Privacy & cookies policy

We collect as little as possible, only for a clear reason, and we never sell personal data. This page explains what we keep, why, for how long and how to exercise your rights under the General Data Protection Regulation (EU) 2016/679 (GDPR).

1. Who is responsible

The controller of the personal data described here is:

2. What we collect and why

Browsing the site

When you visit mynafplio.com, our hosting provider's servers process technical data (IP address, browser, pages requested, time) in order to deliver the pages and protect the site. We also use the IP address briefly to limit abuse (for example repeated form submissions). Legal basis: our legitimate interest in running a secure website (art. 6(1)(f) GDPR).

Statistics (Google Analytics) — only with your consent

If you click «Accept» on the cookie bar, we use Google Analytics 4 to understand, in aggregate, how the site is used (pages visited, device type, approximate location from the IP address). If you decline, Google Analytics is not loaded at all. You can change your choice at any time from the «Cookies» link at the bottom of the home page. Legal basis: consent (art. 6(1)(a)).

Table reservation requests

When you ask for a table through a venue's page, we collect your name, phone, email (optional), date, time and number of people, and forward them to that venue so it can confirm. Legal basis: taking the steps you asked for (art. 6(1)(b)). The venue then handles your booking as its own controller. We delete reservation details six months after the reservation date.

Property guides and extras for your stay

If you are staying at a property that uses myNafplio, you open its guide with the room code. The code and a temporary access key are kept only in your browser. If you request an extra (breakfast, transfer, late check-out etc.), the details you enter (name, email, phone, notes, items and time) go to that property, which decides on your request. For these requests the property is the controller and myNafplio processes the data on its behalf. Your name, email, phone and notes are deleted automatically 30 days after the request; only the items and amounts remain, for the property's records.

Hosts and businesses (accounts and subscriptions)

For property owners and businesses we keep the account details (name, email, phone, business details, listing content) and the subscription status. Payments are handled by Stripe; we never see or store card numbers. Legal basis: performance of the contract (art. 6(1)(b)) and our legal obligations, e.g. tax records (art. 6(1)(c)). We keep account data while the account is active and afterwards only as long as tax law requires.

Contact and interest forms

If you write to us, or fill in the interest forms on the pages for hosts and businesses, we use what you send only to reply and, if you wish, to set up your listing. The forms are delivered to our mailbox through FormSubmit. We keep these messages for up to two years unless they lead to a contract.

3. Who receives the data

We share data only with providers that help us run the service, under data processing agreements, and only what each one needs:

Some of these providers are based in the USA. Transfers outside the EU rely on the EU-US Data Privacy Framework or on the European Commission's Standard Contractual Clauses. We may also disclose data where the law requires it.

4. Cookies and browser storage

We do not use advertising cookies. What the site stores on your device:

5. Your rights

You can ask us at any time to see the data we hold about you, correct it, delete it, restrict its use, receive it in a portable format or object to its use. Where we rely on consent, you can withdraw it at any time without affecting earlier processing. Write to info@mynafplio.com; we reply within one month. For requests about extras at a property, we pass your request to that property and help it reply.

If you believe your data is not being handled lawfully, you can lodge a complaint with the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens, www.dpa.gr.

6. Security

Connections are encrypted (HTTPS), access to data is limited to those who need it, passwords are never stored in readable form, and personal details of extras requests are erased automatically. No system is perfectly secure, but if a breach affecting you happens, we will inform you and the authority as the law requires.

7. Children

The site is not aimed at children under 15 and we do not knowingly collect their data.

8. Changes

If we change this policy we will publish the new version here with a new date. Last updated: 1 November 2026.