Last updated: 6 October 2026

This policy explains which personal data we process when you visit manto-corfu.com, contact us or stay with us, why we do so, and which rights you have.

1. Who is responsible
MANTO RETREAT CORFU SINGLE MEMBER P.C. (MANTO RETREAT CORFU ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε.)
Agios Georgios Pagon, 49083 Kerkyra (Corfu), Greece
Represented by the Managing Director, Mirja Vanessa Bräutigam
Email: info@manto-corfu.com · Phone/WhatsApp: +49 176 35200400

We have not appointed a data protection officer, as we are not required to. For any question about your data, write to info@manto-corfu.com.

2. Visiting our website
Hosting and server logs. Our website and our email are hosted by WeDo Wegner Domus GmbH & Co. KG, Große Bäckerstraße 11, 20095 Hamburg, Germany, on our behalf and under a data processing agreement. When you open a page, the server automatically records technical data: your IP address, date and time, the page requested, the referring page, and your browser and operating system. A security system on the server uses this data to block attacks and malware. We need this data to deliver the website and keep it secure (legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure and working website). Log files are kept only as long as operation, security and legal requirements demand, and are then deleted.

Fonts. The fonts on our website are stored on our own server. No connection to Google Fonts is made for them.

Emoji. On pages that contain emoji, WordPress may load emoji images from s.w.org (WordPress.org). Your IP address is then transmitted to those servers, which may be located in the USA (Art. 6(1)(f) GDPR, consistent display of text).

No tracking. We do not use analytics, advertising or tracking tools, and we do not create user profiles.

3. Cookies and similar technologies
Our own website sets only one cookie: pll_language (manto-corfu.com) remembers whether you use the English or German version of the site and is stored for one year. It is necessary to show you the language you chose (Art. 6(1)(f) GDPR). WordPress also stores a technical note in your browser's session storage about emoji support; it contains no personal data and is deleted when you close the browser.

Embedded services described below may set their own cookies: Google Maps on our contact page (section 6) and the Smoobu booking calendar, which uses Cloudflare's security cookie cf_clearance (section 5). You can delete or block cookies at any time in your browser settings.

4. Contacting us
Contact form. If you use our contact form, we process the data you enter: name, email, phone number, organisation, social media handle, number of participants, preferred dates, and how you heard about us. The form is sent to info@manto-corfu.com and also stored in our website database. We do not store your IP address with it.

Email, phone and WhatsApp. If you email, call or message us, we process the data you share, such as your name, contact details and the content of your message.

We use this data to answer your request and to prepare an offer (Art. 6(1)(b) GDPR, steps prior to a contract; otherwise Art. 6(1)(f) GDPR, our interest in answering enquiries). If your enquiry does not lead to a booking, we delete it 12 months after our last contact.

WhatsApp is a service of WhatsApp Ireland Limited (Meta). If you contact us via WhatsApp, Meta processes your messages and metadata under its own terms; data may be transferred to the USA. Use email or phone if you prefer not to use WhatsApp.

5. Bookings and your stay
Booking calendar. Our booking page shows a calendar from Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany. When you open that page, your browser loads the calendar from Smoobu's servers. Smoobu uses services of Cloudflare, Inc. (content delivery, protection against bots with the cookie cf_clearance, and a statistics script) and loads fonts from Google. Your IP address is therefore transmitted to Smoobu, Cloudflare and Google; Cloudflare and Google may process it in the USA. We embed the calendar so you can check availability and book directly (Art. 6(1)(b) and (f) GDPR).

Booking management. We manage all bookings, messages and invoices with Smoobu, which acts as our processor under a data processing agreement. For a booking we process your name, address, email, phone number, number of guests, dates, booked services, payment details and status, and our correspondence. We need this data to fulfil our contract with you (Art. 6(1)(b) GDPR) and to meet legal obligations, in particular tax and accounting (Art. 6(1)(c) GDPR). Before your stay you receive a link to our digital guest guide, also provided via Smoobu.

Payments. Payments and refunds of the security deposit are made by bank transfer. Our bank receives the data needed for the transfer (Art. 6(1)(b) GDPR).

Booking platforms. If you book through a platform such as Booking.com or Airbnb, the platform is responsible for its own processing. It passes your booking data to us, and we manage it in Smoobu.

Identity documents. Greek tax law requires us to declare every stay to the Independent Authority for Public Revenue (AADE). For this we record the main guest's Greek tax number or, for guests without one, the number of their passport or identity card, their permanent address and country (Art. 6(1)(c) GDPR). If we ask you for a photo of your ID document for this purpose, we delete the photo once the declaration has been submitted, at the latest three months after your departure.

Health and dietary information. For retreats you or your retreat host may tell us about allergies, dietary needs or physical conditions relevant to yoga, bodywork or meals. Such health data is processed only with your explicit consent (Art. 9(2)(a) GDPR) and passed only to the people who need it, for example the chef or therapist. You can withdraw your consent at any time with effect for the future. We delete this information after your stay.

Additional services. If you book additional services such as a private chef, massage, photography or guided tours, we pass your name, dates, group size and relevant preferences to the provider concerned (Art. 6(1)(b) GDPR). These providers process the data under their own responsibility.

6. Embedded content and links
Google Maps. Our contact page and our booking confirmation page show an interactive map from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the map loads, your IP address and technical data are transmitted to Google, which may set cookies and process the data in the USA. We use the map to show you where Manto is (Art. 6(1)(f) GDPR). Google's privacy policy: policies.google.com/privacy.

Instagram feed. The Instagram posts on our homepage are stored on our own server. Viewing them does not transmit data to Instagram. Only when you click a post or our Instagram or Facebook link are you taken to Meta's platforms, where Meta's privacy policy applies.

7. Transfers outside the EU
Google, Cloudflare and Meta may process data in the USA. These companies are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision.

8. How long we keep data
We keep personal data only as long as needed for the purposes above. In particular:

– Enquiries without a booking: 12 months after our last contact.
– Booking and invoice data, including the data declared to the tax authority: five years from the end of the financial year concerned, as Greek accounting and tax law requires; longer only while the tax authority may still audit that year.
– Health and dietary information: until the end of your stay.
– Photos of identity documents: until the declaration to the tax authority has been submitted, at the latest three months after your departure.
– Server logs: see section 2.

9. Your rights
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on our legitimate interests (Art. 21). If you have given consent, you can withdraw it at any time with effect for the future (Art. 7(3)). To exercise your rights, write to info@manto-corfu.com.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or where the alleged infringement occurred. The authority responsible for us is the Hellenic Data Protection Authority, Kifissias 1-3, 115 23 Athens, Greece, www.dpa.gr.

10. Do you have to provide data?
You are not obliged to provide personal data. Without the data needed for a booking, however, we cannot accept it. We do not use automated decision-making or profiling.

11. Changes
We update this policy when our services or legal requirements change. The current version is always available on this page.