This Privacy and Personal Data Protection Policy explains how G&P LAZAROU ESTATE AGENTS LTD ("G&P", "we", "us" or "our") collects, uses, stores, shares and otherwise processes personal data.
This Policy also explains the rights available to individuals whose personal data we process and how they may contact us regarding the use of their personal data.
G&P processes personal data in accordance with:
This Policy applies to users of our website, customers, prospective customers, property owners, vendors, purchasers, bidders, tenants, landlords, applicants to our Real Estate Academy, visitors to our offices and other individuals who interact with us.
The controller responsible for the processing described in this Policy is:
G&P LAZAROU ESTATE AGENTS LTD
Athalassas Avenue 174, 2025, Strovolos, Nicosia, Cyprus
Telephone: +357 22 024949
Email for data protection enquiries: dataprotection@gplazarou.com
Website: www.gplazarou.com, including its language versions and subdomains.
All data protection matters, including requests to exercise the rights described in section 17, should be addressed to dataprotection@gplazarou.com.
G&P Lazarou Property Valuation LLC is a separate legal entity and acts as a separate controller in respect of the personal data it processes for valuation services, including data collected through the valuation pages hosted on this Website. This Policy does not cover that processing.
Where another person or organisation independently determines how and why personal data is processed, that person or organisation may also act as a separate controller.
For the purposes of this Policy:
Applicable Law means the GDPR, Law 125(I)/2018, the laws and regulations of the Republic of Cyprus and any other applicable data protection, privacy, electronic communications or sector-specific legislation.
Controller means the person or organisation that determines the purposes and means of processing personal data.
Personal Data means any information relating to an identified or identifiable natural person. Personal Data may include a person’s name, identification details, contact details, online identifiers, financial information and other information that can directly or indirectly identify that person.
Processing means any operation performed on Personal Data, including collection, recording, organisation, storage, consultation, use, disclosure, transfer, alteration, restriction or deletion.
Processor means a person or organisation that processes Personal Data on behalf of a Controller.
Property means a property offered for sale, rent or other property-related transaction, including, where applicable, a property offered through an electronic auction.
Special Categories of Personal Data means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric information used for identification, health information or information concerning a person’s sex life or sexual orientation.
Third Party means a person or organisation other than the relevant data subject, G&P or a person authorised to process Personal Data on behalf of G&P.
User means any person who accesses or uses the Website or otherwise interacts with G&P.
Vendor means the owner or authorised seller of a Property.
Website means www.gplazarou.com, including its language versions, pages, portals and subdomains.
Depending on the nature of a person’s relationship with G&P, we may collect the following categories of Personal Data.
This may include:
This may include:
This may include:
This may include:
Payment card information may be processed directly by authorised payment service providers and may not be stored by G&P.
A User may provide us with information relating to another person, such as a joint purchaser, co-owner, representative, family member, tenant, landlord or authorised contact.
A person providing Personal Data about someone else should ensure that they are authorised to do so and, where required, that the other person has been properly informed.
This may include:
This may include:
CCTV images may be collected at G&P premises for physical security, access control, the protection of individuals and property, and the prevention and investigation of fraud or crime.
Appropriate notices are displayed where CCTV is in operation.
G&P does not ordinarily seek to collect Special Categories of Personal Data unless such processing is necessary and permitted by law.
Information appearing on an identification document is not automatically Special Category Data. However, an identification document may contain information requiring enhanced protection.
Where Special Categories of Personal Data are processed, G&P will identify both:
Where an individual applies to the G&P Lazarou Real Estate Academy, applies for a position with G&P or expresses an interest in working with us, we may collect:
This information is processed on the basis of pre-contractual measures taken at the request of the individual, our legitimate interest in assessing suitability, and, where applicable, compliance with a legal obligation.
We may collect Personal Data:
WhatsApp is offered on the Website as a contact method. Where an individual contacts us through WhatsApp, the message content and the sender’s WhatsApp number are received by us. WhatsApp is operated by Meta Platforms Ireland Limited under its own privacy terms, over which G&P has no control. Section 13 explains the position on transfers outside the European Economic Area.
We only process Personal Data where we have an appropriate lawful basis. Depending on the circumstances, we may rely on one or more of the following lawful bases.
We may process Personal Data where necessary:
We may process Personal Data where necessary to comply with:
We may process Personal Data where necessary for our legitimate interests or those of a Third Party, provided that those interests are not overridden by the individual’s rights and freedoms.
Our legitimate interests may include:
Where we rely on legitimate interests, we assess whether the processing is necessary, proportionate and reasonably expected.
