Privacy & Cookies

Our Privacy Policy

1.1 This is the Privacy Notice of Corfu Villas Limited (company number 01088052) trading as CV Villas and whose registered office is at 96 Great Suffolk Street  London SE1 0BE. Where this Privacy Notice refers to “CV Villas”, “we”, “us” or “our”, it is referring to Corfu Villas Limited. This Privacy Notice sets out how we collect and process your personal data in relation to the brand known as CV Villas. This Privacy Notice also provides certain information that is legally required and lists your rights in relation to your personal data. Please read this Privacy Notice to understand how we may use your personal data. 
 
1.2 This Privacy Notice relates to personal information that identifies “you” meaning a customer or potential customer, individuals who browse our website or individuals outside our organisation with whom we interact. If you are an employee, contractor or otherwise engaged in work for us or applying to work for us, a separate privacy notice applies to you instead. This Privacy Notice is not intended for children and we do not knowingly collect personal data relating to children.
 
1.3 We refer to this information throughout this Privacy Notice as “personal data” and section 3 sets out further detail of what this includes.
 
1.4 This Privacy Notice may vary from time to time so please check it regularly.  This policy was last updated on 18th May 2018.
2.1 Data controller and contact details
2.1.1 For the purposes of relevant data protection legislation, we are a controller of your personal data and as a controller we use the personal data we hold about you in accordance with this Privacy Notice. 
2.1.2 If you wish to correct your personal data held by us or to opt out at any time from receiving marketing correspondence from us or to alter your marketing preferences please email cv@cvvillas.com
2.1.3 If you need to contact us in connection with our processing of your personal data, then our contact details are cv@cvvillas.com. 
 
2.2 Data Protection Officer
Our Data Protection Officer can be contacted at 96 Great Suffolk Street, London SE1 0BE, or by email at marketing@cvvillas.com.
3.1 The categories of personal data about you that we may collect, use, store, share and transfer are:
3.1.1 Advertising Data. This includes personal data which relates to your advertising preferences, such as information about your preferences in receiving marketing materials from us and your communication preferences; 
3.1.2 Information Technology Data. This includes personal data which relates to your use of our website, such as your [internet protocol (IP) address, login data, traffic data, weblogs and other communication data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website;
3.1.3 Individual Data. This includes personal data which relates to your identity, such as your first name, middle name, last name, username or similar identifier, marital status, title, date of birth, place of birth, passport number and gender;  
3.1.4 Account and Profile Data. This includes personal data which relates to your profile on our website, such as your username and password, proposals and bookings made by you, your interests, preferences, feedback and survey responses.
3.1.5 Usage and Operational Data. This includes personal data which relates to your usage and operation of our website, such as information about how you use our website, products and services;     
3.1.6 Economic and Financial Data. This includes personal data required for us to process your booking in line with our obligations under the Payment Card Industry Data Security Standard (PCI) and for the prevention of fraud;
3.1.7 Enquiry and Sales Data. This includes personal data which relates to the transactions you have conducted with us, such as details about payments to and from you, details of subscriptions to our services or publications and other details of products and services you have purchased from us;
3.1.8 Audio Data. This includes personal data which is gathered using recording systems at our locations. 
3.1.9 Market Research Data. This includes personal data which is gathered for the purposes of market research, such as price comparison information;
3.1.10 Health Data. This includes personal data which is gathered for health and safety purposes including any accident report or claim log or any information you provide about allergies or other medical conditions during the booking process or in one of our locations;
3.1.11 Communication Data. This includes personal data which relates to a method of communication such as your billing address, delivery address, email address and telephone numbers; 
 
3.2 We may also create Personal Data about you, for example, if you contact us by telephone to make a complaint, for example about our services or goods, then we may make a written record of key details of the conversation so that we can take steps to address the complaint.
 
3.3 We also obtain and use certain aggregated data such as statistical or demographic data for any purpose (“Aggregated Data”). Aggregated Data may be derived from your personal data but does not directly or indirectly reveal your identity. For example, we may aggregate your Operation Data to calculate the percentage of users accessing a specific feature on our website. However, if we re-combine or re-connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Notice.
 
3.4 In addition, we may obtain certain special categories of your data (“Special Categories of Data”), and this Privacy Notice specifically sets out how we may process these types of personal data. The Special Categories of Data are data relating to sexuality, religious beliefs or health.
 
