Our Privacy
Policy

The company under the name “TRYFON ANONYMOUS COMMERCIAL, INDUSTRIAL AND REAL ESTATE COMPANY”, with the distinctive title “TRYFON S.A.”, headquartered in Nea Alikarnassos, Municipality of Heraklion, Crete, at the corner of Agiou Tryfonos and Eleftheriadis Streets, VAT No.: 999676701, Tax Office of Heraklion, G.E.M.I. No. 077874427000, acting as Data Controller, hereinafter referred to as the “Company”, and in the context of the General Data Protection Regulation (EU) 2016/679, in force since 25 May 2018 (hereinafter “GDPR”), as well as applicable national and EU legislation, is committed to its customers, respecting their privacy and ensuring the confidentiality and security of their personal data. The Company operates the hotel properties “INFINITY BEACH HOTEL” in Hersonissos, “INFINITY CITY BOUTIQUE HOTEL” in Heraklion, and “ELOUNDA INFINITY EXCLUSIVE RESORT & SPA” in Elounda, Crete (hereinafter collectively referred to as “INFINITY BEACH HOTEL”).

This notice is addressed to all natural and legal persons who carry out any transaction with the Company, including customers who use the services provided by the Company.

The purpose of this Privacy Policy is to inform you about the type of personal data collected by TRYFON S.A., the manner in which it is processed (collection, storage, use, transmission), the means of protection, and the rights that customers have with respect to such processing, which is carried out in all cases in a reliable and transparent manner.

The processing of personal data includes the collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, transmission, restriction or erasure of personal data that has come or will come to the knowledge of the Company, either in the context of your transactional relationship with it or through information received by the Company from a third natural or legal person or public sector body in the exercise of a lawful right of that party or of the Company itself.

The Company, in compliance with the applicable legal framework, has taken all necessary steps, implementing appropriate technical and organisational measures for lawful maintenance and processing, and is committed to ensuring and protecting in every way the processing of your personal data against loss or leakage, alteration, transmission or any other form of unlawful processing.

In order to be transparent about the way personal data is collected, used and shared, and to communicate the purpose and means of processing, TRYFON S.A. provides its customers with the following information:

What Information We Collect and When

The Company processes personal data that you or your legal representatives have disclosed or will disclose to the Company, which is necessary for the initiation, maintenance and performance of your transactional relationship with the Company — existing or future — depending on the product or service provided and the applicable procedures and policies. The personal data you provide to the Company must be complete and accurate, and must be updated by you immediately in every case of change, or whenever required by the Company, in order to maintain your transactional relationship or to fulfil an obligation of the Company arising from national law and applicable regulatory provisions.

The Company also processes your personal data received from third natural or legal persons or public bodies, which is necessary either for the pursuit of the legitimate interests of the Company or a third party, or for the performance of tasks carried out in the public interest (e.g. tax and insurance authorities).

For the initiation and maintenance of its transactional relationship with customers, and in particular for the provision of hotel services, the Company collects and processes at minimum the following personal data: first name, last name, father’s name, identity card/passport details or other official identification document, permanent place of residence, home address, correspondence address, professional details and work address, telephone number (landline and/or mobile), and email address. Additional information may be requested on a case-by-case basis, where such information is a prerequisite for initiating or maintaining the transactional relationship and for the optimal provision of our services.

The collection and processing of the above personal data is necessary for the initiation, performance and maintenance of our transactional relationship [as defined in Article 2 of the Regulation governing relations between hoteliers and their guests (Article 8 of Law 1652/30.10.1986, Government Gazette 167 A’)]. Any objection on your part to the provision or processing of your personal data may result in the inability to initiate or maintain the existing collaboration with the Company (e.g. failure to provide the necessary details for a room reservation will result in the inability to complete the reservation).

The hotel offers you free access to its application, which connects directly to the hotel’s central system. The application does not store data independently. Any existing data and other data you may enter into the application will be stored directly in the hotel’s central database and processed directly by the hotel. Through the application, you may contact us directly via message. Such contact will be stored in accordance with this Privacy Policy, as if you had chosen to contact us by any other means.

Processing of Special Categories of Personal Data (“Sensitive Personal Data”)

The Company does not process sensitive categories of your personal data, such as data relating to your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data for identification purposes, health data, or data concerning your sex life or sexual orientation, unless: a) you have given your explicit consent for a specific purpose; b) such data has been disclosed to the Company by you or a third party for the purpose of documenting and safeguarding your legitimate interests and/or those of the Company as Data Controller; c) processing is necessary to protect your vital interests or those of another person; d) the data has been manifestly made public by you; e) processing is necessary for the establishment, exercise or defence of legal claims; or f) processing is necessary for reasons of substantial public interest. The Company has in all cases taken all necessary technical and organisational measures for the secure maintenance and processing of your personal data belonging to these special categories.