We may rely on consent where required, including for:
Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Where legally applicable, we may process Special Categories of Personal Data where:
Where permitted by law, G&P may use contact details to send information regarding properties, services, events or other matters that may be of interest.
Electronic direct marketing will be based on:
Every electronic marketing message provides an appropriate method for opting out.
An individual may object to direct marketing or withdraw marketing consent at any time by:
An objection to direct marketing does not prevent us from sending essential service, contractual, security or legal communications.
The Website uses cookies, pixels, local storage and similar technologies.
These technologies may be used to:
Strictly necessary cookies may be used without consent where permitted by law.
Non-essential cookies, including analytics and advertising cookies, are activated only after the User has provided valid consent, where consent is legally required.
Through the Website’s cookie-preference tool, a User can:
Further information is set out in our Cookie Policy, available at www.gplazarou.com/cookie-policy.
Where tools such as Google Analytics are used, their activation and configuration reflect the User’s cookie choices and applicable legal requirements.
G&P may record telephone calls only where there is an appropriate lawful basis and the caller has been informed.
Recordings may be used for:
CCTV may be operated at G&P premises for security and crime-prevention purposes.
Telephone recordings and CCTV images are retained for a limited period determined by the security, quality-assurance or crime-prevention purpose for which they were collected, unless a longer period is required in connection with an incident, complaint, investigation or legal claim.
G&P does not make decisions producing legal or similarly significant effects solely through automated processing of Personal Data.
The Website offers an assisted search function that interprets a User’s search request in order to return relevant property listings. This function processes the search text and filters submitted by the User. It does not evaluate the User, does not produce a decision about the User and does not affect any right or entitlement. Its purpose is limited to presenting property results.
G&P may use analytics for statistical, operational, security and business-improvement purposes.
Where possible and appropriate, information used for analytics is aggregated, anonymised or pseudonymised.
If G&P introduces automated decision-making that falls within Article 22 of the GDPR, this Policy will be updated and affected individuals will be provided with the information and safeguards required by law.
G&P shares Personal Data only where necessary, proportionate and lawful. Recipients may include:
This may include lawyers, attorneys-in-fact, family representatives, advisers and other persons authorised by the individual.
Where necessary, Personal Data may be shared with:
We disclose only the information reasonably necessary for the relevant transaction.
These may include:
Processors acting on our behalf are required to process Personal Data only in accordance with our documented instructions, maintain confidentiality and apply appropriate security measures.
Where required or permitted by law, information may be disclosed to:
If G&P considers or completes a merger, acquisition, sale, restructuring or transfer of all or part of its business or assets, relevant Personal Data may be disclosed to prospective parties and their advisers under appropriate confidentiality and data protection safeguards.
For the purposes of this section, a Business Day means a day other than a Saturday, Sunday or public holiday on which banks in the Republic of Cyprus are open for business.
Legal or transaction documentation relating to a Property may be made available on the Website or through another secure platform for due diligence.
Such documentation may be uploaded by licensed lawyers or other authorised professionals acting for a Vendor.
We limit access to what is necessary for the relevant transaction and, where appropriate, restrict access to registered or authorised persons.
We review documentation before publication in order to reduce unnecessary disclosure of Personal Data.
Where a Property is offered through an auction, documentation may remain available during the marketing period.
If a Property is sold or withdrawn before the auction, the documentation may be removed earlier. If the Property remains unsold, documentation may remain available for up to seven Business Days following the auction, unless another period is legally or operationally required.
Personal Data may be stored or processed within the European Economic Area ("EEA").
Some service providers or their sub-processors may process Personal Data outside the EEA. This includes WhatsApp, operated by Meta Platforms Ireland Limited, where an individual chooses to contact us through that service, and may include providers of website hosting, analytics and communication services.
Where Personal Data is transferred to a country outside the EEA, G&P ensures that an appropriate transfer mechanism is used, where required. This may include:
Where appropriate, G&P assesses the legal and practical circumstances of the transfer and implements supplementary technical, contractual or organisational safeguards.
An individual may contact us at dataprotection@gplazarou.com to request further information regarding the safeguards applying to a relevant transfer.
G&P retains Personal Data only for as long as necessary for the purposes for which it was collected and to meet applicable legal, regulatory, accounting, contractual and operational requirements.
Retention periods may depend on:
As a general rule, client identification, due diligence and transaction records are retained for at least five years from the end of the business relationship or the completion of the transaction, in accordance with Cyprus anti-money laundering legislation. Accounting and tax records are retained for the period required by Cyprus tax and company law. Certain records may need to be retained for a longer period where required or permitted by law.
