Privacy Policy

What personal data we collect when you read our guides, create an account, list a property or contact an advertiser — and what we do with it.

Last updated: 20 October 2026

1. Who we are

cyproperty.com ("CyProperty.com", "we", "us") is an online guide to buying, renting and investing in property in Cyprus, with a property listings section where registered members advertise properties for sale or rent. We are the data controller for the personal data described in this policy. We process it in line with the EU General Data Protection Regulation (GDPR) and Cyprus Law 125(I)/2018. Contact for all privacy matters: [email protected].

2. What we collect and why

Visiting the website

Our servers and our content-delivery and security provider (Cloudflare) process technical data such as your IP address, browser type, the pages requested and the time of the request. We use it to deliver the site, keep it secure (for example to block attacks and abusive traffic) and to fix errors. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). Server logs are kept only for a limited period and then deleted or rotated.

Visitor statistics

To understand how the site is used we count page views ourselves, without cookies. For each page view we store the page, the time, the referring website, your country (derived from your IP address by our content-delivery provider), your device type, browser and operating system, and an anonymous identifier that changes every day and cannot be traced back to you. We do not store your IP address for these statistics. Legal basis: our legitimate interest in running and improving the site (Art. 6(1)(f)). Statistics are kept for up to 25 months.

Member accounts

To list a property you create an account. We store your name, email address, optional phone number, a securely hashed password (we never store the password itself), the date and IP address of registration, and a security log of account activity (logins and failed login attempts, logouts, registration, email and mobile verification, password resets and account deletion) with the date and time, IP address, country and browser of each event. The security log is kept for 24 months. We email you a link to confirm your email address and, when you ask, a link to reset your password. Legal basis: performance of our agreement with you (Art. 6(1)(b)). Accounts that are never confirmed are deleted automatically after 14 days.

Mobile number verification (Telegram)

Advertisers verify their mobile number through our Telegram bot. When you start the verification, you open the bot in Telegram and choose to share the phone number of your own Telegram account; the bot then sends you a one-time code that you type on our site. We receive the phone number you share and your Telegram chat identifier, and we store the verified number on your account. The bot is also used by our sister site aggelies.my-gr.com, operated by the same team, and messages for CyProperty.com are passed to us. Telegram processes your use of its app under its own privacy policy (telegram.org/privacy). We keep verification records for 30 days. Legal basis: our legitimate interest in preventing fake listings and protecting buyers and tenants (Art. 6(1)(f)).

Property listings

Everything you put in a listing — title, description, price, location (city and area), property details, features and photos — is published on the website for everyone to see. Your phone number is shown on the listing only if you tick "Show my phone number". Your email address is never shown publicly. New and edited listings may be checked by our team before they go live. Please do not upload photos that show people, car number plates or other personal information. Listings that are removed, expired or rejected are deleted after 12 months; listings marked sold or let stay visible with a badge for 15 days. When you delete a listing or your account, its photos are deleted from our server.

Floor plans you add to a listing are published with it. Other documents you attach to a listing (for example title deeds, permits or contracts) are private: they are stored outside the public website and can be opened only by you, by the agency the listing belongs to and by our staff. They are deleted together with the listing. To help with disputes and abuse, we keep a history of changes to each listing (for example price, status and who made the change), also after the listing has expired or been sold.

Agent and agency profiles

Property managers who join as agents or agencies get a public profile page (for example /agents/<name> and /agencies/<name>). It shows what you or your agency choose to fill in — name, photo, job title, biography, public email, phone, WhatsApp, website, licence number, the agency's logo, address and company details — together with your live listings and, if granted, a verification badge. The agency's logo and company details are also shown on every listing of the agency. An agency property manager can invite team members by email (the invitation link expires), manage their listings and see the listing analytics of the agency. Legal basis: performance of our agreement with you (Art. 6(1)(b)).

Verification documents

Agents and agencies can ask for a verification badge. To do so you upload supporting documents (for example an estate agent licence, company registration certificate or ID). These documents are never published: they are stored outside the public website, are visible only to our authorised staff, and are used only to carry out the checks. We record which checks were carried out, when and by whom. Documents are deleted when you delete your account (or the agency is deleted), or earlier on request — although the badge may then be removed. Legal basis: our legitimate interest in protecting buyers and tenants from fake or unlicensed advertisers (Art. 6(1)(f)).