Data Relating to Minors

The processing of personal data of minors, which is necessary for the initiation, performance and maintenance of our transactional relationship (e.g. room reservation and accommodation of a minor at the hotel), is carried out subject to prior consent from parents or legal guardians, unless otherwise provided by law. For the purposes of this Policy, minors are persons who have not yet reached the age of 18.

Where processing is based on consent pursuant to Article 6(1)(a) GDPR in relation to the direct offer of information society services to a child, the consent given by a minor is lawful if the minor is at least 16 years of age. Where the minor is under 16 years of age, such processing is lawful only if and to the extent that consent is provided or approved by the person holding parental responsibility (see Article 8 GDPR).

Legal Basis for Processing

The Company lawfully processes personal data where processing:

  • Is necessary for the servicing, support and monitoring of your transactional relationship with the hotel and the proper performance of the relationship between you.
  • Is necessary for compliance with a legal obligation of the Company or for the pursuit of its legitimate interests arising from your transactional relationship with the Company or from other rights deriving from law.
  • Is necessary for the performance of a task carried out in the public interest within the applicable legislative and regulatory framework.
  • Is based on your prior information and consent, where processing is not grounded in one of the above-mentioned lawful bases.

Purposes of Processing

The processing of your personal data relates to:

  • The servicing, support and monitoring of your transactional relationship with the Company, the proper performance of contracts and transactions between you, the examination of requests for products/services, the fulfilment of the Company’s obligations as Data Controller or Processor, and the exercise of its legal and contractual rights.
  • The improvement of the Company’s products and services and the promotion of products and services of the Company and Group companies, subject to your prior consent.
  • The satisfaction of any requests addressed to the Company or the handling of complaints regarding products and services offered by the Company.
  • The fulfilment of the Company’s legal obligations arising from the applicable legislative and regulatory framework (e.g. insurance and tax audits).
  • The protection of the Company’s legitimate interests, including: a) the pursuit of legal claims before competent judicial authorities or alternative dispute resolution bodies; b) the evaluation and optimisation of security procedures and information systems; c) physical security and the protection of persons and property (e.g. video surveillance).

Where your prior consent has been obtained, the Company may process your personal data to inform you about the products and services it offers. For this purpose, it processes information about the services you use in order to present products, services or offers that better serve your needs.

In all cases, you have the right to object to the processing of your personal data for the purpose of direct marketing of the Company’s products and services, including profiling, by submitting a request to the Company by any appropriate means or by unsubscribing from newsletters and updates.

Data Retention Period

The Company retains your personal data for the period provided for by the applicable legislative and regulatory framework. Even where the legal framework provides for a shorter period, the Company will retain data for the purposes of its legitimate interests (statute of limitations on claims) for a minimum period of five (5) years and a maximum period of twenty (20) years from the last calendar day of the year in which your transactional relationship with the Company ends. In the event of litigation, personal data concerning you will be retained until the conclusion of the proceedings, even if this exceeds the above twenty (20) year period. In the event of any claim being raised, your data will be retained for at least as long as the claim remains active.

Where any request for collaboration with the Company is not accepted and no contract is concluded, data will be retained for a maximum period of five (5) years to safeguard the Company’s interests in the event of a related claim, after which they will be permanently and irrecoverably deleted.

The Company may retain your personal data for a longer period where it has a legal obligation to do so.

Recipients of Personal Data

Access to your personal data is granted to employees of the Company’s business and operational units, within the scope of their responsibilities, in the context of the proper performance and fulfilment of their contractual, legal and regulatory obligations.

The Company does not transmit or disclose your personal data to third parties, except in the case of:

  • Legal entities (domestic and foreign) to which the Company has entrusted, in whole or in part, the processing of your personal data on its behalf (Data Processors), who have undertaken a confidentiality commitment to the Company and with whom the Company is bound by a contract ensuring the protection of personal data in accordance with Article 28(3) GDPR — either within the framework of a contractual relationship specifying the subject matter, purpose, duration of processing, types of personal data, and the Company’s rights, or within the framework of a regulatory obligation of confidentiality. These include, by way of example:
    • Partner companies responsible for the use and management of information systems.
    • Payment service and payment processing companies (e.g. DIAS, VISA, Mastercard).
    • Courier companies.
    • Cooperating travel agencies, domestic or international.

Full details of our partners’ names are available upon request.

  • Transmission or disclosure required by applicable regulatory, legislative or judicial framework (e.g. to judicial authorities, tax authorities, supervisory bodies, mediation bodies), subject to confidentiality provisions.
  • Judicial authorities and public bodies in the exercise of their competences.

International Data Transfers

TRYFON S.A. does not directly transfer your personal data to third countries (outside the EU) or international organisations, unless such transfer is required by applicable regulatory or legislative framework, or you have been duly informed and have given your prior explicit consent to such transfer (where required).