Marketing contact details are retained until consent is withdrawn or an objection to direct marketing is received.
When Personal Data is no longer required, it is securely deleted, destroyed or irreversibly anonymised.
A deletion request will be considered in accordance with the GDPR. The right to erasure is not absolute and does not apply where continued retention is legally required or otherwise permitted.
G&P applies appropriate technical and organisational measures designed to protect Personal Data against:
Measures may include:
No system can guarantee complete security. Where a Personal Data breach occurs, G&P will assess the incident and make any notifications required by law.
An individual is not always legally required to provide Personal Data.
However, where information is necessary to enter into or perform a contract, to provide a requested service, to verify identity, to comply with anti-money laundering requirements, to process a transaction, to register a bid, or to comply with another legal obligation, failure to provide the information may mean that G&P cannot provide the relevant service, continue the relationship or complete the requested transaction.
Where providing information is optional, this will be made clear where appropriate.
Subject to the conditions and limitations of the GDPR, an individual may have the right to:
Request confirmation as to whether G&P processes their Personal Data and obtain access to that information.
Request correction of inaccurate Personal Data and completion of incomplete Personal Data.
Request deletion of Personal Data in circumstances provided by law.
Request restriction of processing in circumstances provided by law.
Object to processing based on legitimate interests or the performance of a task carried out in the public interest.
G&P will stop the relevant processing unless it demonstrates compelling legitimate grounds overriding the individual’s interests, rights and freedoms or the processing is required for legal claims.
Object at any time to processing for direct marketing purposes.
Receive certain Personal Data in a structured, commonly used and machine-readable format and request transmission to another controller where processing is based on consent or contract and is carried out by automated means.
Withdraw consent at any time where processing is based on consent.
Request safeguards in relation to decisions based solely on automated processing where such decisions produce legal or similarly significant effects.
Lodge a complaint with the Office of the Commissioner for Personal Data Protection or another competent supervisory authority.
Requests may be submitted to dataprotection@gplazarou.com or using the other contact details in section 2.
To protect Personal Data, G&P may request reasonable information to verify the requester’s identity and authority.
G&P will respond without undue delay and normally within one month of receiving a valid request.
Where a request is complex or a large number of requests has been received, the response period may be extended by up to two additional months. The requester will be informed of the extension and the reasons for it within the initial one-month period.
Requests are generally handled free of charge. Where a request is manifestly unfounded or excessive, particularly because it is repetitive, G&P may charge a reasonable fee or refuse to act, as permitted by law.
An individual who is dissatisfied with the way G&P has handled their Personal Data or a data protection request may submit a complaint to dataprotection@gplazarou.com.
We will acknowledge the complaint and respond substantively within the periods set out in section 18. Submitting a complaint to us does not affect the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection at any time.
The Website may contain links to third-party websites, platforms, services or social media pages, including Facebook, Instagram, YouTube, LinkedIn, TikTok and X.
Third-party websites operate under their own privacy notices and terms. G&P is not responsible for the privacy, security or content practices of independent third parties.
The Website may include third-party plugins, embedded content, social-media buttons or login features. Those services may collect information directly from the User and are governed by the relevant provider’s privacy terms.
Users are encouraged to review the privacy information of each third party before submitting Personal Data or enabling a third-party feature.
G&P’s general services and Website are not intended to be directed at children.
G&P does not knowingly collect Personal Data from children for marketing or account-registration purposes without an appropriate legal basis and, where required, authorisation from a person holding parental responsibility.
Where a transaction involves a minor, relevant Personal Data may be processed where necessary for legal, contractual, property or representation purposes and subject to appropriate safeguards.
G&P may update this Policy from time to time to reflect:
The updated Policy will be published on the Website with a revised "Last updated" date.
Where required by law, we will provide additional notice or obtain consent before materially changing the way Personal Data is processed.
Questions, complaints and requests relating to this Policy or the processing of Personal Data may be addressed to:
G&P LAZAROU ESTATE AGENTS LTD
Email: dataprotection@gplazarou.com
Telephone: +357 22 024949
Address: Athalassas Avenue 174, 2025, Strovolos, Nicosia, Cyprus
An individual may lodge a complaint with:
Office of the Commissioner for Personal Data Protection
Office address: 15 Kypranoros Street, 1061 Nicosia, Cyprus
Postal address: P.O. Box 23378, 1682 Nicosia, Cyprus
Telephone: +357 22 818456
Email: commissioner@dataprotection.gov.cy
Website: www.dataprotection.gov.cy