Privacy Policy
Last updated: July 2026
ORO Bohali Zakynthos ("ORO", "we", "us") respects your privacy and is committed to protecting the personal data we collect about you when you visit our website, make a reservation, contact us, or dine with us. This Privacy Policy explains what data we collect, how we use it, and the rights you have under the EU General Data Protection Regulation (Regulation 2016/679) and Greek Law 4624/2019.
1. Data Controller
The data controller is ORO Bohali Zakynthos, Bohali Hill, 29100 Zakynthos, Greece. For any privacy-related request you can contact us at orozakynthos@gmail.com.
2. What we collect
- Identification and contact data: full name, email address, phone number.
- Reservation data: date, time, party size, table preferences, special requests, dietary information you voluntarily share.
- Communication data: messages you send us via email, contact forms, or social media.
- Technical data: IP address, browser type, device, pages viewed, referring URL, approximate location derived from IP.
- Marketing preferences: your consent (or refusal) to receive newsletters and offers.
3. Why we use your data (legal basis)
- To manage your reservation and provide the requested service (contract performance, GDPR Art. 6(1)(b)).
- To comply with legal obligations, including tax and accounting law (Art. 6(1)(c)).
- To send marketing communications, only where you have given consent (Art. 6(1)(a)).
- To improve our website, secure it against abuse, and conduct analytics on the basis of our legitimate interest (Art. 6(1)(f)).
4. How long we keep your data
Reservation data is retained for up to 24 months after your visit. Accounting records are kept for 10 years as required by Greek tax law. Marketing data is kept until you withdraw your consent. Technical logs are retained for up to 12 months.
5. Sharing of data
We never sell your personal data. We share it only with trusted service providers acting as processors on our behalf — including our reservation platform, email provider, hosting provider and accounting firm — and only where required by law or competent authority.
6. International transfers
Where our processors are located outside the European Economic Area, transfers are protected by Standard Contractual Clauses approved by the European Commission.
7. Your rights
You have the right to access, rectify, erase or port your personal data, as well as to restrict or object to its processing and to withdraw consent at any time. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).
8. Contact
To exercise any of these rights, email orozakynthos@gmail.com. We will respond within 30 days as required by GDPR.