Last updated: July 2026
1. Introduction
Karivalis Hospitality Consulting Limited Partnership (“Karivalis Consulting”, “we”, “our”, or “us”) is committed to protecting your privacy and handling your personal information responsibly.
This Privacy Policy explains what information we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR).
2. Data Controller
The data controller responsible for the processing described in this Privacy Policy is:
Nikolaos Karivalis, sole proprietor trading as Karivalis Hospitality Consulting
Registered Business Name: KARIVALIS HOSPITALITY CONSULTING LIMITED PARTNERSHIP
Business address: Aspasias 35, Cholargos, Athens, Greece
VAT: EL802914249
Email: nikos@karivalisconsulting.com
Telephone: +30 694 84 17 741
3. Scope of This Policy
This Privacy Policy applies to personal data processed through:
this website
website contact and enquiry forms
email and telephone communications initiated through the website
consultation or meeting requests
cookies, analytics and similar website technologies, where enabled.
Separate contractual privacy information may apply after a visitor becomes a client or business partner.
4. Personal Data We Collect
4.1 Information You Provide
Depending on how you interact with us, we may collect:
your name
your email address
your telephone number
information included in your enquiry or message
information about your hotel, project or consulting requirements
your meeting availability
any other information you choose to provide.
Please do not submit sensitive personal data or confidential business information through the website unless it is necessary and you have been specifically asked to provide it.
4.2 Information Collected Automatically
When you visit the website, certain technical data may be processed automatically, including:
IP address
browser and device type
operating system
referring website
pages visited
date and time of access
approximate geographic region
cookie identifiers
diagnostic, security and performance information.
The exact data collected depends on the website hosting, security, analytics and cookie configuration active at the time of your visit.
4.3 Information from Third-Party Services
Where third-party services are enabled, such as a scheduling platform, spam-prevention system, analytics provider, embedded media or social media platform, those providers may process personal data under their own privacy terms.
5. Purposes and Legal Bases
We process personal data only when there is an appropriate legal basis.
Responding to Enquiries
We use the information submitted through the contact form, email or telephone to understand and respond to your enquiry.
The legal basis is taking steps at your request before entering into a contract and, where applicable, our legitimate interest in managing professional communications.
Arranging Consultations
We process contact details, availability and information about your consulting needs to schedule and prepare for meetings.
The legal basis is taking steps at your request before entering into a contract.
Providing Consulting Services
Where you become a client, we process information necessary to prepare proposals, deliver agreed services, communicate, manage the engagement and maintain business records.
The legal bases are performance of a contract and compliance with legal obligations.
Website Security and Administration
Technical data may be processed to operate the website, prevent abuse, investigate technical problems, protect systems and maintain appropriate security.
The legal basis is our legitimate interest in operating a secure and reliable website.
Website Analytics
We use Google Analytics to obtain statistical information about how visitors interact with the website, including information about pages viewed, approximate location, device and browser type, referring sources and website interactions.
Google Analytics is only activated after the visitor has provided the required consent through the website’s cookie settings.
The legal basis for this processing is the visitor’s consent. Consent may be changed or withdrawn at any time through the “Cookie Settings” link available in the website footer.
Legal Claims and Compliance
We may process information where necessary to comply with legal obligations, respond to lawful requests, establish or defend legal claims and protect our legal rights.
6. Contact Form and Privacy Acknowledgement
When you submit a contact form, the information you provide will be used to respond to your enquiry and, where relevant, to take steps toward a potential consulting engagement.
Acknowledging this Privacy Policy is not the same as consenting to receive marketing communications.
7. Cookies and Similar Technologies
Cookies are small files or identifiers stored on or accessed through a user’s device.
The website may use the following categories:
Strictly Necessary Cookies
These cookies support essential functions such as website security, form operation, spam prevention, session management and storage of privacy preferences.
Where they are genuinely necessary for website operation, they may be used without consent.
Analytics Cookies
Analytics cookies help us understand how visitors use the website, which pages are viewed and whether technical improvements are needed.
Where required by law, analytics cookies will only be activated after consent.
Marketing and Third-Party Cookies
Marketing, advertising, social media, embedded content or similar third-party technologies may collect information about visitors or their interactions with the website.
These technologies will only be activated where an appropriate legal basis exists and, where required, after the visitor has provided consent through the website’s cookie settings.
Cookie Consent Management
We use Real Cookie Banner, a self-hosted WordPress cookie consent management plugin developed by devowl.io GmbH, to obtain, manage and document visitors’ cookie and privacy preferences.
