This Privacy Policy explains how Guestin EE, owner of the Guestin™ trademark, collects, processes, stores and protects personal data in connection with the operation of the Guestin™ platform, which connects accommodation providers (hotels and short-term rentals) with local cafés/restaurants for the provision of breakfast via QR code. Data processing is governed by Regulation (EU) 2016/679 (GDPR) and Greek law, as in force.

Company Name: Guestin EE
Business Activity: Web Portal Content Services
Registered Office: Leoforos Dimokratias 4-6, Neo Psychiko, 15451, Greece
Tax ID (AFM): 803219460 – Tax Office: KEFODE Attikis
Company Registration No. (GEMI): 192371503000
Phone: +30 697 028 2898
Email: info@guestin.com

Guestin collects and processes the following categories of data:

• Identification details (full name, contact details)
• Booking details (stay dates, number of guests, QR codes)
• Validation data at partner cafés/restaurants
• Technical data (IP address, cookies, device data)

Data is processed for the following purposes:

• Issuance and validation of QR codes
• Connecting accommodation providers with partner cafés/restaurants
• Financial reconciliation and settlement of transactions
• Improving the user experience
• Compliance with legal obligations

Processing of data is based on one or more of the following legal grounds, depending on the case:

• Performance of a contract with the data subject
• Legitimate interest of Guestin or a third party
• Compliance with a legal obligation
• Consent of the data subject, where required

Personal data is retained only for as long as necessary for each purpose of processing, as set out below, after which it is securely deleted or anonymised:

Data Category	Retention Period	Basis
Reservation / guest data (name, room, breakfast)	Up to 18 months from the stay	Business purpose / statute of limitations for claims
Invoices, receipts, accounting records	5 years (may be extended up to 10 years depending on the case)	Greek Tax Procedures Code
Marketing / communication consent data	Until consent is withdrawn	Article 7 GDPR
Audit logs / system security logs	12 months	Information systems security

Data may be shared, to the extent necessary, with the following recipients:

• Partner cafés/restaurants
• Payment service providers (e.g. Stripe)
• Hosting service providers
• Public authorities, where required by law

Any transfer of data outside the European Union/European Economic Area is carried out only on the basis of Standard Contractual Clauses (SCCs), European Commission adequacy decisions, or other additional safeguards.

Every data subject has the right of access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, and objection to processing. Data subjects also have the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

Guestin implements appropriate technical and organisational measures to protect data, including:

• Data encryption
• Role-based access control
• Multi-Factor Authentication (MFA)
• Regular security audits
• Secure data hosting infrastructure

The Guestin™ platform may use cookies and similar technologies to ensure its proper functioning, analyse traffic, and improve the user experience. Users may manage their cookie preferences through their browser settings.

For any query regarding the processing of personal data, or to exercise the rights set out above, you may contact us at: info@guestin.com.
You also retain the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA), www.dpa.gr.