Favourites and price-drop alerts

Logged-in members can save listings as favourites. We store the list on your account and, if you have agreed to alert emails (see below), email you when the asking price of a favourite goes down. You can remove favourites or switch these emails off at any time. Legal basis: performance of our agreement with you (Art. 6(1)(b)) and, for the emails, your consent (Art. 6(1)(a)).

Saved searches and alert emails

You can save a property search (its filters, a name and how often you want to hear about it) and ask to be emailed when new matching listings appear. Alert emails are sent only after you have explicitly agreed to receive them by ticking a box; we store the date and time of your agreement. We send at most a few alert emails a day (currently 3) and never send the same property twice for the same reason. Every alert email contains a one-click unsubscribe link that works without logging in, and you can pause or stop all alerts in My account → Notifications. Withdrawing consent stops all alert emails and removes any that are waiting to be sent. We keep a log of the alerts sent (so nothing is sent twice) for 12 months. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.

Recently viewed listings

To show you the properties you looked at recently we store the ID numbers of up to 12 recently viewed listings in a cookie (cp_rv) in your browser. It contains no other information, is not used for advertising and expires after 180 days. You can clear it at any time from the recently viewed page or by deleting cookies in your browser.

Maps and place search (OpenStreetMap)

Property maps use map tiles from OpenStreetMap. When a map is shown, your browser loads the tiles directly from tile.openstreetmap.org, which therefore receives your IP address and browser information, as with any website you load content from. This is operated by the OpenStreetMap Foundation under its own privacy policy. When you search for a place on the map, or an advertiser sets a listing's location, the place name typed is sent from our server to the OpenStreetMap Nominatim service to find its coordinates; only the search text is sent — not your IP address or any account details. Listings can be shown on the map at their exact location or as an approximate area, as the advertiser chooses. Legal basis: our legitimate interest in showing where properties are (Art. 6(1)(f)).

Listing analytics

For each listing we count, per day, how often it was shown in results, opened, saved as a favourite, how often its phone or WhatsApp button was clicked and how many enquiries it received. These are aggregated totals only: they do not contain IP addresses or identify individual visitors. The advertiser (and, for agency listings, the agency) sees them in their dashboard. They are deleted with the listing.

Reporting a listing

Anyone can report a listing they believe is misleading, fraudulent or unavailable. We store the reason, any details you write, your email address only if you choose to give it (so we can get back to you), your member account if you are logged in, and your IP address (to prevent abuse of the report form). Only our staff see reports; the advertiser is not told who reported the listing. Reports are kept while the listing exists. Legal basis: our legitimate interest in keeping listings accurate and safe (Art. 6(1)(f)).

Enquiries to advertisers

When you contact an advertiser through a listing, we send your name, email address, optional phone number and message to the advertiser by email, so they can reply to you directly. We keep a copy to deal with spam and abuse, together with your IP address, and delete it after 24 months. Once the advertiser has your message, they use it under their own responsibility. Legal basis: taking steps at your request (Art. 6(1)(b)) and our legitimate interest in preventing abuse (Art. 6(1)(f)).

Contact form

Messages sent through our contact form (name, email, optional phone, subject and message) are emailed to our team so we can reply. We keep them only as long as needed to handle your request and any follow-up.

VIP listings and payments (PayPal)

Paid VIP placement is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A. You pay on PayPal's pages; we never see or store your card or bank details. PayPal sends us the payment status, amount, transaction ID and the email address of the PayPal account used, which we store with the order and the listing it applies to. Legal basis: performance of the contract (Art. 6(1)(b)) and our legal obligation to keep accounting records (Art. 6(1)(c)), which we keep for as long as tax law requires (currently up to 7 years) even if you delete your account. PayPal's privacy statement applies to the payment itself.

Spam protection (Google reCAPTCHA)

Registration, password reset, the contact form and enquiry forms are protected by Google reCAPTCHA v3. It works in the background and sends information about your device and your interaction with the page (including your IP address) to Google, which returns a score indicating whether the request is likely to come from a person or a bot. Google's Privacy Policy and Terms of Service apply. Legal basis: our legitimate interest in protecting the site and its users from spam and abuse (Art. 6(1)(f)).

