SPITI | The key to slow living!
Welcome to Rustic!
SPITI | The key to slow living!
The key to slow living!
Data Privacy Statement and Cookie Policy
Last updated: September 2026
-
Who We Are
This website is operated by Spiti Kathikas, a holiday accommodation provider located in Kathikas, Paphos, Cyprus. References to “we”, “us” or “our” in this Privacy and Cookie Policy refer to Spiti Kathikas.
For the personal data processed in connection with direct bookings, enquiries and use of this website, Spiti Kathikas acts as the data controller, except where another organisation acts as an independent controller for its own purposes.
For privacy-related questions or requests, please contact: info@spiti.com.cy.
-
Personal Data We Collect
Depending on how you use our website and services, we may collect personal data including:
- your full name;
- email address;
- telephone number;
- billing or contact address, where required;
- booking dates, accommodation selected and booking preferences;
- number of guests and other information necessary to manage the booking;
- messages and enquiries you send to us;
- booking references, order references and transaction references;
- payment status, payment amount and related transaction information;
- IP address and relevant browser, device and security information;
- account information where you create or use a customer account; and
- technical information generated when you use our website.
Payment card details are entered and processed through the secure payment environment provided for JCC Payments. Spiti Kathikas does not collect or store your full card number, card expiry date or card security code.
We may receive limited payment-related information necessary to manage your booking, such as the payment result, amount, order or transaction reference and relevant timestamps.
-
How and Why We Use Your Personal Data
We use personal data only where we have a lawful reason to do so.
Purpose Legal Basis Processing, managing and confirming accommodation bookings Performance of a contract or steps requested before entering into a contract Processing and reconciling payments and refunds Performance of a contract and compliance with legal obligations Communicating with you about your booking before, during and after your stay Performance of a contract and our legitimate interests in managing our service Responding to enquiries and customer-service requests Legitimate interests or steps requested before entering into a contract Maintaining accounting, tax and transaction records Compliance with legal obligations Preventing fraud, misuse and security incidents Legitimate interests and, where applicable, legal obligations Non-essential analytics, marketing or similar technologies Consent, where required -
Online Payments and JCC Payments
Direct online card payments are processed securely through WooCommerce and JCC Payments.
When you proceed to payment, payment-card information is handled in the secure payment environment provided for JCC Payments rather than being stored by Spiti Kathikas.
JCC Payments may process transaction personal data on our behalf where necessary to provide payment-processing services. JCC Payments may also process certain information as an independent data controller for its own legal, regulatory, fraud-prevention, risk-management, security and payment-authentication purposes.
Eligible refunds are processed through WooCommerce/JCC Payments and returned to the original payment method in accordance with our Refund and Cancellation Policy.
-
Who We May Share Personal Data With
We disclose personal data only where necessary for the operation of our accommodation and booking services, or where required by law.
Recipients or categories of recipients may include:
- JCC Payments and payment-service providers, where necessary to process payments, refunds, authentication, fraud prevention and transaction reconciliation;
- website hosting, email, security and technical service providers acting on our behalf;
- professional advisers such as accountants, auditors or legal advisers where reasonably necessary;
- government authorities, courts, tax authorities, regulatory bodies or law-enforcement authorities where disclosure is required or permitted by law; and
- other service providers where you have requested a service or where disclosure is otherwise lawful and necessary.
We do not sell your personal data.
-
International Data Transfers
Some service providers may process or store personal data outside Cyprus or the European Economic Area.
Where personal data is transferred to a country outside the European Economic Area and applicable data-protection law requires safeguards, we take appropriate steps to ensure that the transfer is made using a lawful transfer mechanism, such as an adequacy decision, appropriate contractual safeguards or another mechanism permitted by applicable law.
-
Data Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, accounting, tax, payment, contractual and dispute-resolution requirements.
Booking, invoice and payment-related information may therefore be retained for the period required under applicable accounting and tax legislation and for any additional period reasonably necessary to establish, exercise or defend legal claims.