Your Rights

You retain control over the processing of your personal data. Specifically, you have the following rights:

  • Right to transparent information (Articles 12, 13, 14 GDPR): the right to be informed about how your personal data is used, as detailed in this Privacy Policy.
  • Right of access (Article 15 GDPR): to the personal data collected from you.
  • Right to rectification (Article 16 GDPR): of any inaccurate personal information.
  • Right to erasure (“right to be forgotten”) (Article 17 GDPR): of your data. This right cannot be exercised to the extent that processing is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims by the Company.
  • Right to restriction of processing (Article 18 GDPR) of your personal data.
  • Right to object (Article 21 GDPR) to the processing of your personal data.
  • Right to withdraw consent (Article 7 GDPR): where processing is based on consent, you may withdraw it at any time. The lawfulness of processing prior to withdrawal is not affected.
  • Right to lodge a complaint with the competent Greek supervisory authority, the Hellenic Data Protection Authority (1–3 Kifissias Avenue, Athens, PC 115 23, +30 210 6475600, contact@dpa.gr), or with the supervisory authority of your country of residence.

How to Exercise Your Rights

To exercise the above rights, you may contact us in writing at the Company’s registered address, at Infinity Beach Hotel, Daidalou 9, 70014 Hersonissos, Crete, by email at infinitybluehotel@gmail.com, or by telephone at +30 28970 29000.

Please accompany your requests with appropriate identification documents, noting that the Company reserves the right to request additional information for identification and verification purposes.

TRYFON S.A. will make every effort to respond to your request(s) within thirty (30) days of submission. Refusal or unjustified delay in satisfying your requests entitles you to lodge a complaint with the Hellenic Data Protection Authority as the competent supervisory authority for the application of the GDPR.

Please note that the Company uses cookies on its website for the purpose of improving your online experience.

Revision of This Policy

The Company, in accordance with its applicable data protection policy and the applicable legislative and regulatory framework, may review or amend this notice. The updated version will always be available on the Company’s website at www.infinitybeach.com.

Technical and Organisational Measures

The Company takes appropriate and necessary technical and organisational measures to ensure both technological and physical security in accordance with Article 32 GDPR (including, by way of example: encryption and regular testing, restricted access, special passwords for authorised individuals to access databases, etc.) and adheres to the principles of processing as set out in the GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality (Article 5 GDPR).

In the interest of protecting your privacy, we implement best practices for securing your personal data through the necessary technical and organisational measures as required by the GDPR. Data is protected against loss of availability, integrity and confidentiality.

The Company is in continuous alignment and compliance with the terms of General Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

What Happens in the Event of a Data Breach

Although the Company exercises due diligence in the processing of your personal data, it is prepared to address any potential breach promptly. In the event of a personal data breach that may pose a high risk to your rights and freedoms, the Company will take all appropriate technical and organisational measures and, where required by law, will notify you without undue delay.

If you become aware of a breach of your personal data, you must notify TRYFON S.A. immediately, disclosing the nature of the breach. Examples include: 1) Loss of correspondence or access by an unauthorised recipient; 2) Security attack (hacking); 3) Malicious software (e.g. virus, ransomware); 4) Phishing email; 5) Accidental publication/disclosure of data; 6) Data shown, provided or transmitted to the wrong person; 7) Accidental verbal disclosure of data.

Please check whether the breach was caused by your own actions and collect all necessary information that TRYFON S.A. will use to address the incident.

Additional Declarations of TRYFON S.A.

  • The Company declares that it is not liable for any damage (direct, indirect, positive or consequential) that may be caused to the visitor in connection with the website or its use. The visitor is solely responsible for protecting their system against viruses and malicious software.
  • The Company declares that it does not make decisions or create profiles based on automated processing of your data.
  • The Company declares that it may review or amend this notice in accordance with its applicable data protection policy and the applicable legislative and regulatory framework. The updated version will always be available at www.infinitybeach.com. The most recently amended version of the Privacy Policy shall always be considered the current version.
  • Please note that TRYFON S.A. uses cookies on its website to improve your online experience. For details regarding cookies, please refer to our Cookie Policy.

The user/visitor of the website, by reading this notice, acknowledges the above processing, which is carried out in accordance with Regulation 2016/679 and its recitals, exclusively for the purposes stated above and for purposes compatible with them.

Contact Information

1. Data Controller Details: TRYFON S.A.

Registered Address: Corner of Agiou Tryfonos and Eleftheriadis Streets, Nea Alikarnassos, Heraklion, Crete

Additional contact address: Infinity Beach Hotel, Daidalou 9, 70014 Hersonissos, Crete

Telephone: +30 28970 29000

Email:reservations@infinitybeach.gr

Website: www.infinitybeach.com

2. Hellenic Data Protection Authority (HDPA — competent national supervisory authority):

Address: 1–3 Kifissias Avenue, PC 115 23, Athens, Greece

Telephone: +30 210 6475600

Fax: +30 210 6475628

Email: contact@dpa.gr

Book Now ▲
Best Rate Guaranteed
Book Direct & Save
Free Cancellation Available
Book Now