Privacy & Cookies Policy

Effective Date: February 25, 2026

This Privacy & Cookies Policy explains how LaGioia LTD(“we,” “us,” “our”), the operator of 26suites.com and 26 Suites Limassol, collects, uses, stores, and protects your personal data in accordance with the General Data Protection Regulation (GDPR) and the laws of the Republic of Cyprus.

1. Data Controller

LaGioia LTD
Company Registration: HE14470
7 Kalliopis, Germasogeia, Limassol 4040, Cyprus
Email: info@26suites.com
Phone: +357 97 475702

2. What Data We Collect

We collect the following categories of personal data:

  • Booking Information: Full name, email address, phone number, nationality, number of guests, arrival/departure dates, special requests.
  • Identity Verification: Government-issued ID and selfie photograph (collected via the online check-in form for regulatory compliance).
  • Payment Information: Credit/debit card details processed securely by Stripe. We do not store card numbers on our servers.
  • Billing Information: Billing name, address, city, postal code, country.
  • Communication Data: Emails, messages, and correspondence with our team.
  • Technical Data: IP address, browser type, device information, and cookies (see Section 7).

3. How We Use Your Data

We process your personal data for the following purposes:

  • Reservation Management: To process, confirm, and manage your booking (legal basis: contract performance).
  • Identity Verification: To verify guest identity and comply with Cyprus hospitality regulations (legal basis: legal obligation).
  • Payment Processing: To charge, refund, or process security deposits via Stripe (legal basis: contract performance).
  • Communication: To send booking confirmations, check-in instructions, and respond to inquiries (legal basis: contract performance).
  • Marketing: To send promotional offers and travel tips, only with your explicit consent (legal basis: consent). You may unsubscribe at any time.
  • Legal Compliance: To comply with tax, accounting, and regulatory obligations (legal basis: legal obligation).

4. Who We Share Data With

We share your personal data only with the following third parties, as necessary for the purposes described above:

  • Stripe: Payment processing (PCI DSS compliant). Stripe Privacy Policy
  • Guesty: Property management and booking technology platform. Guesty Privacy Policy
  • Email Service Providers: For sending booking confirmations and marketing communications (with consent).
  • Government Authorities: When required by law (e.g., guest registration with Cyprus authorities).

We do not sell your personal data to any third party.

5. Data Retention

  • Booking and payment records: Retained for 7 years from the date of stay, as required by Cyprus tax and accounting regulations.
  • Identity verification documents: Retained for the duration of your stay plus 1 year, or as required by local regulations.
  • Marketing data: Retained until you unsubscribe or withdraw consent.
  • Technical/cookie data: See Section 7 for cookie-specific retention periods.

6. Your Rights Under GDPR

As a data subject, you have the following rights:

  • Right of Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate or incomplete data.
  • Right to Erasure: Request deletion of your data (subject to legal retention obligations).
  • Right to Restrict Processing: Request that we limit how we use your data.
  • Right to Data Portability: Receive your data in a structured, machine-readable format.
  • Right to Object: Object to processing based on legitimate interest or for marketing purposes.
  • Right to Withdraw Consent: Withdraw consent for marketing communications at any time.

To exercise any of these rights, contact us at info@26suites.com. We will respond within 30 days. If you are unsatisfied with our response, you may lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus.

7. Cookies & Tracking

Our website uses cookies to improve your experience. Cookies are small text files stored on your device.

Types of cookies we use:

  • Essential Cookies: Required for the website and booking engine to function. Cannot be disabled.
  • Analytics Cookies: Help us understand how visitors use our site (e.g., Google Analytics). These are only set with your consent.
  • Marketing Cookies: Used to deliver relevant advertisements and track campaign performance. Only set with your consent.

Managing cookies:

You can manage your cookie preferences through our cookie consent banner, which appears when you first visit the site. You can also clear cookies through your browser settings at any time. Note that disabling essential cookies may affect the functionality of the booking system.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

  • SSL/TLS encryption for all data transmission
  • PCI DSS compliant payment processing via Stripe
  • Access controls and authentication for staff systems
  • Regular security reviews

9. International Data Transfers

Your data may be processed by service providers located outside the European Economic Area (EEA), including Stripe (USA) and Guesty (USA/Israel). Where such transfers occur, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses or adequacy decisions).

10. Changes to This Policy

We may update this Privacy & Cookies Policy from time to time. Changes will be published on this page with an updated effective date. Continued use of our services after changes constitutes acceptance.

11. Contact Us

For any questions about this policy or to exercise your data rights:

LaGioia LTD
7 Kalliopis, Germasogeia, Limassol 4040, Cyprus
Email: info@26suites.com
Phone: +357 97 475702