Cyprus Sotheby's International Realty
Version 2.0 · Compliant with GDPR (Regulation (EU) 2016/679) and Cyprus Law 125(I)/2018
The data controller of your personal data is ConceptRealty Ltd (trading as Cyprus Sotheby's International Realty), Company Reg. No. 1013, Real Estate Agent License No. 517/E, registered office at 1 Vasileos Constantinou, Office 302, 8020, Paphos, Republic of Cyprus ("the Company", "we", "us").
This website operates under the "Cyprus Sotheby's International Realty" brand, used under an independent franchise/trademark licence. Brand ownership is separate from data control: ConceptRealty Ltd operates this website and determines the purposes and means of processing personal data collected through it, and is the sole data controller for GDPR purposes.
Email: info@cyprus-sothebysrealty.com
Postal address: 1 Vasileos Constantinou, Office 302, 8020, Paphos, Republic of Cyprus
Data you provide directly: name, email, phone number and the content of your enquiry, submitted via the contact form, newsletter sign-up, the Insights report download form, live chat, WhatsApp/Viber/Telegram, "Sign in with Google", property marketplaces or our social media pages. Where you contact us through a third-party channel (Google, WhatsApp, a messaging app, or a social network), that provider also processes your data as an independent controller under its own privacy policy.
Data collected automatically: IP address, browser and device information, and cookie data (see Section 4).
Data collected for a property transaction (AML/KYC): once you become a client in a purchase or sale transaction, we additionally collect an identification document, proof of address, source of funds/wealth information, PEP status where applicable, and bank details, as required by anti-money laundering law.
| Purpose | Legal basis | Explanation |
|---|---|---|
| Handling enquiries / contact forms | Art. 6(1)(b) | Responding to you, property consultation |
| Entering into and performing a service agreement | Art. 6(1)(b) | Transaction support, documentation |
| Identity verification / due diligence (AML/KYC) | Art. 6(1)(c) | Cyprus Law 188(I)/2007, EU AML Directives |
| Marketing communications | Art. 6(1)(a) | Only after explicit opt-in, revocable anytime |
| Website analytics | Art. 6(1)(f) / (a)* | Consent needed for non-essential cookies |
| Website security, fraud prevention | Art. 6(1)(f) | Protecting infrastructure and users |
| Other legal obligations | Art. 6(1)(c) | Tax reporting, authority or court requests |
We use strictly necessary cookies (no consent required), and analytics and marketing cookies (set only with your consent). On your first visit, a consent banner lets you accept or reject each non-essential category, and you can change your choice at any time using the Cookie Settings icon in the bottom-left corner of the website. Cookies are processed under Cyprus Law 112(I)/2004 (the ePrivacy Directive).
Newsletter sign-up requires an explicit opt-in, separate from any other consent. Every email includes an immediate unsubscribe link, and you may withdraw consent at any time free of charge, without affecting the lawfulness of processing carried out before withdrawal.
The data described in Section 2 for property transactions is processed on the basis of legal obligation (Art. 6(1)(c) GDPR) under Cyprus Law 188(I)/2007 and applicable EU AML Directives. It may be shared with competent authorities (including MOKAS), banks, to the extent necessary for the transaction. Providing this data is a legal requirement — without it, the transaction cannot proceed.
| Data category | Retention period |
|---|---|
| Enquiries/leads with no resulting transaction | 12 months from last contact |
| Clients with completed transactions, AML file | 5 years from end of business relationship (may be extended if required by law) |
| Marketing newsletter data | Until consent is withdrawn |
| Analytics and marketing cookies | Up to 24 months, or per platform settings |
We share data, as needed, with: IT/hosting/CRM and email-marketing providers; the live chat, messaging (WhatsApp/Viber/Telegram) and Google sign-in providers described in Section 2; the property developer or seller, to arrange viewings and negotiations; the client's or other parties' lawyers, where involved in a transaction; banks, where you request assistance arranging financing; competent authorities including MOKAS, where required by law; and our legal, tax and audit advisors. Where a recipient is located outside the EEA, we ensure an adequate level of protection through Standard Contractual Clauses, an adequacy decision, or another safeguard under Articles 44–49 GDPR.
Under Articles 15–22 GDPR, you have the right to access, rectify, erase, or restrict your data, to data portability, to object to processing (including direct marketing), and to withdraw consent at any time without affecting prior processing. We do not use automated decision-making or profiling that produces legal effects on you. To exercise your rights, contact us using the details in Section 1; we respond within one month, extendable by two months for complex requests.
You have the right to lodge a complaint with the Cyprus Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy), or with the supervisory authority of your habitual residence.
We apply appropriate technical and organisational measures, including encryption in transit, restricting access to personal data to authorised staff, and confidentiality obligations for our staff. In the event of a personal data breach, we will notify the supervisory authority within 72 hours and affected individuals where required, in accordance with Articles 33–34 GDPR. This website is not directed at individuals under 18, and we do not knowingly collect their data. We may update this Policy from time to time; material changes will be announced via a notice on this website before they take effect, and the revision date appears at the top of this document.
Russian
German
Hebrew
Greek
French
Italian
Spanish
Arabic
Serbian
