GDPR compliance

TWENTYONE WEST COAST TRVL STORIES SINGLE MEMBER P.C. processes personal data in two distinct capacities, and the Regulation treats them very differently.

Controller — this website and our own business

Briefings, the journal list, supplier and client contact records, server logs. We decide why and how these are processed, so the obligations of Articles 12 to 22 fall on us directly. The privacy policy is the notice required by Articles 13 and 14 for that processing.

Processor — inside a property's own systems

Running a property's marketing means being given the keys to systems that hold its guests' data: the analytics and advertising accounts, the booking engine, the mailing list, the review platforms, and any site or application we build or operate for it. That data belongs to the property, not to us. The property is the controller; we act only on its documented instructions under a written data processing agreement meeting Article 28(3). We do not use it for our own purposes, we do not mine it, we do not market to a property's guests, and we never carry a list from one property into another — the second of which is the single most common thing a hotel is right to worry about when it hires an agency that also works with its competitors.

Article 5 sets six of them, and they are engineering constraints here rather than a statement of intent:

• Lawfulness, fairness and transparency — every collection point on this site says what it is for at the point it asks.
• Purpose limitation — an address given for a briefing is not repurposed into something unrelated.
• Data minimisation — the contact form asks only what a first reply actually needs. We set up client systems the same way: a guest field nobody uses is a liability, not a feature.
• Accuracy — corrections are made on request, and passed on to anyone we shared the data with.
• Storage limitation — everything has a stated retention period, and it is enforced rather than aspirational.
• Integrity and confidentiality — TLS everywhere, access on a need-to-have basis, two-factor authentication on every account that touches personal data.

Article 5(2) adds accountability: being able to demonstrate the above. We keep the record of processing activities required by Article 30, and the retention and access decisions behind it are written down rather than remembered.

The journal is a business-to-business publication, and it is sent lawfully. This is the part of the Regulation most often got wrong, so it is worth stating precisely.

It goes to hoteliers and operators, at a work address, about their own industry. We run no consumer marketing and we never write to a property's guests. We do not buy, rent, scrape or append lists — every address on ours was given to us directly, on a briefing, by the single route below:

Legitimate interest, in a business relationship

You sent us a briefing with the journal box — which sits in plain language immediately above the Send button — left ticked. Article 6(1)(f) GDPR permits processing necessary for our legitimate interests, and Recital 47 states in terms that processing for direct marketing purposes may be regarded as such. The balancing test comes out our way for a narrow set of reasons: the interest engaged is professional rather than private, the address was given to us for business correspondence about exactly this subject, the contact is one email a month, and refusing costs a single click. Article 11(2) of Law 3471/2006 — Greece's transposition of Article 13(2) of the ePrivacy Directive — permits the same thing on the electronic communications side, for an address obtained in the course of a business transaction, used for similar services, with a clear and free opportunity to object both when it is collected and in every message after. Untick the box and the address never reaches the list at all.

Under Article 21(2) you may object to direct marketing at any time and for any reason, and unlike other objections it is absolute: there is no balancing exercise and no interest we may weigh against it. We honour it immediately.

These are two different things and you are entitled to either. Both are free, neither requires a reason, and neither requires an account.

Unsubscribe

A one-click link at the top of every issue. No login, no confirmation step, no preference centre designed to slow you down. The address stops receiving the journal from that moment.

Erasure, Article 17

Write to hello@twenty-one.co and the address is deleted from our mailing platform and from our own records, within one month and normally within days. What remains is a suppression entry — the minimum note that this address must never be contacted again — kept for the sole purpose of making the erasure hold, which is what Article 21(3) requires of us.

The same applies to a briefing you have sent us. Ask and it is deleted, subject only to what Greek tax and commercial law obliges us to retain once an invoice exists.

Articles 15 to 22 give you the right to access the data we hold about you, to have it corrected, to have it erased, to restrict how it is used, to receive it in a portable machine-readable form, to object to processing based on legitimate interests, and to withdraw consent where consent is what we relied on.

Send the request to hello@twenty-one.co. There is no form to fill in and no fee. We answer within one month, as Article 12(3) requires, and if a request is genuinely complex we will tell you inside that month that we are extending it and why. We will ask for enough to be confident it is really you — no more.

If the data sits inside a property's own system rather than ours — you booked a room, you left a review, you subscribed to a hotel's list — we are the processor, not the controller: we will pass the request to that property, which is the party that must answer it, and we will help it do so as Article 28(3)(e) obliges us to.

You may also complain to the Hellenic Data Protection Authority, Kifissias 1–3, 115 23 Athens, +30 210 6475600, www.dpa.gr — or to the supervisory authority of the EU country you live or work in. We would rather you came to us first, but the right is yours either way.

What a property's owner, general manager or counsel usually needs to know, in the order they usually ask it:

• We sign a data processing agreement on Article 28(3) terms before we are given access to anything holding guest data — ours or yours, whichever your counsel prefers.
• We process only on documented instructions, and we say so if an instruction looks to us like it breaches the Regulation.
• Everyone with access is under a written duty of confidentiality that outlives the engagement.
• Sub-processors — hosting, mail delivery, advertising platforms, analytics — are named before they are used, and you may object to a new one.
• Data stays in the EEA by default. Where a specific tool requires otherwise, we say so before it is chosen, and it is covered by standard contractual clauses or an adequacy decision.
• We assist with data subject requests from your guests, with breach notification, and with any DPIA the processing requires under Article 35.
• At the end of the engagement your data is returned or deleted, at your choice, and backups age out on a stated schedule.
• We do not subcontract the work offshore. The people running your account are in Athens, and guest data does not leave that boundary for the convenience of a cheaper resource.

Article 32 asks for measures appropriate to the risk. On our own estate that means TLS on every connection, two-factor authentication on every account, least-privilege access, rate limiting and input sanitisation on public endpoints, dependency updates as routine work rather than as a project, and backups that are actually restored from time to time to prove they work.

If a breach occurs on our own systems we notify the Hellenic DPA within 72 hours where Article 33 requires it, and the people affected without undue delay where Article 34 does. If it occurs inside a system we run for a property, we notify that property without undue delay so it can meet the same deadlines — the clock is theirs, and our job is not to burn it.

• No automated decision-making or profiling with legal or similarly significant effects, on this site or in what we send.
• No sale of personal data, ever, in any form, to anyone.
• No special-category data collected through this site.
• No dark patterns in the collection points: no pre-selected consent for tracking, no unsubscribe buried behind a login, no cost to saying no.

We have not appointed a Data Protection Officer, and are not required to: our core activity is marketing and building for a handful of properties a year, not large-scale monitoring or large-scale processing of special categories, so Article 37(1) does not bite. Responsibility sits with the manager named below, who answers the mail personally.

Questions about any of this go to hello@twenty-one.co, or 210 3000 463, or Plataion 55, 104 35 Athens, Greece. A named person reads that inbox — it is not a ticket queue.