3.5 We do not collect any information about Criminal convictions and Offences. 
 
.1 We obtain your personal data from the following sources:
4.1.1 Directly from you, either in person (at our locations or otherwise), via our website, via email or by telephone. This could include personal data which you provide when you:
(a) request a brochure;
(b) book an appointment;
(c) browse or create an account on our website;
(d) subscribe to our service or publications; 
(e) request marketing to be sent to you;
(f) enter into a competition or promotion;
(g) completing a survey from us; 
(h) saving a proposal;
(i) entering details at an event.
(j) send an email to us
4.1.2  Automated technologies, such as call recording, cookies, server logs and other similar technologies.
4.1.3 Third parties, such as:
(a) analytics providers;
(b) advertising networks;
(c) search information providers;
(d) providers of technical, payment and delivery services;
(e) data brokers or aggregators;
(f) partnerships;
(g) travel Agents.
5.1 Where we are relying on a basis other than consent
 
We may rely on one or more of the following legal bases when processing your personal data. We have set out below the purposes for which we may process your personal data and the relevant legal basis upon which we will rely (this is what the law allows us to do): 
 
5.1.1 For managing your booking we will use information provided by you to deliver our products and services. This includes booking holidays, tours, transportation, car hire and the issuing of tickets. We will rely on the following legal basis to process this personal data:
(a) the processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;
 
5.1.2 To make suggestions and recommendations to you about our products and services that may be of interest to you, for determining and measuring the effectiveness of promotional campaigns and advertising and making sure our marketing is relevant to you. We will rely on the following legal basis to process this personal data:
(a) the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data;
 
5.1.3 To deal with your enquiries, to send you information you have requested or to provide you with important-real time information about our products and service you have ordered from us (e.g. a change of time or location due to unforeseen circumstances).  We will rely on the following legal bases to process this personal data:
(a) the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data;
(b) the processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;
 
5.1.4 For the development, delivery and improvement of our products and services, marketing, customer relationships and experiences in the provision of products and services to our customers. We will rely on the following legal basis to process this personal data:
(a) the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data;

(b) You may receive an invitation to review your holiday or booking experience from Feefo, our ratings and review partner. In this instance Feefo will be acting as the data processor on CV Villas’ behalf. Feefo use different methods of communication for the invitations including email and WhatsApp. For more details on how WhatsApp may process your data, see here

 
5.1.5 Where you have submitted a job application we may for a reasonable period of time keep your details on file for future reference should a suitable position subsequently become available and we may send you information about job opportunities. We will rely on the following legal basis to process this personal data:
(a) the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data;
 
5.1.6 To help us develop our website to be more useful to you and our customers, for identifying usage trends and for internal purposes of research, analysis, testing, monitoring, customer communication, risk management and administrative purposes, to help us define types of customer for our products and services, to keep our website updated and relevant and to develop our marketing strategy. We will rely on the following legal basis to process this personal data:
(a) the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data;
 
5.1.7 To protect our rights or property (including our website), administer and improve our IT services and network security, prevent fraud and facilitate any business reorganisation or group restructuring exercise. We will rely on the following legal basis to process this personal data:
(a) the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data;
 
5.1.8 In order to comply with our own legal obligations, e.g. health and safety legislation, or to assist in an investigation (e.g. from the Police). We will rely on the following legal basis to process this personal data:
(a) the processing is necessary for compliance with a legal obligation to which we are subject;
 
5.1.9 In order to use your personal data in life or death situations where there is no time to gain your consent (e.g. in the event of an accident and we have to give personal details to medical personnel). We will rely on the following legal basis to process this personal data:
(a) the processing is necessary in order to protect the vital interests of the data subject or of another natural person;
 
5.1.10 In an official role which we have been designated to carry out by an official authority (e.g. the government), or where we are otherwise carrying out tasks which are in the public interest (e.g. which have been designated as such by the government, or which would otherwise be deemed in the public interest). We will rely on the following legal basis to process this personal data:
(a) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

5.2 Special Categories of Data
In addition, we may lawfully process Special Categories of Data in certain ways. We set out below the purposes for which we may process Special Categories of Data along with the legal bases on which we process these Special Categories of Data (this is what the law allows us to do): 
 
