Privacy Policy

1. Introduction

This Privacy Policy explains how Touloupis Real Estate Ltd, a licensed Cyprus real estate agency (Registered Real Estate Agent Reg. 1273 | Licence No. 624), collects, uses, stores and protects personal data when you visit this website, submit an enquiry, request the Cyprus Tax Guide 2026, contact us by WhatsApp, phone or email, or otherwise communicate with us in relation to real estate brokerage services in Cyprus.

We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") and the Cyprus law supplementing the GDPR, the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data Law of 2018 (Law 125(I)/2018), as amended.

Touloupis Real Estate Ltd acts as the data controller for personal data collected through this website, unless otherwise stated.

2. Contact details

Data controller: Touloupis Real Estate Ltd
Registered Real Estate Agent Reg. 1273 | Licence No. 624
Cyprus

Data protection contact: polys.cy@cytanet.com.cy
Phone: +357 99 457 228

3. Personal data we may collect

We may collect and process the following categories of personal data:

• full name
• email address
• phone number / WhatsApp number
• country
• preferred area
• enquiry type
• property requirements
• budget, asking price or rent range where provided
• preferred timeline
• message content submitted through website forms
• consent preferences, including enquiry consent, email marketing consent and WhatsApp marketing consent
• source of enquiry, such as Contact page enquiry form, property enquiry or Cyprus Tax Guide 2026 form
• date and time of submission
• communication records, including email, WhatsApp, phone or contact form correspondence
• technical information such as IP address, browser type, device type and cookie preferences, where applicable
• where a transaction proceeds, identity verification and compliance information required by law, such as proof of identity, proof of address, beneficial ownership details and source-of-funds information (see Section 6 — Anti-money-laundering obligations). This information is collected directly during a transaction and is not requested through this website's general enquiry forms.

4. How we collect personal data

We collect personal data when you:

• complete the Contact page enquiry form
• request the Cyprus Tax Guide 2026
• contact us by WhatsApp, phone or email
• enquire about a property listing
• request an appraisal
• submit buyer, tenant, seller or landlord requirements
• interact with the website
• give or update cookie preferences
• consent to email or WhatsApp updates
• provide documentation in the course of progressing a property transaction

5. Purposes of processing

We process personal data for the following purposes:

• to respond to property enquiries
• to respond to requests for the Cyprus Tax Guide 2026
• to communicate with buyers, sellers, landlords, tenants, owners, developers and referral partners
• to prepare property shortlists and coordinate viewings
• to follow up on seller, landlord, buyer or tenant requirements
• to manage transaction-related communication through the licensed agency
• to keep a record of enquiries and consent preferences
• to improve website functionality and user experience
• to manage website security and technical operation
• to send email or WhatsApp updates only where the user has separately opted in
• to perform identity verification and customer due diligence where required under anti-money-laundering legislation
• to comply with legal, regulatory, accounting or professional obligations where applicable

6. Anti-money-laundering obligations

Licensed real estate agents in Cyprus are designated as obliged entities under the Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (Law 188(I)/2007), as amended.

Where we act in relation to the purchase or sale of immovable property, and where applicable when acting as intermediaries in the letting of immovable property, including high-value rental transactions falling within the scope of applicable anti-money-laundering legislation, we may be required by law to carry out customer due diligence ("CDD") and "know your customer" ("KYC") checks. This may include verifying the identity of clients and, where applicable, the ultimate beneficial owners of corporate buyers, and obtaining information on the source of funds.

We process this information to comply with our legal obligations, retain it for the period required by law, and may be required to share it with, or report it to, the competent authorities, including the Unit for Combating Money Laundering (MOKAS), where the law so requires. Where a report is required by law, we may be prohibited from informing the client that a report has been or will be made.

This compliance information is collected only where a transaction proceeds. It is not requested through the website's general enquiry or Tax Guide forms.

7. Legal bases for processing

We process personal data under one or more of the following legal bases:

Consent: Where you request the Cyprus Tax Guide 2026, opt in to email updates, opt in to WhatsApp updates, or give consent for optional analytics or marketing cookies.

Contractual necessity or steps prior to a contract: Where processing is necessary to respond to property enquiries, arrange viewings, coordinate negotiations or support real estate brokerage services requested by you.

