Privacy Policy
Last updated: 27 August 2025
1. Introduction
Welcome to Realty.com.cy (the “Platform”), your trusted real estate marketplace in Cyprus. We value your privacy and are committed to protecting your personal data. This Privacy Policy explains how your information is collected, used, shared, and safeguarded when you use our Platform. It also outlines your rights under the EU General Data Protection Regulation (GDPR).
2. Who operates Realty.com.cy?
The Platform is operated by RimaTech Ltd, a company registered in the Republic of Cyprus (Company No. HE 439114). For the purposes of data protection law, RimaTech Ltd is the controller of your personal data when you interact with the Platform.
In practical terms, you’ll mostly see us as “Realty.com.cy” in communications. Behind the scenes, RimaTech Ltd is the legal entity responsible for safeguarding your data and ensuring compliance with GDPR.
By using the Platform, you agree to this Privacy Policy as well as our Terms & Conditions and Cookies Policy.
3. Controller & Contact Details
- Controller: RimaTech Ltd
- Registered address: Bridge Tower, Alexandrias 2–4, Limassol 3013, Cyprus
- General enquiries: info@realty.com.cy
- Privacy/Data protection: info@rimatech.com.cy (please mark as “DPO – Privacy Request”)
4. Scope & Audience
This Policy applies to visitors and registered users of the Platform, including those who browse listings or create an account (“users”) and those who advertise properties (“listing users”). The Platform is intended for individuals aged 18+. We do not knowingly collect data from children under 18.
5. Personal Data We Collect
5.1 Categories of data
- Identification & contact: name, email, phone, preferred language.
- Account (“Cabinet”) data: login details, profile settings, saved searches, wishlists/favourites.
- Leads & communications: enquiries you send to agents/developers, viewing requests, feedback, support tickets.
- Search & usage data: pages viewed, searches run, clicks, time on page, referring URL, approximate IP-derived location, device and browser data.
- Marketing preferences: subscription status, consent signals, opt-out choices.
- Cookies & similar tech: identifiers stored/read on your device (see Cookies Policy).
- Surveys & feedback: questionnaire responses, ratings, comments.
- Telephone interactions: notes taken to handle your request; we do not retain call recordings.
No special categories: We do not require or intend to collect special categories of data (e.g., health, religious beliefs). Please avoid including such information in free-text fields.
Property data vs personal data: listing attributes (price, area, features, photos/plans) relate to the property. Personal data identifies an individual (e.g., a contact name/number placed in a listing).
6. Why We Process Your Data & Legal Bases
We only process personal data where we have a valid legal basis under EU/EEA GDPR.
| Purpose | Examples | Legal basis |
|---|---|---|
| Provide the Platform & account features | Registration, login, saving searches/favourites, sending enquiries, arranging viewings | Contract (Art. 6(1)(b)) for core features; Legitimate interests (Art. 6(1)(f)) to run and secure the service |
| Facilitate connections between users and listing users | Forwarding your enquiry/contacts to an agent/developer and vice-versa | Contract when you request this; otherwise legitimate interests in enabling marketplace interactions |
| Customer support & service communications | Responding to messages, troubleshooting, service notices, security alerts | Legitimate interests; Legal obligation where applicable |
| Personalise experience & recommend content | Tailored search results, similar listings, reminders | Legitimate interests (relevance, UX improvement) |
| Marketing communications | Newsletters, product updates, offers | Consent (Art. 6(1)(a)) where required; legitimate interests for similar-product emails to existing customers (opt-out anytime) |
| Analytics & performance | Measuring feature use, improving UI/UX | Consent for non-essential cookies/SDKs; legitimate interests for aggregated, strictly-necessary measurement |
| Adtech & measurement | Delivering and assessing ads on/around the Platform | Consent for audience/behavioural ads; legitimate interests for basic non-personalised ads/frequency capping where permitted |
| Fraud prevention & security | Abuse detection, incident response | Legitimate interests; Legal obligation where applicable |
| Compliance & enforcement | Handling complaints, enforcing terms, regulatory/tax retention | Legal obligation; legitimate interests |
Right to object: Where we rely on legitimate interests, you may object at any time. Where we rely on consent, you may withdraw it at any time without affecting prior lawful processing.
7. How We Share Personal Data
- With listing users (independent controllers): when you request information, book a viewing, or interact with a listing, we share your contact details and enquiry so they can respond. They become independent controllers for their reply and subsequent processing.
