Privacy Statement

Scope of this Privacy Policy

Ora Hospitality Limited (hereinafter referred as “We”, or “Us”), located at Register02, Floor 11, Al Maqam Tower, Abu Dhabi Global Market Square, Abu Dhabi, Al Maryah Island guarantees, the safety and protection of your personal data, which are collected through its various websites (https://www.oradevelopers.com/hospitality) and (https://www.silversandscollection.com/) (hereinafter ”Website”). We publish the present lawful, transparent and fair Privacy Policy, in order to provide sufficient information on the personal data we collect and further process in the context of operation of its Website. The Hotel in its capacity as Data Controller, collects and processes your personal data, only to the extent necessary, for specific and legitimate purposes, in compliance with the applicable EU and National Data Protection Legislation.

Definitions
For the purposes of this Policy, the following terms should apply:

“Personal Data”: any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person,
“Special Categories of Personal Data”: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation,
 “Processing”: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, on personal data or on sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction,
“Controller”: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law,
“Processor”: a natural or legal person, public authority, agency or other body that processes personal data on behalf of the Controller,
“Data Subject”: the natural person whose personal data are processed. The data subjects this Policy refers to are the users of our website.
“Consent of the data subject”: any freely given, specific, explicit, informed and unambiguous indication of the data subject’s wishes by which he or she by a statement or by clear affirmative action, signifies agreement to the processing of personal data relating to him or her,
“Personal Data Breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access to personal data transmitted, stored or otherwise processed,
“Anonymisation”: the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject,
“Pseudonymisation”: the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person,
“Existing Legislation”: the provisions of the existing Greek and EU legislation which is applicable to US which regulates matters of protection of personal data, such as the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as "GDPR"), the Greek Law 4624/2019, the Greek Law 3671/2006, the case law of the Court of Justice of the European Union (hereinafter "CJEU") as well as the Decisions, Directives and Opinions of the European Data Protection Board (hereinafter "EDPB") and the Hellenic Data Protection Authority (hereinafter "HDPA”), as well as any further applicable laws regulating data privacy matters.

Types of Personal Data we collect - Purpose of processing - Legal Basis

We ensure that we collect, store and process only the necessary information in order to provide you with high-quality services. More specifically, we collect your personal data for the following purposes and based on the following legal bases:

Α. Data related to Guests
A.1. Data collected for booking purposes

Online booking engine through our website:
In case you make a booking reservation through our website, we will collect your name and surname, address, city, country, telephone, email, any special requests or preferences you may have, preferred payment method, your credit card details (card type, card number, security code, expiration date, name of card owner), arrival and departure date.

Booking confirmation form:
If you contact us directly, to make a reservation, we will send you the booking confirmation form in order to provide us the necessary information, such as name and surname, address, telephone, email, preferred payment method, your credit card details (i.e. card type, card number, expiration date, name of card owner).

Third parties’ online booking engines and/or travel agents:
In this case, we receive an email confirming your booking, including information such as your name and surname, country, preferred payment method, arrival date and departure date, flight details in case of transfer, any (family) members that will accompany you, any special requests (i.e. requirement for transportation, declaration of special preferences and/or allergies that we should be aware of).
Apart from the above, for the completion of your reservation, we may collect further information, such as your Tax Identification Number, Nationality, details of national identification documents (e.g. Identity, passport, driving license) etc.

A.1.1. Purposes of processing – legal basis

We collect your booking data in order to:

Process and complete your booking reservation. Our legal basis is the performance of a contract with you.
Process the payment of the relevant services, fees and charges. Our legal basis is that processing is necessary for the performance of a contract with you.
Ensure the security of our financial transactions. Our legal basis is our legitimate interest.
Collect and recover money owed to us. Our legal basis is our legitimate interest.
Process your details in case of disputes. Our legal basis is our legitimate interest.
Contact you to organize and facilitate your stay. Our legal basis is that processing is necessary for the performance of a contract with you.

A.2. Registration Data – Check-in procedure

Check-in procedure:
During your arrival at our various properties, you will provide us with the necessary information to complete the check-in procedure. More specifically, we collect personal data such as your title, your first and last name, your language, your address (street, postcode, city, country), your nationality, Tax Identification Number, your telephone number, your email address, names of any (family) members that will accompany you and their date of birth, your date of birth, passport/ID number, car plate, preferred payment method, your credit card details, arrival date and departure date as well room number.

