Privacy Policy

Last updated: October 2026

1. Controller

Kiekmann Trading Ltd
Groumperon C20, Coral Bay Village
8575 Peyia
Cyprus
Email: enjoy@coral-bay-holiday.com · Phone: +357 96 735 803

We have not appointed a data protection officer, as we are not required to do so. If you have any questions about data protection, you can reach us using the contact details above.

2. Hosting and server logs

This website is hosted by Hostinger International Ltd, 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. When you visit the website, the server processes technically necessary data transmitted by your browser: IP address, date and time, the page accessed, referrer, browser and operating system. This is necessary to deliver the website securely and reliably (Art. 6(1)(f) GDPR). Server logs are deleted after a short period. We have a data processing agreement with Hostinger.

To deliver pages quickly we use the LiteSpeed Cache page cache. Fonts (Inter) are loaded locally from our own server – no connection is made to Google Fonts.

3. Cookies and consent

We set technically necessary cookies on the basis of Art. 6(1)(f) GDPR and Section 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act). We only use all other cookies and similar technologies – for example for statistics – if you give your consent via our cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can change or withdraw your consent at any time via the “Privacy settings” link at the bottom of the page.

To manage the cookies and similar technologies we use and your consents, we use the consent tool “Real Cookie Banner” (devowl.io GmbH, Germany), which runs on our own server. It stores your choice, a random consent ID, the time and the version of the banner; we do not store your IP address in the process. Your consent is stored in a cookie in your browser (duration 1 year) and documented on our server as proof. Details: devowl.io/de/rcb/datenverarbeitung. The legal bases are Art. 6(1)(c) GDPR (obligation to provide proof) and Art. 6(1)(f) GDPR.

4. Booking via Smoobu

For availability checks and bookings we embed the booking system of Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany. When you open a page with a booking calendar, a connection to Smoobu is established and your IP address is transmitted. Loading the calendar is based on our legitimate interest in enabling you to book directly (Art. 6(1)(f) GDPR). The booking form includes the payment service Stripe (Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Dublin 2, Ireland), which sets cookies for fraud prevention (__stripe_mid, duration 1 year; __stripe_sid, duration 30 minutes). So that the calendar automatically adjusts its height to your screen, the script library “iframe-resizer” is also loaded from the cdnjs service (Cloudflare, Inc., USA); in the process your IP address is transmitted to Cloudflare (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework. If you enter your details (name, address, email, phone, travel dates, number of guests, message), we process them to carry out your booking (Art. 6(1)(b) GDPR). Smoobu processes this data on our behalf; a data processing agreement is in place. We keep booking and invoice data for as long as statutory retention obligations require.

Payment service providers

You can pay by PayPal or by bank transfer to our Wise or Revolut account. If you pay in cash on arrival, a 30 % deposit is due via one of these methods when you book. The data required for the payment (name, amount, payment reference, and account or PayPal details where applicable) is processed by the respective provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg; Wise Europe SA, Rue du Trône 100, 1050 Brussels, Belgium; Revolut Bank UAB, Konstitucijos pr. 21B, 08130 Vilnius, Lithuania. The legal basis is Art. 6(1)(b) GDPR. The privacy notices of these providers also apply.

5. Contact by email, phone or WhatsApp

When you contact us, we process your details in order to answer your enquiry (Art. 6(1)(b) GDPR for booking enquiries, otherwise point (f)).

Our website has a WhatsApp button. It is simply a link: only when you click it and confirm the redirect does WhatsApp open and a connection to WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, is established. WhatsApp/Meta’s privacy policy applies; a transfer to the USA cannot be ruled out. If you would rather avoid this, feel free to email us instead.

6. Web analytics with Google Analytics

With your consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, integrated via the Site Kit by Google plugin. Google Analytics helps us understand how visitors use our website. Google Analytics 4 does not store IP addresses. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR). Google Analytics is only loaded after you have given your consent in the cookie banner. The cookies _ga and _ga_* (duration up to 13 months) are set in the process. You can withdraw your consent at any time via “Privacy settings”.

We also use Google Search Console to analyse the visibility of our website in Google Search. No additional data about you is collected on our website for this.

7. Links to booking platforms and partners

We link to our listings on Airbnb and Booking.com and, where applicable, to partner offers (for example car hire or excursions). Only when you click such a link are you taken to the respective provider’s website, where its privacy policy applies. Partner links are marked as advertising. Our links to GetYourGuide contain a partner ID so that a booking can be attributed to us.

8. GetYourGuide tours widget

On some pages we show a selection of bookable tours from GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany (“GetYourGuide”). The widget is only loaded once you consent to the “GetYourGuide” service in the cookie banner or directly on the widget. Your browser then connects to GetYourGuide’s servers. Among other things, your IP address, device and browser information and the page you are viewing are transmitted. GetYourGuide sets cookies (e.g. “visitor_id”, up to 400 days; “par_sess”, 31 days) to recognise you and to attribute a booking to our partner ID. We receive a commission for referred bookings; for billing purposes GetYourGuide sends us reports on referred bookings.

GetYourGuide may set further cookies, including for analytics purposes, and may use service providers in third countries such as the USA. Details can be found in the GetYourGuide privacy policy. The legal basis is your consent (Art. 6(1)(a) GDPR and, for access to your device, Art. 5(3) of the ePrivacy Directive as implemented in national law). You can withdraw your consent at any time with effect for the future via the privacy settings.

9. Travelpayouts partner network

Some partner links, for example for airport transfers and car rentals, are provided through the Travelpayouts partner network operated by Go Travel Un Limited, 4007 Central Plaza, 18 Harbour Road, Wanchai, Hong Kong (“Travelpayouts”). If you consent to the “Travelpayouts” service (Marketing category) in the cookie banner, your browser loads a script from Travelpayouts servers (tpembars.com). In the process, your IP address, device and browser information, the page visited and clicks on partner links are transmitted, among other data. Travelpayouts may use cookies or similar technologies to attribute clicks and resulting bookings to our partner ID. We receive a commission for referred bookings; the price stays the same for you.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Travelpayouts is based in Hong Kong, outside the EU; there is no EU Commission adequacy decision for Hong Kong. The transfer is based on your explicit consent (Art. 49(1)(a) GDPR). This involves the risk that authorities there may access the data and that your rights may be harder to enforce. You can withdraw your consent at any time via the cookie settings. The partner links still work without consent, but the script is then not loaded.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Commissioner for Personal Data Protection, Kypranoros 15, 1061 Nicosia, Cyprus (dataprotection.gov.cy). You can also contact the supervisory authority in your place of residence.

11. Changes

We update this privacy policy when our website or the services we use change.