Privacy
GDPR & privacy notice
What personal data we hold, why we hold it, and the rights you have over it.
This notice is maintained by Starmax Real Estate Agency and explains our own data practices under Regulation (EU) 2016/679 (GDPR) and Cyprus Law 125(I)/2018. Last updated: July 2026.
Who is the data controller
Starmax Real Estate Agency, Eleftherias 24 Avenue, Apt. 101, 7101 Larnaca, Aradippou, Cyprus. Registration No. 1267, Licence No. 514/Ε. For any privacy matter contact starmax@starmax.cy or +357 24 53 17 42.
What data we collect
- Enquiry data — name, phone, email and the message you send through our forms or chat.
- Property owner / client data — contact details and property details you give us so we can market or find a property.
- Messaging data — the content of conversations you start on WhatsApp, Viber or Messenger with us.
- Technical data — IP-derived usage data, device and browser information, and cookie identifiers (see the cookies policy).
- Account data — email and role, for staff using our internal CRM.
Why we use it and the legal basis
- To answer enquiries and arrange viewings — steps taken at your request before a contract.
- To provide agency services — performance of our agreement with you.
- To match you with suitable properties and improve the site — our legitimate interest in running the agency.
- Analytics and marketing cookies — your consent, which you can withdraw at any time.
- Accounting and legal records — compliance with our legal obligations.
Who we share it with
We share personal data only where necessary: our hosting and database provider, email and messaging providers, property portals where a listing is syndicated (Bazaraki, BuySell, Ktimatomesites, Spitogatos — listing information only, not your enquiry), and our professional advisers. We do not sell personal data. Some providers may process data outside the EEA under standard contractual clauses.
How long we keep it
Enquiries and client records are kept for as long as needed to serve you and, afterwards, for the period required by Cyprus accounting and anti-money-laundering rules. Cookie data is kept for the lifetime of each cookie described in the cookies policy. Records that are no longer needed are deleted.
Security
Access to our CRM is restricted by individual accounts and role-based permissions, data is transmitted over encrypted (HTTPS) connections, and internal records are only visible to the staff who need them. No system can be guaranteed absolutely secure.
Your rights
- access a copy of your data;
- correct inaccurate data;
- ask us to erase data we no longer need;
- restrict or object to processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent for cookies or marketing at any time;
- complain to the Office of the Commissioner for Personal Data Protection of Cyprus.
To exercise any right, email starmax@starmax.cy. We respond within one month.
Children
Our services are intended for adults; we do not knowingly collect data from children.
See also our terms & conditions and cookies policy.