Allergies/Special Preferences Declaration:
Allergies and special preferences may constitute special category of personal data. We may collect information relating to allergies, dietary requirements or other preferences only where you voluntarily choose to provide it to us, based on your explicit consent. In such cases, we may process your name, surname, arrival and departure dates, room number and details of the relevant allergy or preference in order to accommodate your needs, ensure your safety and provide a personalized guest experience during your stay.

A.2.1. Purposes of processing – legal basis

We collect your registration data for:

Completion of the check-in procedure in terms of offering you accommodation. Our legal basis is that processing is necessary for the performance of the contract with you.
Completion of the guest registration and check-in procedures, provision of accommodation services, and compliance with applicable legal obligations, which require the collection and verification of guests' identification data.
In case you wish to record your allergies/preferences information, we will proceed to relevant processing based on your explicit consent.
Facilitating administration and security of financial transactions. Our legal basis is our legitimate interest.
Facilitating payment procedure. Payment information is necessary in order to issue your invoice and comply with fiscal obligations.
Offering you personalized services (regarding preferences etc.). Our legal basis is your prior consent, if provided.

Communication channels (E-concierge services)
Moreover, upon your arrival at our premises, you may wish to benefit from our E-concierge services to contact us for any requests you may have during your stay and to have timely and easy access to useful information about our premises and services. In case you wish to contact us through communication platforms, we may collect your (as well as any further guests you add in the communication channel) phone number, name and room number, as well as any further information you provide us to facilitate your stay and serve your needs.

A.2.2. Purposes of processing – legal basis
We collect your registration data for:

Completion of the check-in procedure. Our legal basis is that processing is necessary for the performance of a contract with you.
Completion of the registration procedure. Identification data is necessary in order to comply with our legal obligations
Offering you accommodation. Our legal basis is our legitimate interest. In case you wish to record your allergies/preferences information, we will proceed to relevant processing if you provide us your consent.
Facilitating administration and ensuring the security of our financial transactions. Our legal basis is our legitimate interest.
Facilitating payment procedure. Payment information is necessary in order to issue your invoice and comply with fiscal obligations.
Improving the quality of our services and enhance guests’ experience. Our legal basis is our legitimate interest.
Offering you personalized services (regarding preferences etc.). Our legal basis is your prior consent, if provided.
Promoting our special offers and goods, services or forthcoming events or promotions which may interest you. Our legal basis is your prior consent, if provided.
For communication with you, in the context of providing you with useful information about our premises and services, as well as to meet any of your needs and requests. Our legal basis is the fulfillment of our contract and our legitimate interest.
Protection of the health of our guests and our employees. The processing of such information is necessary for reasons of public interest in the area of public health.

Data collected through our website or online platforms

A.3. Personal Data Collected via your registration to our Newsletter
When you register to receive our newsletter, we collect and store your email address and if you wish you can submit your name and surname.

A.3.1. Purposes of processing – legal basis
We use data you provide us with when you register to our Newsletter for:
• Receiving newsletters about our services, products and offers. We will proceed with relevant processing if you provide us with your consent. You may withdraw your consent at any time by using the unsubscribe link included in every communication.

A.3.2. Personal Data Collected through “Contact Us” form
When you reach us through our dedicated “Contact Us” form via our website, we collect your email address name, surname and telephone, as well as any information that you include in your message to us.

A.3.3. Purposes of processing – legal basis
We collect and process the information you will provide through the communication form with the sole purpose of serving and contacting you in order to satisfy your request, respond to your question etc. The legal basis of processing is Our legitimate interest to improve our services and satisfy any requests submitted to Us [GDPR art. 6 (1f)].

A.4. Profiling
We may analyse information relating to your interactions and preferences in order to better understand and improve our services. However, we do not make decisions concerning you based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on you.

When we use profiling for the provision of tailor made offers and services (not wholly automated decision making), you always have the right to object to such processing (including profiling) that is related to direct marketing at any time by submitting your request to our DPO contact details, as further described below (Data Subject Rights).