5.2.1 we may need to process your health information (for example to enable us to make arrangements for special assistance and any dietary preferences or requirements or for determining your fitness to fly). In relation to the processing of such Special Categories of Data:
(a) We rely on the following legal basis to process such Special Categories of Data:
(i) the processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;
(ii) the processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(b) Additionally, we can only process such Special Categories of Data where:
(i) The processing is necessary in order to protect the vital interests of you or another individual where you or the individual is physically or legally incapable of giving consent;
(ii) The processing is necessary for reasons of public interest in the area of public health for example:
(aa) protecting against serious cross-border threats to health;
(ab) ensuring high standards of quality and safety of healthcare and of medicinal products or medical devices;
5.2.2 we may need to disclose any Special Categories of Data we hold on you, where to do so is in the substantial public interest (for example your health information in order to prevent an epidemic, in the event of illness or injury or some other related emergency, to record any accident or injury or other incident you may suffer when visiting any of our locations or to arrange for you to receive medical assistance), provided that when we do so we provide suitable measures to protect your rights. In relation to the processing of such Special Categories of Data:
(a) We rely on the following legal basis to process such Special Categories of Data:
(i) The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
(b) Additionally, we can only process such Special Categories of Data where:
(i) The processing is necessary for reasons of public interest in the area of public healthfor example:
(aa) protecting against serious cross-border threats to health;
(ab) ensuring high standards of quality and safety of healthcare and of medicinal products or medical devices;
5.2.3 we may need to process information about your religion (for example to enable an airline to provide you with a meal indicating a particular religion e.g. halal or kosher) or your sexuality (for example to enable us to provide you with a specific holiday which you have requested from our range). In relation to the processing of such Special Categories of Data:
(a) We rely on the following legal basis to process such Special Categories of Data:
(i) the processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;
(b) Additionally, we can only process such Special Categories of Data where:
(i) You have given us explicit consent to the processing of such Special Categories of Data for the purpose. You may at any time withdraw this specific consent but we will be unable to fulfil your booking in such event and we may have to cancel your booking.
 
We will always attempt to minimise the amount of sensitive personal data collected unless there is a specific lawful reason (e.g. an emergency situation). 
6.1 We may disclose your personal data to:
6.1.1 our third party suppliers or sub-contractors who may process data on our behalf to enable us to provide you with our services. Any such disclosure will only be so that we can process your personal data for the purposes set out in this Privacy Notice;
6.1.2 our group companies and affiliates or third party data processers who may process data on our behalf to enable us to carry out our usual business practices. Any such disclosure will only be so that we can process your personal data for the purposes set out in this Privacy Notice;
6.1.3 HMRC, legal and other regulators or authorities, including those who request your personal data or to report any potential or actual breach of applicable law or regulation;
6.1.4 external professional advisers such as accountants, bankers, insurances, auditors and lawyers; 
6.1.5 law enforcement agencies, courts, immigration authorities, customs and excise authorities or other relevant party, to the extent necessary for the establishment, exercise or defence of legal rights;
6.1.6 third parties where necessary for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;
6.1.7 third parties which are considering or have decided to buy some or all of our assets or shares, merge with us or to whom we may transfer our business (including in the event of a reorganisation, dissolution or liquidation);
6.1.8 third parties operating plugins or content (such as Facebook, Twitter, Instagram) on our website which you choose to interact with;
6.1.9 In the event of our insolvency we, or any appointed insolvency practitioner, may disclose your personal information to the CAA, and/or ABTA so that they can assess the status of your booking and advise you on the appropriate course of action under any scheme of financial protection. The CAA’s General Privacy Notice is at https://www.caa.co.uk/Our-work/About-us/General-privacy-notice/ ABTA’s Privacy Notice is at https://www.abta.com/privacy-notice.

6.2.1 If you opt-in to hear from our carefully selected third parties. We work with Epsilon Abacus (registered as Epsilon International UK Ltd), a company that manages the Abacus Alliance on behalf of UK retailers and charities. The participating retailers are active in the clothing, collectables, food & wine, gardening, gadgets & entertainment, health & beauty, household goods, home interiors and travel categories. These retailers and charities share information about their customers and supporters and what they buy or donate. Epsilon Abacus processes this information as a processor on behalf of these companies to help them understand individuals’ behaviour and preferences. Epsilon combines information provided by participating retailers and charities with third party data. From this combined information, these companies can tailor their communications, sending individuals suitable offers and appeals that should be of interest to them. You can learn more about how Epsilon Abacus processes your personal information in their Privacy Policy, which is available here

7.1 If you provide personal data to us about someone else  you must ensure that you are entitled to disclose that personal data to us and that, without our taking any further steps, we may collect, use and disclose that personal data as described in this Privacy Notice. 
7.2 You must ensure the individual concerned is aware of the various matters detailed in this Privacy Notice, as those matters relate to that individual, including our identity, how to contact us, the way in which we collect and use personal data and our personal data disclosure practices, that individual's right to obtain access to the personal data and make complaints about the handling of the personal data, and the consequences if the personal data is not provided.

