Privacy policy
Last updated 12 October 2026
This page explains what personal data this website collects, why, who receives it and for how long, and the rights you have over it.
Who is responsible
Uma Ray Suites, Agiou Mina, Fira 847 00, Santorini, Greece, is responsible for the personal data collected through this website: the data controller under the EU General Data Protection Regulation (GDPR). Write to info@umaraysuites.com or call +30 22860 21722.
What we collect
- Contact form. Your name, email address, the dates of your stay if you give them, your message, and your agreement that we may use them to answer you. The website keeps no copy: the server passes your message to our email provider, which delivers it to the hotel's mailbox.
- Bookings. Bookings are made on our booking engine at umaraysuites.reserve-online.net, which WebHotelier runs for us. The privacy notice on the booking engine explains what it collects.
- Server logs. Our web server records the IP address, time, page requested, referring page and browser of each request, to keep the site running and secure.
- Message limit. To stop automated abuse, the server counts the messages sent from each IP address over the past hour. The count lives only in the server's memory and is never written to disk.
- Security check. On the contact page, Cloudflare Turnstile checks that a person, not a bot, is sending the form. It processes technical signals such as your IP address and browser details, solely to detect bots, as Cloudflare's Turnstile privacy addendum describes.
- Analytics. On www.umaraysuites.com, Google Tag Manager loads Google Analytics 4, which measures visits. The next section explains the cookies involved.
- Map. The location page shows a Google Maps map, which loads when you scroll near it. Your browser then connects to Google, which receives your IP address and the address of the page and may set or read its own cookies, as Google's privacy policy explains.
Cookies and similar technologies
The cookie banner on www.umaraysuites.com lets you accept or reject analytics and marketing cookies. Essential ones need no consent, because the site cannot run safely without them.
| Category | Cookie or storage | What it does | Kept for |
|---|---|---|---|
| Essential | Your cookie choice, in your browser's local storage | Remembers whether you accepted or rejected analytics and marketing cookies | Until you clear your browser data |
| Essential | Cloudflare Turnstile, contact page only | Checks that a person is sending the contact form | As Cloudflare's Turnstile privacy addendum describes |
| Analytics | _ga and _ga_ followed by an ID, from Google Analytics 4 | Tells visits apart, so we can count them and see which pages are used | 2 years |
| Marketing | None | We set no marketing or advertising cookies | Not applicable |
| Map | Google's own cookies, location page only | Google may set or read them when the Google Maps map loads | As Google's privacy policy describes |
Google Analytics reads or writes its cookies only if you accept analytics cookies. If you reject them, Google's Consent Mode stops it from using cookies, though it can still send measurements without cookies, which Google uses for basic measurement and modelling. To change your choice, use Cookie settings at the foot of any page, or clear this site's data in your browser and the banner will ask again.
Your choice in the banner does not apply to the map on the location page, which loads when you scroll near it.
Why we use it
- Answering your message: your consent, given with the tick box on the form (GDPR Article 6(1)(a)). You can withdraw it at any time by writing to info@umaraysuites.com.
- Your booking: what is needed to make and run the booking you ask for (Article 6(1)(b)).
- Server logs, the message limit and the security check: our legitimate interest in keeping the website safe and working (Article 6(1)(f)).
- Analytics cookies: your consent in the cookie banner (Article 6(1)(a)).
- The map on the location page: our legitimate interest in showing guests where the hotel is (Article 6(1)(f)).
Who receives it
Nothing collected on this website is sold. These providers process data for us:
- Hetzner Online GmbH hosts the website on a server in Germany.
- Our email provider delivers contact-form messages to the hotel's mailbox.
- Cloudflare runs the security check on the contact form.
- WebHotelier (Revplus Hellas S.A., Rhodes, Greece) runs the booking engine.
- Google provides Google Tag Manager and Google Analytics 4 on www.umaraysuites.com, and may process that data outside the European Union, as Google's privacy policy explains.
The map on the location page comes from Google, which handles what it receives under its own privacy policy and may process it outside the European Union.
We share data with public authorities only when Greek or EU law requires it.
How long we keep it
- Contact-form messages: in the hotel's mailbox for as long as we need them to answer you and look after any stay that follows, then deleted, unless the law requires us to keep them longer.
- Server logs: up to 15 days.
- Message counts: one hour.
- Analytics: the cookies stay on your device for up to 2 years. Google Analytics keeps user-level and event-level data for at most 14 months; the aggregated statistics in its standard reports are kept longer.
Your rights
You can ask to see the personal data we hold about you, to correct or delete it, to restrict or object to its use, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to info@umaraysuites.com. You can also complain to the Hellenic Data Protection Authority at www.dpa.gr.
Security
The website is served only over HTTPS. The contact form is protected by Cloudflare's security check and by a limit on messages per connection.
Changes
If this policy changes, the new version will appear on this page with a new date. See also our terms of use.