Skip to content
Elounda Cave Villas
Sign in

Privacy Policy

How we handle your personal data when you use this website. Last updated 12 October 2026.

1. Controller

Novalytix UG (haftungsbeschränkt), Richardstraße 88, 22089 Hamburg, Germany, info@novalytix.eu, operates this website and is the controller for the processing described here. The initiator of the Elounda Cave Villas project receives the requests in order to review them.

2. What we process, and why

Visiting the website

Our server records the IP address, time, requested page, browser type and referring page of each request in a technical log that is rotated automatically by size and is never kept longer than needed; in practice a few weeks. We need this to deliver the pages and to detect abuse (Art. 6(1)(f) GDPR). No analytics or tracking tools are used.

Registering as a member

To see the full presentation you register with your full name, email address, main residence and a password. We store these, a one-way hash of the password, sign-in timestamps and the IP address of your last two sign-ins (to detect misuse of your account). We process this to handle your interest in the project (Art. 6(1)(b) GDPR). The initiator sees who has registered.

Asking to proceed and the questionnaire

If you ask to proceed, the initiator may open a questionnaire for you. It asks for the number of shares you are considering, your preferred usage months, your flexibility, your preferred villa, a short description of how you would finance a participation, an optional note about yourself and your confirmation that you could commit the equity. These answers are sensitive to you and are seen by the initiator and the administrators only; they are used solely to compose the Co-Owner group (Art. 6(1)(b) GDPR). No documents are requested or stored.

Messages in the app

This app sends no email. Notifications, updates from the initiator and your messages to him are delivered to an inbox inside the app and stored with your account. If you forget your password, the initiator can issue a temporary password in person; it must be replaced at your next sign-in.

3. Who receives your data

  • The project initiator and the administrators of this app, who review registrations and questionnaires.
  • Hetzner Online GmbH, Germany, which hosts the server in its data centre in Helsinki, Finland, inside the EU (data processing agreement in place).

Your data does not leave the European Union and is not sold or shared with anyone else.

4. Cookies

We set one strictly necessary session cookie to keep you signed in and to protect forms against forgery. If you tick "Keep me signed in", a second cookie remembers you for two weeks. If you install the app on your phone, your browser stores the app's icon and an offline page, and remembers whether you dismissed the install banner. There are no third-party or tracking cookies, so no consent banner is needed.

5. How long we keep your data

  • Accounts that were declined are deleted automatically six months after the decision.
  • Member accounts that never went beyond registration and have not signed in for a year are deleted automatically.
  • All other accounts, including their inbox and the messages they sent to the initiator, are kept until you delete them yourself (see section 6) or the selection process ends and the initiator asks us to close the app. Deleting your account also deletes the messages you sent.
  • The administrative audit log records which administrator viewed or decided on which registration. If you delete your account, these entries no longer refer to you.

6. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15 to 21 GDPR). Two of these are available in the app without asking anyone:

  • Export your data as a JSON file from the Account page (Art. 15 and 20).
  • Delete your account from the Account page. Deletion is immediate and cannot be undone (Art. 17).

For anything else, write to info@novalytix.eu. You may also lodge a complaint with a supervisory authority; the one responsible for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg.

7. Security

All traffic is encrypted (HTTPS). Passwords are stored as salted bcrypt hashes. Sign-in attempts are rate-limited and accounts are locked for one hour after ten failed attempts.