8.1 It is important that the personal data we hold about you is accurate and current and we take all reasonable precautions to ensure that this is the case but we do not undertake to check or verify the accuracy of personal data provided by you.  Please keep us informed if your personal data changes during your relationship with us . We will not be responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete personal data that you provide to us.
 

9.1 It is possible that personal data we collect from you may be transferred, stored and/or processed outside the European Economic Area. In particular, where you are booking a holiday to a destination outside of the European Economic Area, we may need to transfer your personal data to that destination as is necessary for the conclusion or performance of the contract concluded in your interests between us (in other words, in order for us to provide you with the holiday you have requested).
9.2 In connection with transfers of personal data outside of the European Economic Area, we shall take such steps as are necessary for compliance with the General Data Protection Regulation (EU) 2016/679, for example ensuring that:
9.2.1 the relevant safeguard in place is the standard data protection contractual clauses between us and the recipient. or
9.2.2 any such transfer is made on the basis of an adequacy decision, namely:
(a) the Privacy Shield for transfers to the US; or
(b) the European Commission has decided that the relevant non-EU country ensures an adequate level of protection.
We ensure that we only keep your personal data for the minimum period as is necessary for us to abide by our relevant legal obligations and we will act in accordance with any group data retention policy mandated by our parent company which is place from time to time. In relation to personal data relating to your bookings with us, we will store your personal data for 8 years from your departure date.  In relation to personal data relating to marketing, we will store your personal data for 8 years from your last interaction with us.  We keep the length of time that we hold your personal data under review. These reviews take place annually.
11.1 In certain circumstances the provision of personal data by you is a requirement:
11.1.1 to comply with the law or a contract; or 
11.1.2 necessary to enter into a contract. 
11.2 You are required to provide personal data which is necessary to comply with the law and the consequences of failing to provide your personal data are the inability for us to fulfill your product or service request.
11.3 It is your choice as to whether you provide us with your personal data necessary to enter into a contract or as part of a contractual requirement. If you do not provide your personal data then the consequences of failing to provide your personal data are that we may not be able to perform to the level you expect under our contract with you. An example of this would be where we are unable to provide you with certain products or services as we do not have your full details, or where we cannot perform our contract with you at all because we rely on the personal data you provide in order to do so. Please see here for further information.
12.1 Subject to applicable law including relevant data protection laws, in addition to your ability to withdraw any consent you have given to our processing your personal data (see section 5.2.3), you may have a number of rights in connection with the processing of your personal data, including:
12.1.1 the right to request access to your personal data that we process or control; 
12.1.2 the right to request rectification of any inaccuracies in your personal data or, taking into account the purposes of our processing, to request that incomplete data is completed;
12.1.3 the right to request, on legitimate grounds as specified in law:
(a) erasure of your personal data that we process or control; or
(b) restriction of processing of your personal data that we process or control;
12.1.4 the right to object, on legitimate grounds as specified in law, to the processing of your personal data; 
12.1.5 the right to receive your personal data in a structured, commonly used and machine-readable format and to have your personal data transferred to another controller, to the extent applicable in law; and
12.1.6 the right to lodge complaints regarding the processing of your personal data with the Information Commissioner’s Office or other relevant supervisory body. Please see https://ico.org.uk/concerns/ for how to do this.
If you would like to exercise any of the rights set out above, please contact us using the contact details set out in section 2.

13.1 This policy only applies to us. If you link to another website from our website, you should remember to read and understand that website’s privacy policy as well. We do not control unconnected third-party websites and are not responsible for any use of your personal data that is made by unconnected third party websites.

Corfu Villas Limited, trading as CV Villas, as controller, processes your data in order to contact you. This information therefore applies to personal data provided to CV Villas in the course of its business or other activities by post, telephone, fax, e-mail or online. Through this data protection information, we would like to inform you about the scope and purpose of the processing as well as your rights as a data subject. 

Persons who provide personal data of others to us must ensure that the data subjects agree to the provision and are informed about how personal data may be processed by us and what rights data subjects have.

(Status: August 2022).

1. Purposes and legal basis of the processing of personal data  

1.1 Establishing contact within the scope of a business relationship 

For the initiation or implementation of a business relationship, we will process your contact data (name, address, telephone number and e-mail address), communication data (e.g. correspondence by e-mail) and, if applicable, location data (IP address).

The legal basis for this processing of your personal data is Art. 6 para. 1 lit. a GDPR (your consent) and lit. b GDPR (pre-contractual measures, performance of contract) if we receive the data directly from you or enter into a direct contractual relationship with you.

