Privacy Notice

Last Updated: October 2025

1. Introduction

At White City Limassol, we take your privacy seriously.
This Privacy Notice explains how we collect, use, disclose, and protect your personal information when you use our booking system, website, or related online services.
Please read it carefully to understand how we handle your data and your rights under applicable law, including the EU General Data Protection Regulation (GDPR).
By accessing our booking platform or providing us with personal data, you acknowledge and agree to the practices described in this notice. We may update this Privacy Notice from time to time — please review it periodically to stay informed of any changes.

2. Who We Are

Data Controller:
White City Limasso l ICY MANAGEMENT LTD
Perikleous 4, Agia Zoni, 3031 Limassol, Cyprus
We are responsible for deciding how your personal data is collected and used.

Data Processor:
Our booking system is operated by WebHotelier (Revplus Hellas S.A.) and BOOM.

5th Km Rhodou–Lindou Ave., 85100 Rhodes, Greece
1250 E. Hallandale Beach Blvd PH#1, Hallandale Beach, FL 33009

WebHotelier and BOOM act as our Data Processors, processing data on our behalf in strict accordance with our instructions and GDPR requirements.

You may contact their Data Protection Officers at:
📧 WebHotelier – dpo@webhotelier.net
📧 BOOM – nitzan@boomnow.com

3. What Information We Collect

We collect and process personal information you provide when you:

Make a reservation through our booking engine (e.g., name, email, phone number, address, nationality).
Provide payment details to confirm or guarantee your booking.
Communicate with us through contact forms or email.
Participate in surveys, feedback, or loyalty programs.

We may also automatically collect limited technical data (e.g., browser type, IP address, device identifiers) to improve website performance and security.

4. Purpose and Legal Basis for Processing

We process your personal data for the following purposes:

To manage and confirm your booking, including payments and preferences.
To provide you with requested accommodation or related services.
To handle inquiries or support requests.
To send marketing communications (only with your explicit consent).
To comply with legal and accounting obligations.
To evaluate service quality and enhance customer experience.

Legal bases:

Contractual necessity – to perform our obligations when you make a booking.
Legal obligation – to comply with applicable laws.
Legitimate interest – to improve our services and maintain security.
Consent – for optional communications and marketing.

5. Sharing and Disclosure

We may share your personal data:

With our Data Processor (WebHotelier), who operates our booking system.
With payment providers or financial institutions for processing transactions.
With legal authorities or regulators, if required by law.
With IT or service providers that help us maintain operations under GDPR-compliant agreements.

We will never sell or rent your personal data.

6. International Data Transfers

Your data may be stored or processed outside the European Economic Area (EEA), including on Amazon Web Services (AWS) servers in the USA and Germany.
Where data is transferred outside the EEA, we ensure adequate safeguards, such as Standard Contractual Clauses or equivalent legal mechanisms.

7. Data Retention

We retain your personal data only for as long as necessary to:

Fulfil the purposes described in this notice;
Comply with legal, tax, or accounting obligations; or
Resolve disputes and enforce agreements.

After this period, your data will be securely deleted or anonymised.

8. Your Rights

Under the GDPR, you have the right to:

Access the personal data we hold about you;
Request correction of inaccurate or incomplete data;
Request deletion (“right to be forgotten”);
Restrict or object to processing;
Withdraw consent at any time (without affecting past processing);
Request data portability to another controller;
Lodge a complaint with your local Data Protection Authority.

To exercise your rights, contact us at:
📧 Office@whitecitylimassol.com

9. Security Measures

We use appropriate technical and organizational measures to protect your data from unauthorized access, alteration, loss, or misuse.
Access to personal data is limited to authorized personnel bound by confidentiality obligations.
Our Data Processor, WebHotelier, is PCI-DSS Level 2 Certified and audited monthly by Trustwave.

10. Video Surveillance (CCTV)

We operate CCTV systems in certain areas of our premises for security and safety purposes, including the protection of guests, employees, and property.

Video recordings may capture identifiable images of individuals within or around our facilities.
CCTV footage is processed under the legitimate interest legal basis (Article 6(1)(f) GDPR) to ensure the safety and security of persons and assets.
Cameras are installed only in public or common areas and never in private spaces (such as rooms, restrooms, or staff-only changing areas).
Recordings are retained for a limited period, typically up to 30 days, unless required for investigation or legal purposes.
Access to recordings is strictly limited to authorized personnel and may be shared with law enforcement authorities when legally justified.
Clear signage is displayed in all monitored areas, indicating the presence of CCTV and providing our contact details for inquiries.

For questions or to exercise your privacy rights regarding CCTV, you may contact us at:
📧 Office@whitecitylimassol.com

11. Use of Services by Minors

Our services are not directed to individuals under 16 years of age.
We do not knowingly collect personal data from minors. If we learn that a child under 16 has provided us with personal data, we will delete it immediately.

12. Contact Information

If you have any questions or concerns about this Privacy Notice or how your personal data is handled, please contact us:

White City Limassol
Perikleous 4, Agia Zoni, 3031 Limassol, Cyprus
📧 Email: Office@whitecitylimassol.com 📞 Phone: +357 97 731333