of the Company BERATI ATHINA – RENTED APARTMENTS regarding the processing of personal data through a video surveillance system Second-Level Information Notice

Last updated: 13/10/2026

The company under the name “BERATI ATHINA - RENTED APARTMENTS”, headquartered in Rethymno, Crete, in the area of MYRTHIOS, MUNICIPALITY OF AG. VASILEIOS (Postal Code 74060), with T.I.N.: 053895935, RETHYMNO TAX OFFICE (hereinafter referred to as the “Company”), which manages and operates the rented apartments “Mirthea Suites” (hereinafter referred to as the “Tourist Accommodation”), recognizing the importance of protecting the personal data of the latter’s guests, partners, suppliers and staff, and having as one of its primary concerns compliance with Regulation (EU) 2016/679 (GDPR) and the relevant national legislation, proceeded with the drafting of this policy in order to fully inform data subjects about the Operating Policy of all Video Surveillance Systems maintained at the premises of the Tourist Accommodation, the terms of their installation and operation, the security measures taken to protect personal data, as well as the rights of access to the data retained.

Video surveillance systems are called those systems that are permanently installed in a place and have the ability to capture and/or transmit images or sound to display screens or recording devices (where cameras may be connected to the screen or recording device either directly or through a network/internet). Our policy does not apply in those cases where the capture of images and/or sound takes place using handheld cameras, photographic cameras, mobile phone devices, videoconferencing systems, recordings of audiovisual material at events, as well as video recordings for the production of material for the Company’s social media.

1. Data Controller:

The company under the name “BERATI ATHINA - RENTED APARTMENTS”, headquartered in Rethymno, Crete, in the area of MYRTHIOS, MUNICIPALITY OF AG. VASILEIOS (Postal Code 74060), with T.I.N.: 053895935, RETHYMNO TAX OFFICE, is the data controller for all cameras installed at the “Mirthea Suites” Tourist Accommodation located in Myrthios 74060, Rethymno, Crete.

The contact details of the legal entity are:

Mirthea Suites
Telephone: +30 6976880666
info@mirrheasuites.gr
MYRTHIOS, MUNICIPALITY OF AG. VASILEIOS, POSTAL CODE 74060, Rethymno, Crete
https://www.mirtheasuites.gr/

As data controller, the Company has all the obligations arising from the GDPR, Law 4624/2019 and the Guidelines of the Data Protection Authority.

2. Data processed:

The personal data collected during the operation of the video surveillance system are image and video data of guests and staff who are present at the premises of the Tourist Accommodation.

3. Purpose of processing and legal basis:

We use a surveillance system for the purpose of protecting persons and property, monitoring and preventing unlawful entry, protecting the guests and staff of the Tourist Accommodation, as well as our Company’s partners, and protecting our property from theft, arson or other unlawful acts. We use a surveillance system for the purpose of protecting persons and property. The processing is necessary for the purposes of the legitimate interests pursued by us as data controller (Article 6 paragraph 1. f GDPR).

4. Assessment of legitimate interests

The Company seeks to provide the highest possible level of security at the premises of the Tourist Accommodation, always respecting the privacy of those present on the premises. For these reasons, we use a video surveillance system with privacy-friendly technology, carefully positioned to ensure that monitoring is limited, as far as possible, to the areas and assets strictly necessary for the purposes pursued.

Our legitimate interest consists in the need to protect the premises of the Tourist Accommodation and the assets located therein from unlawful acts, such as theft, vandalism, fire, as well as the timely detection of malicious acts. The same applies to the safety of life, physical integrity, health, as well as the property of our staff and of any third party lawfully present in the monitored area.

We collect image data only, through the use of fixed cameras that do not record sound and do not have optical zoom capabilities. Recording is limited to areas where we have assessed that there is an increased likelihood of unlawful acts, e.g. theft, such as our cash registers, the server and the entrance and exit points of the Tourist Accommodation, as well as the private parking area it provides for its guests, and areas requiring a high level of security, such as the accounting office and our electromechanical installations, with cameras focused exclusively and only on the asset being protected.