A.4.1. Purposes of processing – legal basis
We may use your personal data to:

Analyze aspects concerning your personal travelling preferences and interests. Our legal basis is the legitimate interest in providing services of higher quality to our guests.
Customize personalized services ahead of, during or after your stay with us. Our legal basis is the legitimate interest in providing services of high quality to our guests.
Provide you with direct marketing services. We will proceed to relevant processing if you provide us your consent.

B. Job Applicants & Employees

B.1. Job Applicants

If you apply for a job vacancy, we will collect and process only the personal data necessary to assess your qualifications, experience and suitability for the relevant position (e.g. name, surname, contact details, education, working experience etc.). We collect these data when you submit an application by any means (e.g. by sending an email to the Hotel’s email address, using recruitment platforms, accessing through the Hotel’s website), as well as through the documents you enclose with your application (e.g. CV, certificates etc.). When you include into your application the contact details of your previous employers, we may contact them, so as to provide us with information about your position, collaboration with them and their evaluation for you.

B.1.1. Purposes of processing – legal basis
We collect your data in order to:

Assess your application. Our legal basis is our legitimate interest.
Maintain your CV and assess its suitability for relevant vacancies in our Hotel. Our legal basis is our legitimate interest.
Contact with your previous employers, so as to receive feedback about your former professional experiences. Our legal basis is our legitimate interest.

B.2. Employees
We collect and process personal data that is necessary for the establishment, administration and management of the employment relationship, as well as for the fulfilment of the employee's duties and the Hotel's obligations under the relevant employment agreement and applicable law. Indicatively, such data may include the name, surname, forenames, date of birth, place of birth, gender, nationality, home address, e-mail address, contact telephone numbers, ID number, Tax Identification Number, Social Security Number and other insurance registry numbers, health booklet, criminal record (if required by the relevant position, permitted by applicable law and subject to appropriate safeguards), work permit, bank account number (IBAN), CV, education diploma, health, marital status and data of depending members of the family, data on your education and training, on your working experience, as applicable for the exercise of our statutory obligations.

We always provide you with a relevant privacy notice as an Annex to our Agreement, respecting your privacy and your respective rights.

B.2.1. Purposes of processing – legal basis
We collect your data in order to:

Manage, perform and administer our contractual relationship and the fulfilment of obligations arising from our agreements. Our legal basis is the need to process your data in the context of our contractual obligation or during the pre-contractual stage.
Fulfill our legal obligations as employers. Our legal basis is the need to process your data in compliance with a legal obligation.
Use your photos to upload them to the website. We will proceed to relevant processing if you provide us your consent.
Comply with our legal obligations, as necessary for the protection of the public interest in the area of public health.

Data we collect automatically – Cookies policy
When you use our website, certain information is collected automatically, which may constitute personal data. Such data may include your language settings, IP address, location, device settings, device operating system, activity data, time of use, redirect URL, status reports, user information (information about browser version), operating system, browsing result (single visitor or registered customer), browsing history and the type of content viewed. We may also collect data through cookies. For more information regarding the use of cookies, click here.

Minors Data
We do not knowingly collect personal data directly from individuals under the age of 18. Where the processing of a minor's personal data is necessary, we seek to obtain such information from the minor's parent or legal guardian and, where required, the appropriate consent. As we may not always be able to verify the age of individuals accessing our website or services, we encourage parents and guardians to contact us if they believe that a minor has provided personal data without authorization, so that we can take appropriate steps, including deleting such information where necessary.

Transfer of Personal Data
We may transfer the abovementioned personal data to third parties, to whom it has entrusted the processing of personal data on its behalf, (such as service companies, website developers etc.).
In any case, all third parties to whom your personal data may be transferred are contractually bound to us in order to ensure the obligation of confidentiality and are subject to all the obligations deriving from the Existing Legislation for the protection of personal data.
At the same time, the personal data of the data subjects may be transferred to public authorities, independent authorities, or other relevant entities when required for compliance with legal obligations of Ora Hospitality.

When the transfer of data concerns a country outside the European Union (EU) or the European Economic Area (EEA), we always check whether:

The Commission has issued an adequacy decision on the third country to which the transfer is addressed to.
Appropriate safeguards are in place in accordance with the Regulation for the transfer of such data.