Real Cookie Banner stores information relating to a visitor’s consent choices, including the selected services and categories, the date and time of the decision, a consent identifier and technical information necessary to document and respect those choices.
Consent information is processed and stored within our WordPress installation on the website infrastructure hosted by FastComet.
Under normal operation, consent information is not transmitted to or accessed by devowl.io GmbH. The developer may only receive access to website data where we explicitly provide access in connection with a technical support request.
Real Cookie Banner is also used to prevent optional services, scripts, cookies or embedded third-party content from loading before the visitor has provided any consent required for those services.
The legal basis for storing and documenting cookie preferences is our legal obligation to obtain and demonstrate valid consent and our legitimate interest in managing visitors’ privacy choices. Technically necessary storage used to remember these choices is required for the operation of the consent-management system.
Visitors may change or withdraw their choices at any time by selecting Cookie Settings. They may also view their consent history or revoke their consent.
8. Spam Prevention and Google reCAPTCHA
We use Google reCAPTCHA to protect our contact form and website against spam, automated submissions, abuse and fraudulent activity.
When reCAPTCHA is loaded, Google may process technical and interaction information such as the visitor’s IP address, browser and device information, website interactions and security-related signals.
Google reCAPTCHA is configured through our cookie consent management system. Where consent is legally required, the service will only be activated after the visitor has provided that consent.
9. Recipients and Service Providers
Personal data may be shared with carefully selected service providers that support website and business operations, such as:
website hosting providers
website developers and maintenance providers
email and productivity service providers
cloud storage providers
scheduling and video-conferencing providers
analytics providers
cybersecurity and spam-prevention providers
accountants, lawyers and professional advisers
public authorities where disclosure is legally required.
Providers acting on our behalf may process personal data only for the agreed purpose and subject to appropriate contractual and security obligations.
The following service providers and technologies are currently used in connection with the operation of the website:
Website development and technical administration provider: TruthWebMedia
Form provider: Contact Form 7
Scheduling provider: Calendly
Analytics provider: Google Analytics
Cookie consent provider: Real Cookie Banner, a self-hosted WordPress plugin developed by devowl.io GmbH
Spam-prevention provider: Google reCAPTCHA
10. International Data Transfers
Some technology or service providers may process personal data outside Greece or the European Economic Area.
Where personal data is transferred internationally, we will use an appropriate transfer mechanism where required, such as:
an adequacy decision
approved Standard Contractual Clauses
another legally recognised safeguard.
11. Data Retention
Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected.
Indicative retention periods are:
general enquiries that do not lead to an engagement: up to 24 months after the last meaningful communication
consultation and meeting requests: up to 24 months, unless an engagement begins
client and contractual records: for the duration of the relationship and for any additional period required by accounting, tax or legal obligations
security and technical logs: for the period reasonably required for security, diagnosis and fraud prevention
cookie consent records: for the period necessary to demonstrate and manage the user’s choices.
Information may be retained for a longer period where necessary to establish, exercise or defend legal claims or comply with a legal obligation.
12. Your Data Protection Rights
Subject to the conditions and limitations of applicable law, you may have the right to:
request access to your personal data
request correction of inaccurate or incomplete data
request deletion of your personal data
request restriction of processing
object to processing based on legitimate interests
receive certain data in a structured, commonly used and machine-readable format
withdraw consent at any time where processing is based on consent
lodge a complaint with a competent supervisory authority.
To exercise a right, contact us using the details provided below.
We may need to request reasonable information to confirm your identity before responding.
13. Complaints
You may raise a privacy concern directly with us so that we can review and address it.
You also have the right to lodge a complaint with the Hellenic Data Protection Authority or another competent supervisory authority in the European Union.
14. Data Security
We use reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
However, no internet transmission, website or storage system can be guaranteed to be completely secure.
15. Automated Decision-Making
We do not use information submitted through the website to make decisions based solely on automated processing that produce legal or similarly significant effects.
16. Children’s Privacy
The website and consulting services are intended for business and professional users and are not directed at children.
We do not knowingly collect personal data from children through this website.
17. Third-Party Links
This website may link to third-party websites and platforms.
We do not control their data processing practices. Visitors should review the privacy information provided by those third parties before submitting personal data.
18. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to the website, our services, technology providers or legal requirements.
The updated version will be published on this page and identified by a revised “Last updated” date.
19. Contact
Privacy questions and requests may be sent to:
Karivalis Hospitality Consulting
Nikolaos Karivalis
Aspasias 35, Cholargos, Athens, Greece
Email: nikos@karivalisconsulting.com
Telephone: +30 694 84 17 741