This Privacy Policy applies to the use of the website www.captainkaras.com and any related online services of Captain Karas Collection. (Captain Karas Collection is a brand operated under Karas Hospitality Group). A & M Karas & Sons LTD
Registered Address: Kennedy Ave 55, Paralimni, Cyprus
Email: dpo@karasgroup.com.cy We may collect and process the following categories of personal data:

• Identification data (name, surname)
• Contact details (email address, telephone number)
• Reservation and inquiry details
• Communication content submitted via forms or email
• Technical data (IP address, browser type, device type, operating system)
• Cookie and website usage data
• CCTV image data from our premises

Payment card details are not stored by us.
All payments are processed securely through authorized payment providers.

Purpose	Legal Basis (GDPR Art. 6)
Handling reservations and inquiries	Contractual necessity (b)
Customer communication	Contract / Legitimate interest (b, f)
Legal and tax compliance	Legal obligation (c)
Website security and fraud prevention	Legitimate interest (f)
Website analytics and cookies	Consent (a)
Marketing communications	Consent (a)
CCTV for safety and security	Legitimate interest (f)

CCTV systems operate in all Captain Karas Apts premises for:

• Protection of individuals and property
• Prevention and investigation of incidents

• No audio recording takes place
• Access to footage is strictly limited to authorized personnel
• CCTV footage is retained for 14 days, unless required for investigation or legal claims
• Clear signage is displayed in all monitored areas

Our website uses cookies to ensure proper functionality and to analyze traffic.

• Strictly necessary cookies are always active
• Analytics and marketing cookies are used only after your explicit consent

Third-party services may include:

• Google Analytics
• Meta / Facebook Pixel (if activated)

You may manage or withdraw your consent at any time through the cookie settings. Personal data may be shared only with trusted third parties, including:

• Payment service providers
• IT, hosting and website support providers
• Email and SMS communication providers
• Reservation and property management systems

All third parties act under GDPR-compliant Data Processing Agreements. Where personal data is transferred outside the EU/EEA, appropriate safeguards are applied, including:

• EU Standard Contractual Clauses (SCCs)

Data Category	Retention Period
Reservations and invoices	7 years
Contact and inquiry data	12 months
Marketing data	Until consent is withdrawn
Website logs	6 months
CCTV footage	14 days

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erase
• Restrict processing
• Object to processing
• Data portability
• Lodge a complaint with the Office of the Commissioner for Personal Data Protection (Cyprus)

Website: www.dataprotection.gov.cy
Requests may be submitted to:
📧 dpo@karasgroup.com.cy We apply appropriate technical and organizational measures including:

• Access controls
• Secure hosting environments
• Encrypted communications where applicable
• Authorized personnel access only

This Privacy Policy may be updated periodically.
The most current version will always be available on our website.