Advertising (Google AdSense)

The site shows advertising through Google AdSense. Google and its partners may use cookies and similar technologies to show ads, measure them and prevent fraud, and — where you have agreed — personalise ads based on your visits to this and other websites. You can manage personalised advertising at adssettings.google.com and learn how Google uses data at policies.google.com/technologies/partner-sites.

Our Facebook Page

We share new articles and new property listings on the CyProperty.com Facebook Page. A post contains the listing title, price, location, main details, a short excerpt of the description and a link; Facebook shows the listing's first photo in the link preview. We do not post advertisers' names, email addresses or phone numbers. If you interact with our Page, Meta Platforms Ireland Ltd. processes that data under its own policies, and Meta and we are joint controllers for Page insights. If you would like a listing not to be shared on Facebook, email us.

Share buttons

Our share buttons are plain links. Nothing is sent to Facebook, X or LinkedIn until you click one.

3. Cookies and similar technologies

  • Session cookie (cp_mem): keeps members logged in (up to 30 days) and holds the security token of our forms (for example the enquiry form on a listing). Strictly necessary; it contains no personal data itself.
  • Recently viewed (cp_rv): the ID numbers of listings you viewed recently, so we can show them to you again. Functional; expires after 180 days.
  • Map tiles: maps load images from OpenStreetMap, which receives your IP address (see above). OpenStreetMap does not set advertising cookies.
  • Security / bot protection: Cloudflare and Google reCAPTCHA may set cookies or read device information to detect abuse.
  • Advertising: Google AdSense cookies, as described above.

When you first visit, a banner asks for your consent. Until you choose, Google is told to use no advertising or analytics cookies and ad requests are paused; if you reject, only non-personalised ads are shown. Your choice is stored in your browser (local storage key cp_consent). You can change it at any time via Cookie settings in the footer. You can also delete or block cookies in your browser settings; logging in will then not work.

4. Who receives your data

We do not sell personal data. We share it only with: advertisers you contact (your enquiry) and, for agency listings, the agency's managers; our hosting provider and Cloudflare (to run the site); Google (reCAPTCHA, AdSense); PayPal (payments); Telegram (mobile verification); Meta (our Facebook Page); the OpenStreetMap Foundation (map tiles and place search, as described above); and our email providers, which deliver the emails described above. Some of these providers are based in, or transfer data to, countries outside the EU/EEA such as the United States. Where they do, the transfer relies on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. We may also disclose data where the law requires it.

5. How long we keep data

  • Accounts: until you delete them (unconfirmed accounts: 14 days).
  • Listings: while live; removed, expired or rejected ones are deleted after 12 months.
  • Enquiries: 24 months.
  • Favourites, saved searches and alert settings: until you delete them or your account.
  • Log of alert emails sent: 12 months.
  • Private listing documents, listing analytics and listing reports: deleted with the listing.
  • Verification documents: until you delete your account or the agency is deleted, or earlier on request.
  • Recently viewed cookie (cp_rv): 180 days in your browser.
  • Account security log (logins etc.): 24 months.
  • Visitor statistics (no IP addresses): 25 months.
  • Mobile verification records: 30 days.
  • Payment records: as long as tax law requires (currently up to 7 years).
  • Server and security logs: a limited period, then deleted or rotated.

6. Your rights

You can ask for access to your data, correction, deletion, restriction of processing, a copy in a portable format, and you can object to processing based on our legitimate interests. You can edit your profile and listings at any time and delete your account yourself under My account → Profile, which also deletes your listings and photos. For any other request email [email protected]; we answer within one month. You also have the right to complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy).

7. Security

All pages use encrypted connections (HTTPS). Passwords are stored only as strong one-way hashes, uploaded photos and floor plans are re-processed to remove embedded data (including camera location), private documents are stored outside the public website, and access to our admin area is restricted to authorised staff.

8. Children

Accounts are for adults (18+). We do not knowingly collect data from children.

9. Changes

We will update this page when our services change, and show the date of the latest version at the top. Significant changes will be announced on the site or by email to members.

10. Contact

Questions about privacy or this policy: [email protected].