Privacy Policy | 26 Suites Limassol

Last updated: October 2026

At 26 Suites, we take your privacy seriously. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website and services. By using our website or making a booking, you agree to the practices described in this policy.

Who We Are

The controller of your personal data is LaGioia LTD, registered in Cyprus (company number HE14470), trading as 26 Suites Limassol, 7 Kalliopis, Germasogeia, Limassol 4040, Cyprus. You can reach us at [email protected].

Information We Collect

We collect information you provide directly to us when making a booking or contacting us. This includes your full name, email address, phone number, billing address, payment details, and any special requests or preferences you share. We also automatically collect certain information when you visit our website, such as your IP address, browser type, device information, pages visited, and referring URL.

What Online Check-in Collects

Before arrival every guest completes our online check-in form. It collects:

Identity documents — a photo of the passport or ID of every person staying, including children, and the document number, date of birth, nationality and expiry date read from it. We need these for the guest register that Cyprus law requires accommodation providers to keep, and to confirm who is staying.
A selfie of the main guest, which we compare with the photograph on their identity document — see Identity Verification below.
Your signature on the Guest Accommodation Agreement, together with the date, time, IP address, browser and country of each step of the form. This is the evidence that you signed, and which version of the agreement you saw.
Payment card details, which are held by our payment provider Stripe. We see only the card brand and the last four digits; we never store the card number ourselves.
Stay details — your expected arrival time, parking and vehicle registration plate, cot and extra-guest requests, and the messages you send us.

We process this information to perform our contract with you, to meet the legal obligations that apply to accommodation providers in Cyprus, and for our legitimate interest in preventing fraud and unauthorised access to the apartments.

Identity Verification

To confirm that the person arriving is the person who booked, our system reads the identity document you upload and compares the photograph on it with your selfie. The comparison is made from measurements of the two faces. It runs on our own servers inside the EU; no face data is sent to an external artificial-intelligence service. The data used for this check is the document photograph, the measurements taken from it, and your selfie; all three are deleted 36 months after check-out, as set out under Data Retention below. If the automatic comparison fails or cannot be made, a member of our team reviews the two photographs by hand — no decision about your stay is taken on the automatic result alone, and you can ask us for the manual review instead.

Children

The guest register requires an entry for every person staying, so online check-in collects the identity details and document photo of every guest, children included. For a child we keep the name, date of birth, nationality and document details and the document photo. A parent or guardian provides this information on the child's behalf. We do not run the facial comparison on children's documents and we do not send marketing to children.

How We Use Your Information

We use your personal information for the following purposes:

Processing and managing your bookings and payments
Communicating with you about your reservation and stay
Sending check-in instructions and access codes
Verifying the identity of guests and keeping the guest register required by Cyprus law
Responding to your enquiries and support requests
Improving our website, services, and guest experience
Complying with legal obligations and regulatory requirements
Sending promotional communications (only with your explicit consent)

Cookies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyse website traffic, and understand how visitors interact with our site. Essential cookies are required for the website to function properly. Analytics cookies help us understand usage patterns and improve our services. You can manage your cookie preferences through your browser settings at any time. Disabling certain cookies may affect the functionality of the website.

Third-Party Services

We use the following service providers to operate our business. Each of them may have access to your personal information as necessary to perform its function, and each processes it on our instructions:

Stripe — payment processing and the storage of your card. Stripe handles payment information in accordance with PCI DSS standards and its own privacy policy.
Guesty — our property-management system and the record of your reservation (United States; transfers are made under the European Commission's standard contractual clauses).
Cloudflare — hosting, database and document storage for our website and our check-in system (EU/US; check-in documents are stored in the EU).
Our own identity-verification service — reading the identity document and comparing the two photographs. It runs in a container we operate inside the EU; no external artificial-intelligence service is involved.
Google Workspace — our [email protected] mailbox (EU/US).
Google Analytics — website traffic analysis and visitor insights. Google may collect and process data according to its own privacy policy.
OpenAI — processing of the text of the messages you send to our guest assistant, so that it can draft an answer (United States).
Meta / WhatsApp — when you choose to contact us there, your message and phone number are processed by that platform under its own terms.
Booking platforms — where you booked through Booking.com, Airbnb, Expedia or another platform, that platform processes your data under its own policy.

We do not sell your personal data, and we share with each provider only what it needs. We encourage you to review the privacy policies of these services for more information about how they handle data.

CCTV

For safety and property protection, CCTV operates in the parking area and in the outdoor common areas of the building. There are no cameras inside the apartments. Recordings are used only to investigate an incident, a safety concern or damage, and are kept for no longer than that purpose requires.

Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

Copies of identity documents, selfies and the facial-comparison data — the photo of each guest's passport or ID, the selfie, the facial measurements taken from them and the ID and selfie pages of your check-in record are deleted 36 months after check-out.
The signed check-in record, your booking and payment details — the guest details you gave us (including date of birth and document number), your signature and consents, the version of the agreement you signed, the check-in event log and the record of payments and paid extras — are kept for as long as Cyprus accounting and tax law requires (currently six years) and for the handling of disputes.
Marketing preferences — kept until you withdraw your consent.

We keep the identity images for 36 months because we have to be able to answer the legal duty to keep a guest register, to prevent and investigate fraud, to defend a card chargeback or other payment dispute, and to investigate damage to the apartment or illegal activity during a stay — all of which can arise well after a guest has left. After that the images and the facial-comparison data are deleted, while the signed record of who stayed and what was paid remains as our financial and legal record.

Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

Right of access — request a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate or incomplete data
Right to erasure — request deletion of your personal data, subject to legal obligations
Right to restrict processing — request that we limit how we use your data
Right to data portability — receive your data in a structured, machine-readable format
Right to object — object to processing of your data for certain purposes
Right to withdraw consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us using the details provided below. We will respond to your request within 30 days. You can withdraw marketing consent at any time using the unsubscribe link in any of our emails, or by writing to [email protected]. If you are not satisfied with how we have handled your data, you may also lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.

Contact Information

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

26 Suites
Limassol, Cyprus
Email: [email protected]

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically. Continued use of our website and services after any changes constitutes your acceptance of the revised policy.