally approved. This policy will be updated when the outstanding matters are resolved.