Privacy policy

TWENTYONE WEST COAST TRVL STORIES SINGLE MEMBER P.C. is the data controller for the personal data described here. Registration details are at the foot of this page; write to hello@twenty-one.co for anything on this subject and it reaches the person who can act on it.

We have not appointed a Data Protection Officer — the scale of the processing described below does not require one under Article 37 GDPR.

It covers twenty-one.co: the enquiry form, the journal subscription, the server logs and the one third-party script the site loads.

It does not cover a property's own site, booking engine or guest data, even where we run them. There the property is the controller and we act as a processor on its written instructions under a data processing agreement; its own privacy notice governs, not this one.

Enquiry form

Your name, the property, where it is, how many rooms it has, your email address and — if you fill them in — a telephone number, the services you have ticked and the message itself. Purpose: to read your briefing and reply to it. Legal basis: Article 6(1)(b) GDPR, steps taken at your request before entering into a contract; and, where you are writing on behalf of a property rather than as an individual, our legitimate interest in responding to business enquiries under Article 6(1)(f).

Journal subscription

Your email address, and a note that it arrived with a briefing. Purpose: to send you the journal. Legal basis: our legitimate interest in business-to-business direct marketing under Article 6(1)(f) GDPR, read with Article 11(2) of Law 3471/2006. The section below sets out exactly what that means and how to end it.

Server and delivery logs

Your IP address and ordinary request metadata — time, page, browser, referring page — recorded by the web server, and by the rate limiter that stops the contact form being flooded. Purpose: keeping the site up, secure and abuse-free. Legal basis: our legitimate interest in the security and availability of the service, Article 6(1)(f).

Meta Pixel

A measurement script from Meta Platforms Ireland Ltd. It records that a browser viewed a page of this site, together with the identifiers and device information described in the cookie policy, and reports it to Meta — which may link it to a Facebook or Instagram account. Purpose: measuring whether our advertising reaches the right audience. Legal basis: your consent under Article 5(3) of the ePrivacy Directive and Article 6(1)(a) GDPR, asked for on the banner before anything is loaded and withdrawable at any time from Cookie settings in the footer, with Meta acting as joint controller for the reporting it performs. Decline and the script never runs.

We do not ask for special-category data, we do not buy lists, we do not build profiles of visitors, and there is no automated decision-making of any kind on this site.

The journal is a business-to-business publication: it goes to hoteliers and operators, at a work address, about their own industry. We run no consumer marketing, we never write to a property's guests, and we do not buy, rent, scrape or append lists. There is one way onto our list — the box left ticked on the contact form alongside a briefing — which is the business-relationship route Article 6(1)(f) GDPR and Article 11(2) of Law 3471/2006 allow.

Both routes end the same way: a one-click unsubscribe at the top of every issue, and erasure on request at hello@twenty-one.co. The full legal basis, and the balancing test behind it, is set out under "Direct marketing" on the GDPR page.

Only the suppliers that make the site work, each under a contract that binds them to process on our instructions:

Google Ireland Ltd

Google Workspace carries the mailbox that receives enquiries, so your message is stored there as an email. Data held in the EU.

Sendinblue SAS (Brevo)

Holds the journal subscriber list and sends the emails. Data held in the EU (France).

DigitalOcean LLC

Hosts the site and its logs on a server in Frankfurt, Germany. Transfers to the United States, where the parent company is established, are covered by the European Commission's standard contractual clauses.

Meta Platforms Ireland Ltd

Receives the pixel measurements described above, and transfers them to the United States under the EU–US Data Privacy Framework and standard contractual clauses.

Beyond those, we disclose personal data only where the law obliges us to, or where it is necessary to establish or defend a legal claim — to our accountants, auditors or lawyers, under professional confidentiality. We never sell it.

• An enquiry that does not become a project: kept for up to 24 months, so we can pick up the thread if you come back, then deleted.
• An enquiry that becomes a project: kept for the life of the engagement and then for as long as Greek tax and commercial law requires the records of it, currently five years from the end of the financial year.
• Journal subscription: until you unsubscribe, plus a suppression record of the fact that you did — that record exists precisely so we never email you again.
• Server and rate-limiter logs: days, not months. The rate-limiter window is one hour.

Under the GDPR you can ask us for a copy of the personal data we hold about you, ask us to correct it or erase it, ask us to restrict how we use it, ask for it in a portable form, and object to processing we base on legitimate interests. Where processing rests on consent, you can withdraw that consent at any time — which does not affect what was done lawfully before you did.

Write to hello@twenty-one.co. We answer within one month, free of charge, and we will ask for enough information to be sure it is really you before we act.

If you think we have handled your data wrongly, please tell us first — but you also have the right to complain to the Hellenic Data Protection Authority, Kifissias 1–3, 115 23 Athens, +30 210 6475600, www.dpa.gr.

The site is served only over TLS. Access to the mailbox, to the subscriber list and to every client account we hold credentials for is limited to the people here who need it and protected by two-factor authentication. The contact form is rate-limited and its inputs are sanitised. No system is perfectly secure; if a breach ever puts your rights at risk we will notify the Hellenic DPA and you, as Articles 33 and 34 require.

This is a business site and it is not directed at children. We do not knowingly collect data from anyone under 15, the age of digital consent in Greece. If you believe a child has sent us something, tell us and we will delete it.

When what the site does changes, this page changes with it, and the date at the top moves. Material changes to processing that relies on your consent will be asked for again rather than assumed.

Questions about any of this go to hello@twenty-one.co, or 210 3000 463, or Plataion 55, 104 35 Athens, Greece. A named person reads that inbox — it is not a ticket queue.