Privacy Policy

Current version publication date: 17/6/2025

The company under the trade name “KNOWLEDGE S.A.” and the distinctive title “KNOWLEDGE”, based in Patras (37, N.E.O. Patron-Athinon), with Tax Registration Number (AFM) 998688081, General Commercial Registry (G.E.MI.) No. 034785016000, and MHTE No. 0414E70000123001, hereinafter referred to as the “Company”, hereby provides you, either as a Personal Data Controller or as a Data Processor on behalf of Personal Data Controllers, within the framework of the General Data Protection Regulation (EU) 2016/679, effective since 25/05/2018 and as currently in force, hereinafter referred to as the “GDPR”, with the following information regarding the processing of your personal data and your rights as a data subject.

Obligation to Protect Personal Data

The Company is committed to protecting the personal data of visitors and/or users (registered or not) of the Company’s websites (extranet.bookoncloud.com, www.bookoncloud.com) and to complying with the provisions of the applicable legislation on personal data protection, as currently in force. The Company does not collect information regarding the personal data of visitors/users unless they provide it voluntarily. Personal data is requested by the Company only for the specific and defined purposes mentioned herein or disclosed by any appropriate means at the time it is provided.

Personal and Corporate Data that the Company may collect

The information constituting personal data that we may collect is as follows:

  • BookonCloud Accommodation Owner
    • Data: Accommodation Name, Logo, Address and location coordinates, Contact Details (Email, Telephone, Fax, Website, SkypeId), Communication Languages, Accommodation Articles, Business Characteristics (Amenities, Facilities), Description and photos of room types, Description of Price Lists and Accommodation Policies, Bank Accounts (IBAN), MHTE number.
    • Purpose: Display of details on the accommodation’s booking page.
    • Retention Period: Until deleted by the accommodation owner themselves or until they request the deactivation of services and deletion of data.
  • BookonCloud Accommodation Owner
    • Data: Google Analytics Key & Profile Id.
    • Purpose: Recording and displaying analytics data from the booking page.
    • Retention Period: Until deleted by the accommodation owner themselves or until they request the deactivation of services and deletion of data.
  • BookonCloud Accommodation Owner
    • Data: Cookie with the last managed accommodation.
    • Purpose: Direct login to the accommodation accessed last time (for owners of multiple accommodations).
    • Retention Period: A few hours.
  • BookonCloud Accommodation Owner
    • Data: Merchant ID and password.
    • Purpose: Use of credentials (merchant ID and password) for authenticated communication with the cooperating bank’s API, in order to generate a unique link (URL) for completing the customer’s payment through the bank’s secure environment.
    • Retention Period: Until deleted by the accommodation owner themselves or until they request the deactivation of services and deletion of data.
  • BookonCloud Accommodation Customer
    • Data: First and Last Name, Date of Birth, Email, Telephone, Mobile Phone, Address, Tax Registration Number (AFM), Social Security Number (AMKA), Identity Card Number (A.D.T.), Bookings at the accommodation (Arrival, Cost, Room Type).
    • Purpose: Provided by the customer themselves on the booking page or at the Channel Manager points of sale to update the accommodation, or filled in by the accommodation owner in the management back-office.
    • Retention Period: Until deleted by the accommodation owner or until they request the deactivation of services and deletion of data.
  • BookonCloud Accommodation Customer
    • Data: Credit Card Details.
    • Purpose: Use by the accommodation owner to confirm and settle the booking.
    • Retention Period: Deleted from the system after 10 days.

All the above information is provided either directly by the data subjects or by third parties – data controllers who lawfully possess and process it, either when they or we communicate with them for the first time, or when they transact with us or with third parties through the Company’s websites and webpages and the services, programs, and tools provided through them, or when they visit and navigate the Company’s websites and webpages. The provision of the above information may take place at various times and by various means, such as via a printed or electronic form, telephone, or email, through a member of our staff or our partner, or through the employer or a member of staff of the data subject or the third-party data controller or their partner. Alternatively, we may collect information concerning the data subject, for example, when either the data subject themselves or a third-party data controller who lawfully possesses and processes personal data of the data subject:

  • requests information or submits a request, query, etc., through our websites or in any other way using the Company’s contact details,
  • subscribes to the information service (newsletter, etc.) or to any promotional activity or survey of the Company,
  • registers and/or creates an account to use the services provided by the Company through its websites and webpages, where the registered user is given the possibility to post content,
  • the Company’s staff visits websites where the data subject has posted and made the above information publicly available.