Legitimate interests: Where processing is necessary for ordinary business communication, enquiry management, fraud prevention, website security, service improvement, record-keeping and professional follow-up, provided that such interests are not overridden by your rights and freedoms.

Legal obligation: Where processing is required to comply with applicable legal, regulatory, accounting, anti-money-laundering or professional obligations.

8. Marketing communications

We do not treat a request for the Cyprus Tax Guide 2026 as automatic subscription to marketing communications. Email updates and WhatsApp updates are optional and separate.

You may choose whether to receive occasional Cyprus real estate market updates, selected property opportunities and relevant guides. You may unsubscribe or opt out at any time by contacting: polys.cy@cytanet.com.cy

For WhatsApp, you may also reply with "STOP" or otherwise clearly request that we stop sending WhatsApp updates.

9. Sharing personal data

We may share personal data where necessary with:

• professional advisers engaged independently by clients, such as lawyers, accountants, surveyors, architects, engineers or town planners, where relevant to a transaction and with appropriate context
• property owners, developers, landlords, buyers, tenants or referral partners where necessary to progress an enquiry or transaction
• website hosting, email, form submission, analytics, cookie consent, security and IT service providers
• regulatory, legal, tax, anti-money-laundering or public authorities where required by law

Touloupis Real Estate Ltd does not sell personal data.

10. Independent professionals

Where clients engage independent lawyers, accountants, surveyors, architects, engineers or other advisers, such professionals act independently and are responsible for their own advice, services, professional duties and data protection obligations. Touloupis Real Estate Ltd does not replace their role.

11. International transfers

Some website, email, hosting, analytics, form, cookie or technology service providers may process data outside Cyprus or the European Economic Area. Where this occurs, we aim to rely on appropriate safeguards, such as adequacy decisions, standard contractual clauses or other lawful transfer mechanisms, where required.

12. Data retention

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including enquiry handling, transaction follow-up, legal, regulatory, accounting and professional record-keeping purposes.

General website enquiries may be retained for a reasonable business period unless a longer period is required for legal or professional reasons. Records collected for anti-money-laundering and customer due diligence purposes are retained for the minimum period required by law (currently at least five years following the end of the business relationship or the completion of the transaction), or longer where the law so requires. Marketing consent records may be retained for as long as necessary to demonstrate consent or opt-out status.

13. Your rights

Subject to applicable law, you may have the right to:

• request access to your personal data
• request correction of inaccurate personal data
• request deletion of personal data
• request restriction of processing
• object to processing
• withdraw consent where processing is based on consent
• request data portability where applicable
• lodge a complaint with the competent supervisory authority

Some of these rights may be limited where we are required to retain data to comply with a legal obligation, including anti-money-laundering record-keeping.

To exercise your rights, contact: polys.cy@cytanet.com.cy

14. Automated decision-making

We do not make decisions producing legal effects, or similarly significant effects, concerning you based solely on automated processing, including profiling.

15. Children

This website and our services are intended for adults and are not directed at children. We do not knowingly collect personal data relating to children. If you believe a child has provided personal data to us, please contact polys.cy@cytanet.com.cy and we will take appropriate steps.

16. Supervisory authority

The supervisory authority for data protection in Cyprus is the Commissioner for Personal Data Protection (Office of the Commissioner for Personal Data Protection).

If you believe that your personal data has not been handled properly, you have the right to lodge a complaint with the Commissioner:

Office of the Commissioner for Personal Data Protection
15 Kypranoros Street, 1061 Nicosia, Cyprus

17. Cookies

This website uses essential cookies and may use optional analytics or marketing cookies only where consent is given. For further information, please see the Cookies Policy and the Cookie Preferences panel.

18. Security

We take reasonable technical and organisational measures to protect personal data. However, no method of transmission over the internet or electronic storage is completely secure.

19. Third-party links

This website may contain links to third-party websites, including social media platforms, professional services providers or property-related resources. We are not responsible for the privacy practices or content of third-party websites.

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this website with a revised "Last updated" date.

21. Contact

For privacy-related questions, contact: polys.cy@cytanet.com.cy