Last updated: April 2026

1. Who We Are

This website is operated by Spiti Kathikas, a holiday accommodation provider located in Kathikas, Paphos, Cyprus. References to “we”, “us”, or “our” in this policy refer to Spiti Kathikas.

For any privacy-related questions, you may contact us at: info@spiti.com.cy

2. What Data We Collect

When you interact with our website or make a booking, we may collect the following personal data:

• Full name
• Email address
• Phone number
• Billing address
• Payment information (processed securely via JCC Payments — we do not store card details)
• IP address and browser/device information
• Booking preferences and enquiry messages

3. How We Use Your Data

We use your personal data to:

• Process and confirm accommodation bookings
• Communicate with you before, during, and after your stay
• Process payments through our payment provider (JCC Payments)
• Respond to enquiries submitted through our contact form
• Comply with legal and tax obligations
• Improve our website and services

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR) and Cyprus data protection law (Law 125(I)/2018), we process your personal data on the following legal bases:

• Contractual necessity — to fulfil your booking
• Legal obligation — to comply with applicable laws
• Legitimate interests — to improve our services and communicate with you
• Consent — where you have explicitly agreed (e.g. newsletter sign-up)

5. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy, and in any case for a minimum of 7 years where required by Cypriot tax and accounting law.

6. Your Rights

As a data subject, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data (where legally permissible)
• Object to or restrict certain processing activities
• Request data portability
• Withdraw consent at any time (where processing is based on consent)
• Lodge a complaint with the Cyprus Commissioner for Personal Data Protection (www.dataprotection.gov.cy)

To exercise any of these rights, please contact us at info@spiti.com.cy.

7. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. Online payments are handled exclusively through JCC Payments, a certified and regulated payment processor, using SSL encryption.

8. Third-Party Services

Our website may use third-party services including:

• JCC Payments — for secure online payment processing
• Google Analytics — for anonymous website traffic analysis
• WordPress plugins — for website functionality and form handling

Each third party has its own privacy policy and data practices.

9. Cookie Policy

Our website uses cookies — small text files stored on your device — to improve your browsing experience.

Types of cookies we use:

Managing Cookies

You can control and delete cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For more information on managing cookies, visit www.aboutcookies.org.

By continuing to use our website, you consent to our use of non-essential cookies as described above.

10. Changes to This Policy

We may update this policy from time to time. The latest version will always be available on this page with the date of last update.