If you are not an existing or potential business partner yourself, we have usually received your contact details from our business partner who has named you as a contact person. In this case, the processing of your data is based on Art. 6 para. 1 lit. f GDPR (balancing of interests, based on our legitimate interest in contacting existing or potential business partners). 

The provision of personal data about you for the purpose of contacting you in the context of a business relationship is on a voluntary basis. Insofar as your contact data is absolutely necessary for the initiation and fulfilment of a contract, you must disclose your contact data, otherwise the contract with you cannot be concluded.

1.2 Establishing contact within the framework of our public relations work 

We also maintain databases with contact details of political, media and press representatives, among others, in order to be able to contact them on relevant issues, events, etc. as part of our public relations work.  

The processing of your personal data is based on your consent (Article 6 paragraph 1 lit. a GDPR), which you can give to us in personal contact (e.g. by handing over your business card or via online form). For your right to withdraw consent, please see point 5.8. 

We also collect contact details from public sources and enter them in our databases. The legal basis for the data processing described is Art. 6 para. 1 lit. f GDPR. (Weighing of interests, based on our legitimate interest in contacting political, media and press representatives, among others, as part of our public relations work).


2. Recipients of personal data 

As a general rule, your data collected by us will not be disclosed to unauthorised persons.  

However, in some cases we use service providers to process personal data, including for sending emails, chats and video telephony. Your data (contact data, communication data, location data (IP address) is stored in a secure data center and databases.  

All service providers have been carefully selected and are subject to data protection agreements with us. The service providers are only given access to your data to the extent and for the period required to provide the services or to the extent that you have consented to the data processing and use.  

We also use service providers located in third countries outside the European Union to process your data. Countries outside the European Union handle the protection of personal data differently than countries within the European Union. There is currently no decision by the EU Commission that these third countries generally offer an adequate level of protection. We have therefore taken special measures to ensure that your data is processed in the third countries as securely as within the European Union. With service providers in third countries, we conclude the data protection contract (standard contractual clauses) provided by the Commission of the European Union for the processing of personal data in third countries or implement other permissible guarantees or legally permissible exceptions from Art. 49 GDPR. This provides appropriate safeguards for the protection of your data with service providers in the third country. You can request a copy of these guarantees using the contact details above.

3. Storage period; deletion periods 

We store the data processed by you for as long as it is required to achieve the purpose and a legal basis exists. When this ceases to apply, your data will generally be deleted within 3 months. In addition, your data will be stored/not deleted for as long as contractual or statutory retention periods exist for them. These amount to a maximum of 7 years in accordance with UK Law.

4. Automated decision-making; profiling 

We do not use your personal data for automated decision-making or profiling.

5. Your data subject rights 

Insofar as CV Villas processes your personal data, you as the data subject are entitled to the following data subject rights, subject to the requirements of data protection law.  

5.1 Information  

You can request information about your personal data processed by us (Art. 15 GDPR). 

5.2 Correction  

If your information is not (or no longer) accurate, you can request that your data be corrected. If your data is incomplete, you can request that it be completed (Art. 16 GDPR). 

5.3 Deletion  

You have the right to request the deletion of your data. Please note that a right to erasure depends on the existence of a legitimate purpose. In addition, there must be no regulations that oblige us to retain your data (Art. 17 GDPR). 

5.4 Restriction of processing  

You have the right to request the restriction of the processing of your data. Please note that a claim to restriction of processing depends on the existence of a legitimate purpose (Art. 18 GDPR). 

5.5 Objection

If data is collected on the basis of Art. 6(1)(f) GDPR (data processing to protect overriding legitimate interests), you have the right to object to the processing of your data on grounds relating to your particular situation. In the event of an objection, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the assertion, exercise or defence of legal claims (Art. 21 GDPR).  

5.6 Right of appeal

You have the right to lodge a complaint with the Information Commissioner’s Office (https://ico.org.uk/) if you do not agree with the processing of your data (Art. 77 GDPR). 

5.7 Data portability  

You have the right to receive personal data that you have provided to us in an electronic format (Art. 20 GDPR). 

5.8 Revocation of your consent 

You have the right to revoke consent (Art. 6(1)(a) GDPR) to the processing of your data which you have given to us at any time. Your personal data will be deleted on the basis of your consent as soon as the purpose has been fulfilled or until revocation and when prior-rating retention periods have expired.

The easiest way to revoke consent you have given is to send an email to the contact details below. The revocation of consent does not affect the lawfulness of the processing of your data carried out until the revocation.

6. Contact details of the data protection officer 

Data protection officer 

Marketing@cvvillas.com