Personal Data Notice (GDPR & KVKK)

This notice explains how Serenity Spa Zante processes your personal data when you use spazante.com. It is written to meet the transparency requirements of the EU General Data Protection Regulation (GDPR) and, for visitors from Türkiye, the Turkish Personal Data Protection Law No. 6698 (KVKK).

1. Data controller

Serenity Spa Zante
Tragaki Zakynthos, Greece
E-mail: [email protected]
Telephone: +30 697 060 0520

2. What data we process

Contact form: name, e-mail address, subject and the message you write.
Messages by WhatsApp, phone or e-mail: the details you choose to send us, such as your name, phone number and booking preferences.
Technical data: IP address, browser type and cookie choices, processed to keep the site secure and working.
Optional analytics and marketing cookies: only if you accept them in the cookie banner (see our Cookie Policy).

3. Why we process it and on what legal basis

To answer your enquiry or booking request — performance of a contract or steps taken at your request (GDPR Art. 6(1)(b); KVKK Art. 5/2-c).
To keep the website secure and to improve it — our legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5/2-f).
Analytics and marketing cookies — your consent (GDPR Art. 6(1)(a); KVKK Art. 5/1), which you can withdraw at any time.
Compliance with legal obligations, such as tax or accounting rules.

4. Who receives your data

We do not sell your data. It may be handled by service providers that act on our behalf — for example our web hosting provider and the e-mail delivery service that sends us your contact-form messages — and by public authorities where the law requires it. Where a provider is outside the European Economic Area, the transfer relies on appropriate safeguards.

5. How long we keep it

Contact-form messages are kept for as long as needed to answer you and to handle any follow-up, and afterwards only as long as the law requires or our legitimate interests justify. Cookie choices are stored for up to 12 months.

6. Your rights

You have the right to access your data, have it corrected or erased, restrict or object to its processing, receive it in a portable format and withdraw your consent at any time (GDPR Arts. 15–21; KVKK Art. 11). To exercise your rights, write to [email protected]. We will reply within one month.

7. Complaints

If you believe your data is not handled correctly, you may complain to the Hellenic Data Protection Authority (www.dpa.gr) or, for KVKK matters, to the Turkish Personal Data Protection Authority (www.kvkk.gov.tr).

Last updated: October 2026.