No cameras have been installed in open areas and no images are captured from external public spaces, roads, pavements or neighbouring buildings, nor in dining areas and corridors leading to the rooms of the Tourist Accommodation, or in areas where guests and/or visitors of the Tourist Accommodation may be monitored (at the entrances to individual rooms, staff recreation areas, toilets and areas where recreational activities take place, such as swimming pools, gyms, sports areas, changing rooms, etc.), and we do not focus on areas where the private life of the persons whose images are captured may be excessively restricted, including their right to respect for their personal data.

The Personal Data collected through the system are not used under any circumstances to monitor work, evaluate the behaviour or assess the performance of employees.

5. Recipients

The retained material is accessible only to a small number of clearly designated persons, our authorised staff, who are responsible for the security of the premises and are bound by relevant confidentiality and secrecy clauses. This material is not transferred or disclosed to third parties, with the exception of the following cases: (a) to the competent judicial, prosecutorial and police authorities when it contains information necessary for the investigation of a criminal offence concerning persons or property of the data controller, (b) to the competent judicial, prosecutorial and police authorities when they lawfully request data in the performance of their duties, and (c) to the victim or perpetrator of a criminal offence, when the data may constitute evidence of the offence.

Our Company has taken all appropriate organisational and technical measures to ensure that the processing of your personal data, whether by the Company itself or by third parties on its behalf, is lawful, appropriate and has the appropriate level of security to prevent any unauthorised or accidental access, processing, deletion, alteration or other use thereof.

6. Retention period

We retain the data for thirteen (13) days, after which they are automatically deleted. If we identify an incident during this period, we isolate a segment of the video and retain it for up to one (1) additional month, for the purpose of investigating the incident and initiating legal proceedings to defend our legitimate interests, whereas if the incident concerns a third party, we will retain the video for up to three (3) additional months.

7. Informing data subjects about video surveillance

The Company informs data subjects about video surveillance in the following ways:

• Through the text of the Personal Data Protection Policy, which is posted on the website https://www.mirtheasuites.gr/. This policy the guests, partners, suppliers, as well as any third party who visits the premises of the Tourist Accommodation.
• Through warning signs.

8. Your rights

Data subjects have the following rights:

• Right of access: you have the right to know whether we process your image and, if so, to receive a copy of it.
• Right to restriction: you have the right to ask us to restrict processing, for example, not to delete data that you consider necessary for the establishment, exercise or defence of legal claims.
• Right to object: you have the right to object to the processing.
• Right to erasure: you have the right to request that we delete your data.

You may exercise your rights by sending an email to info@mirtheasuites.gr, by letter to our postal address or by submitting the request to us in person at our address.

To examine a request relating to your image, you must specify approximately when you were within the cameras’ range and provide us with an image of yourself, to help us locate your data and conceal the data of other persons appearing in the footage. Alternatively, we give you the possibility of visiting our premises so that we can show you the images in which you appear. We also point out that exercising the right to object or to erasure does not entail the immediate deletion of data or a change in processing. In all cases, we will provide you with a detailed response as soon as possible, within the deadlines set by the GDPR.

If you have any questions about our practices regarding personal data or the exercise of your rights, you may contact the Company at info@mirtheasuites.gr

9. Right to lodge a complaint

If you believe that the processing of your personal data infringes Regulation (EU) 2016/679, you have the right to lodge a complaint with a supervisory authority.

The competent supervisory authority for Greece is the Data Protection Authority, 1-3 Kifisias Avenue, 115 23, Athens, https://www.dpa.gr/, tel. 2106475600.

10. Amendment of this Second-Level Information Notice

This Statement may be amended periodically to reflect any changes in our Company’s policies and practices. When we make changes to this Statement, we will publish a link to the revised version on the homepage of our website.