Purpose for which the Company collects and processes personal data

The Company uses the personal data it collects for the following purposes:

  • Correspondence and communication of the Company to facilitate the exercise of its commercial activity and the execution of its transactions.
  • Conclusion and execution of service provision contracts.
  • Sending informative material and promotional actions.

Legal basis for processing

The Company processes the personal data it collects under any of the following legal bases for processing, as applicable:

  • The processing constitutes a legal or contractual obligation of the Company.
  • The processing is necessary for entering into or executing a contract of the Company or for carrying out and processing transactions of the Company within the framework of its commercial activity.
  • The processing serves the operational needs and the business and commercial interests of the Company, such as compliance with our contractual and legal obligations, defense-legal protection and the exercise of its rights, or informing about and promoting the Company’s services.
  • The data subject has previously given specific, explicit, and concrete consent to the processing of their personal data in a specific manner and for a specific purpose.

Disclosure of personal data

The Company may disclose the personal data it collects to third parties only in the following cases:

  • To the staff or partners of the Company who need to know it to perform their duties and/or provide their services to the Company, within the framework of our Company’s commercial activity and pursuant to a relevant contract that includes specific terms, commitments, and obligations for the protection of personal data with these persons.
  • In the event that disclosure is mandatory by law or arises from an order, decision, investigation, or audit of any competent administrative, judicial, police, or other authority, etc.
  • The data subject has previously given specific and concrete consent to the disclosure of their personal data in a specific manner and for a specific purpose.

The Company does not transfer personal data to countries outside the European Economic Area. However, in the event that it transfers personal data to third countries, this transfer will only be made to third parties with whom it has signed/adhered to the new Standard Contractual Clauses set by the European Commission’s Implementing Decision 2021/914 of June 4, 2021, and who will provide the necessary level of protection for personal data exported outside the EU, in accordance with the terms of the GDPR and the Standard Contractual Clauses.

Retention period of your personal data

The Company retains the personal data it collects for as long as required in each case to fulfill the purpose of its collection, as well as for any additional time required by any applicable legislation or upon prior written and specific consent of the data subject. When the owner of an accommodation requests the deactivation of their account, the Company provides a period of 10 days within which the accommodation owner can download all their account information and data (see right to portability below). After the expiration of this period and the deactivation of the account, the Company deletes all data of the respective account.

Security of personal data

The Company takes all appropriate organizational and technical measures for data security and its protection against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access, and any other form of unlawful processing.

Rights of the data subject

In summary, the data subject has the following rights against the Company:

  1. Right to information: To be provided, in addition to what is stated in this Privacy Notice, with information regarding how the Company uses their personal data and regarding their rights.
  2. Right of access: To gain access to their own personal data and to information concerning them, such as the purposes of processing, the categories of data, the origin, and any recipients thereof.
  3. Right to rectification: To correct their personal data if it is inaccurate or incomplete.
  4. Right to erasure (Right to be forgotten): To request the erasure of their personal data when it is no longer necessary in relation to the purposes of processing, or there is no legal ground for the Company to continue using it, or if they have withdrawn their consent.
  5. Right to restriction of processing: To restrict, in certain cases, the further processing of their personal data.
  6. Right to data portability: To receive the personal data concerning them and/or request the Company to transmit it to another data controller.
  7. Right to object: To object, at any time, to the processing of their personal data for reasons related to a task carried out in the public interest or in the exercise of official authority, or the existence of a legitimate interest, following a balancing of interests, including profiling. It is noted that the Company does not engage in profiling and automated individual decision-making based on it.

For any questions or queries regarding the use of personal data, the Company will make every effort to respond in writing to the data subject within thirty (30) days from the date of submission of the request. Within the same period, the Company will inform the subject in case serious reasons do not allow the Company to respond to the request.

In any case, the provision of information is free of charge, except in cases of manifestly unfounded, excessive, or repeated requests, where a reasonable fee may be charged to cover the Company’s administrative costs.

In all the above cases, as well as in the event of communicating with us regarding any of the above matters, you can send us your request at the email: privacy@knowledge.gr.

Changes to the Privacy Notice

The Company reserves the right to modify this Privacy Notice at any time in order to adapt it to the Company’s personal data protection policy and the applicable legislation. The publication date of the latest version will be indicated at the beginning of this notice.

Greece 2.0 - National Recovery and Resilience Plan, funded by the European Union NextGenerationEU