Privacy policy

Who controls your data

The controller of the personal data described in this policy is Hotelday — legal entity details will be added before launch.

What we collect

• Booking contact details, such as your name, email address and phone number. For a booking you pay for at the hotel, a phone number is required, so we can reach you about your request.
• Payment details when you pay online, handled by our payment provider — Hotelday never stores your full card number. When you pay at the hotel, we take no payment details at all.
• When you send a booking request, a scrambled (hashed) version of your IP address, made with a secret key. We don’t store the address itself. We use it to stop one connection sending too many requests, and to look into misuse.
• Messages you send us through a form on the site.
• Contact details for the hotel partners we work with.
• Sender and recipient details for gift cards.
• If your party includes children, how many — not their individual names or ages.
• Where a booking came from: the Hotelday page you started the booking from, the website that sent you to us (its domain only), and any campaign tag in the link you followed. We record this with the booking to see which pages and links lead to bookings, and we keep it for as long as we keep the booking itself. It sets no cookie and stores nothing in your browser, but the values travel in the address of the checkout page, so they can also appear in your browser history, in our hosting provider’s request logs, in the return link our payment provider receives when you pay online and, if you accepted analytics cookies, in the page address Google Analytics and Microsoft Clarity receive.

If you’re the recipient of a gift card, we get your name and email from the person who bought it for you, not from you directly.

Why we use it, and our legal basis

• To fulfil your booking or booking request — necessary to perform our contract with you, or to take the steps you ask for before one.
• To protect the booking service from misuse, for example by limiting how many requests one connection can send — our legitimate interest in keeping the service available.
• To work with the hotel partners who list on Hotelday — necessary to perform our contract with them.
• To process and deliver gift card orders — necessary to perform our contract with the buyer.
• To answer questions and provide support — our legitimate interest in helping you.
• To understand which pages and links lead to bookings — our legitimate interest in improving the service.
• To meet our legal obligations, for example around accounting.
• To send marketing emails, but only if you’ve given consent.
• To measure how the site is used with Google Analytics — only if you’ve given consent.
• To see how pages are used, with Microsoft Clarity, so we can fix places where visitors get stuck — only if you’ve given consent.

Who we share it with

The hotel you book with receives your name and booking details, so they can welcome you on the day. For a booking you pay for at the hotel, we contact the hotel, usually by phone, to confirm your place, and tell it your name, the date and how many guests are coming. We also use processors who help us run Hotelday, described here by role rather than by name: a payment provider (only when you pay online), an email provider, a hosting provider and analytics providers (only if you accept analytics cookies). Some of these providers may process personal data outside the European Economic Area: Google and Microsoft, for example, if you accept analytics cookies, may process it in the United States. When that happens we rely on the safeguards data protection law requires, such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

How long we keep it

We keep personal data only for as long as we need it for the purposes above, or as long as the law requires. Exact retention periods are still being confirmed and will be added before launch. The scrambled IP address stored with a booking request is cleared after 30 days.

Your rights

Under data protection law, you have the right to:

• Access the personal data we hold about you
• Correct it if it’s wrong
• Ask us to delete it
• Ask us to restrict how we use it
• Receive a copy of it in a portable format
• Object to certain uses
• Withdraw consent at any time, where we rely on it

You can also complain to the Hellenic Data Protection Authority, or to the data protection authority in the country where you live or work. To use any of these rights, email info@hotelday.co.

Cookies

Hotelday uses strictly necessary cookies — the kind needed to run the site and keep your booking session working. These don’t need your consent.

Only if you accept, we also use Google Analytics 4 to measure how the site is used: the pages viewed, and your approximate location and device. It sets cookies named _ga and _ga_ followed by an ID, which last up to 2 years. Google acts as our processor. Google uses your IP address to estimate your approximate location, and does not log or store it. Until you accept, nothing is loaded from Google and no analytics cookie is set. If you decline, none ever is.

Only if you accept, we also use Microsoft Clarity to see how pages are used, so we can fix places where visitors get stuck, especially on phones. It records clicks, taps, scrolling and mouse or finger movements, and how the page looked, as a replay. What you type into forms is hidden from the recordings, and so are names, email addresses and phone numbers shown on the pages where you book or manage a booking. Clarity does record the address of each page you visit, as Google Analytics does, and on a booking page that address contains your booking reference. Microsoft acts as our processor; see its privacy statement. On our own domain Clarity sets a persistent visitor-ID cookie (_clck) and a short-lived session cookie (_clsk). Microsoft’s documentation also lists cookies set from Microsoft’s own domain (CLID, MUID, ANONCHK, MR and SM), which Clarity may use. We never use Clarity for advertising. Until you accept, nothing is loaded from Microsoft and no Clarity cookie is set. If you decline, none ever is.

You can change your choice at any time with “Cookie settings” in the footer. Withdrawing consent stops the measuring and recording, and deletes the Google Analytics and Clarity cookies on our domain. We cannot delete the cookies Microsoft sets from its own domain (such as CLID and MUID); Microsoft’s privacy statement explains how to manage them. We remember your choice in your browser’s local storage and ask again after about six months.

Maps

A hotel’s location page can show an embedded OpenStreetMap map. It only loads if you tap “View on map” — nothing is requested from OpenStreetMap before then. Once it loads, OpenStreetMap (OpenStreetMap Foundation) receives your IP address and browser details, under its own privacy policy.

Contact

Questions about this policy? Email info@hotelday.co.