Enquiry, technical and website information is retained only for as long as reasonably necessary for the relevant purpose, security requirement or legal obligation.
Where information is no longer required, it may be deleted or anonymised, subject to any legal requirement requiring us to retain it.
-
Your Data Protection Rights
Subject to the conditions and exceptions provided by applicable data-protection law, you may have the right to:
- request access to the personal data we hold about you;
- request correction of inaccurate or incomplete personal data;
- request erasure of personal data where the legal conditions are met;
- request restriction of processing;
- object to processing based on legitimate interests;
- request data portability where applicable;
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before consent was withdrawn; and
- lodge a complaint with the competent data-protection authority.
To exercise your rights, please contact info@spiti.com.cy.
You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.
-
Data Security
We use appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful access, disclosure, alteration, loss or destruction.
The website uses encrypted HTTPS connections where information is transmitted between your browser and the website.
Payment-card details are handled through the JCC payment environment and are not stored by Spiti Kathikas.
No internet or electronic storage system can be guaranteed to be completely secure, but we take reasonable measures appropriate to the nature of the information and the risks involved.
-
Cookies and Similar Technologies
Our website uses cookies and similar technologies. A cookie is a small text file or piece of information stored on or accessed from your device when you use a website.
Some cookies are strictly necessary for functions such as website security, session management, customer accounts, booking functionality and checkout.
Other cookies, such as analytics, preference, advertising or third-party cookies, are considered non-essential and will only be used after you have made the appropriate choice through our cookie-consent controls where consent is required.
Cookie Category Purpose Consent Strictly Necessary Required for essential website functions such as security, booking sessions, checkout and account functionality. Not normally subject to consent where strictly necessary to provide a service you have requested. Analytics / Performance Help us understand how visitors use the website and measure website performance, where such services are enabled. Used only after consent where required. Functional / Preference Remember optional preferences or provide enhanced functionality that is not strictly necessary. Used only after consent where required. Marketing / Third-Party May be used by advertising, social-media or other third-party services if those services are enabled. Used only after consent where required. The specific cookies and similar technologies currently in use, including their provider, purpose and duration where applicable, should be available through our Cookie Settings.
-
Your Cookie Choices
When you first visit the website, you may be presented with cookie controls allowing you to accept or reject non-essential cookies and manage your preferences.
Non-essential cookies are not treated as accepted simply because you continue browsing the website.
Where consent is required, non-essential cookies should only be activated after you make a clear affirmative choice.
You may refuse non-essential cookies without losing access to the core website and booking service.
You can change or withdraw your cookie preferences at any time through the website’s Cookie Settings.
You may also control or delete cookies using your browser settings. Blocking strictly necessary cookies may prevent certain essential website, booking, account or checkout functions from working correctly.
-
Analytics and Other Third-Party Website Services
Our website may use third-party website services for functionality, security, analytics or other legitimate purposes.
Where an analytics or other non-essential third-party service requires cookie consent, that service should not be activated until the required consent has been provided.
Third-party providers may process personal data under their own privacy notices where they act as independent data controllers.
We do not describe analytics information as anonymous unless the relevant service and configuration actually ensure that the data has been irreversibly anonymised.
-
Links to Other Websites
Our website may contain links to third-party websites or services. We are not responsible for the privacy practices of websites operated independently by third parties.
We encourage you to review the privacy information provided by those services before submitting personal data to them.
-
Changes to This Privacy and Cookie Policy
We may update this Privacy and Cookie Policy from time to time to reflect changes to our website, services, legal obligations or data-processing activities.
The current version will be published on this page together with its latest update date.
-
Contact
For privacy questions or to exercise your data-protection rights, please contact:
Spiti Kathikas
Kathikas, Paphos, Cyprus
Email: info@spiti.com.cy
Tel: +357 26 222864
Website: https://spiti.com.cy/You may also contact the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus regarding your rights under applicable data-protection law.