In any other case, the transfer to a third country is not allowed and we may not transfer personal data unless any of the specific derogations provided for in the Regulation apply (e.g. explicit consent of the data subject, upon informing him/her on the risks of the transfer, the transfer is necessary for the performance of a contract at the request of the subject, there are reasons of public interest, it is necessary to support the legal claims and the vital interests of the subject etc.).

Data Retention Period
Your personal data collected and processed by our Hotel are retained for a pre-determined and limited period depending on the purpose of processing. When this time period expires, they are securely deleted and/or destroyed from our databases, unless their further retention is permitted or required by law. Where the processing is imposed as an obligation by applicable legislation or where a specific retention period is foreseen, your personal data will be stored for as long as the relevant provisions require. If your personal data are processed for the performance of a contract, they are retained as long as it is necessary for the performance of the contract and the establishment, exercise or defense of legal claims based on the contract. The personal data processed for commercial purposes on the grounds of the user’s prior consent are retained until the withdrawal of the consent whereas such withdrawal does not affect the lawfulness of the processing until the withdrawal.

Data Privacy and Security
Taking into account the latest updates, implementation costs and nature, scope and purposes of processing, as well as the risks of different probability of occurrence and seriousness of the rights and freedoms of users from processing, the Hotel takes the necessary technical and organizational measures to protect users' personal data. However, it is noted that no electronic data transfer or storage method is 100% secure. Nevertheless, the Hotel takes all necessary security measures (antivirus, firewall).

Third - Party Websites Disclaimer
The Website may include hyperlinks which redirect to third-party websites as a convenience to our users, as well as widgets of social media platforms. We do not control third-party websites and is not responsible for the content of any such websites or any hyperlink contained therein. The Hotel is neither responsible for the privacy practices or the content of third-party websites nor for the processing of the users’ personal data appearing on the links.

Data Protection Officer
In order to secure sufficiently the privacy and integrity of the personal data processed, we have appointed a Data Protection Officer (“DPO”) to which the data subjects can make their requests and their questions about the privacy of their personal data and the current Privacy Policy as well as to perform their rights hereinafter. The contact details are as follows: Email: [email protected]

Rights of Data Subjects
We ensure and take the appropriate measures for the data subjects to be able to exercise their rights, as provided by national and EU legislation regarding the collection and processing of personal data concerning them. Each data subject has the following rights:

To be informed of the processing of your personal data and to request to obtain further information on the processing applied,
To request the rectification of your personal data in case of inaccurate information,
To request the deletion of your personal data if they are not necessary for the purposes for which they were collected and if their retention is not based on any legitimate interest of the Hotel,
To request the limitation of the processing of your personal data,
To request the portability of your personal data either to yourself or to third parties,
To withdraw at any time the consent given for the processing of your personal data,
To object at any time to further processing of your data.

The Hotel may refuse to fully or partially satisfy a data subject’s request only when this possibility is provided by the Regulation or by national law.

In the event you exercise any of the above-mentioned rights, the Hotel will respond without undue delay and in any case within thirty (30) days from the submission of your request and following the data subject’s identification. This period can be extended by two (2) more months, if necessary, if the request is complex or in case of numerous requests. In this case, the Hotel is obliged, within one month of the receipt of that request, to inform the data subject about the delay and the reasons of the delay. Within that period, the Hotel shall also inform the data subject of possible refusal to fully or partially satisfy the request as well as for the motives of the refusal.

If the data subject submits the request by electronic means, the information shall be provided, if possible, by electronic means, unless the data subject requests differently.

If the data subject's request is manifestly unfounded or excessive, in particular because of its repetitive character, the Hotel may charge a reasonable fee in order to satisfy the request or refuse to respond to the request.

To exercise your rights, you may contact Ora Hospitality DPO at [email protected]

Updates to the Privacy Policy
This Privacy Policy may be amended or revised in the future, to ensure the ongoing regulatory compliance of and to reflect improvements or updates of the website's services. Updated versions will be uploaded to our website and will bear the relevant date so that you are always informed of when our Privacy Policy was last updated.

Revised: September 2026