- Service providers (processors): hosting/cloud, CRM/helpdesk, email/SMS delivery, analytics, anti-fraud/security, payments (if applicable). We sign data processing agreements and require confidentiality and security.
- Adtech partners: with your consent where required, to deliver and measure advertising (see Cookies & Adtech).
- Corporate & legal: professional advisors, auditors, authorities or courts where required by law, to protect rights, or in a merger/acquisition/asset transfer.
We do not sell your personal data.
8. Lead Generation & Billing Model
When you submit a property enquiry (for example, by clicking “Arrange Viewing” or “Request Details”), we share your contact details and enquiry message with the relevant listing user (such as an estate agent or developer) so they can respond to you directly.
- Your enquiry is free of charge to you as a visitor.
- The listing user pays us for receiving your enquiry as a warm lead.
- The listing user becomes an independent controller of your personal data for their reply and follow-up (their privacy notice applies).
We maintain contractual safeguards to ensure that listing users only use your contact details to respond to your enquiry and not for unrelated marketing unless you give them separate consent.
9. International Transfers
Some providers may be located outside the EEA. Where we transfer personal data internationally, we use EU Standard Contractual Clauses (SCCs) and, where needed, supplementary measures, or rely on an adequacy decision.
10. Retention
- Account data: kept while your account is active; if inactive for 24 months we may notify you and delete the account.
- Leads & communications: typically 12–24 months; longer if required for dispute handling or legal obligations.
- Marketing data: until you unsubscribe/opt-out.
- Analytics & cookies data: per cookie lifespan (see Cookies Policy), typically 1–13 months for analytics identifiers, shorter for session cookies.
- Legal/compliance records: per mandatory retention periods (e.g., tax/accounting).
11. Cookies & Adtech (Summary)
We use cookies and similar technologies to operate the site, remember preferences, measure performance, and—where you consent—deliver personalised advertising. Examples of partners include Google Analytics/Ads and Segment. Details of cookies, purposes, lifespans and how to manage settings are in our Cookies Policy and consent banner.
- Essential cookies are required to provide the service; you cannot opt-out via the banner (you may block them in your browser, but the site may not work properly).
- Analytics/advertising cookies are used with your consent. You can change your choices in the consent banner at any time.
- We may use audience segments derived from Platform activity to show more relevant content/ads. We do not provide advertisers with your direct identifiers for their own use.
12. Your Rights (EEA/EU GDPR)
Subject to conditions and exemptions, you have the right to:
- Access your personal data and obtain a copy
- Rectify inaccurate data
- Erase data (“right to be forgotten”)
- Restrict processing
- Data portability (for data you provided)
- Object to processing based on legitimate interests (including profiling) and to direct marketing at any time
- Withdraw consent where processing is based on consent
- Not be subject to a decision based solely on automated processing producing legal or similarly significant effects
To exercise your rights, contact us at info@rimatech.com.cy with proof of identity. We will respond within one month (extendable by two months for complex requests).
Lodging a complaint: You may contact the supervisory authority: Office of the Commissioner for the Protection of Personal Data, Cyprus — commissioner@dataprotection.gov.cy — www.dataprotection.gov.cy.
13. Security
We implement appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, secure development practices, staff training and vendor diligence. No system is perfectly secure; we continuously assess and improve our safeguards.
13.1. Vulnerability Disclosure (Responsible Reporting)
If you believe you have found a security issue, please report it to info@rimatech.com.cy with steps to reproduce. Please avoid accessing or exfiltrating data, disrupting services, or public disclosure before remediation. We do not currently offer monetary bounties.
14. Links to Third-Party Sites
The Platform may link to third-party websites. Their privacy policies apply to their processing; we are not responsible for their practices. Please review their notices before sharing data with them.
15. Changes to This Policy
We may update this Policy from time to time. Material changes will be communicated via the Platform or by email where appropriate. Please check the “Last updated” date.
16. Contact Us
- General enquiries: info@realty.com.cy
- Privacy/Data protection: info@rimatech.com.cy (subject: DPO – Privacy Request)
- Postal: Data Protection Officer, RimaTech Ltd, Bridge Tower, Alexandrias 2–4, Limassol 3013, Cyprus
Short Glossary
- Controller / Processor: the entity deciding the purposes/means of processing (controller) or processing data for a controller (processor).
- Personal data: information relating to an identified or identifiable person.
- Adtech: technologies used to deliver, bid for and measure digital advertising.
- Cookies: small files placed on your device to remember settings and track activity.