PROPERTY OWNERS · UPDATED 11 NOVEMBER 2026

Owner website privacy & cookies

This privacy and cookie notice covers the Truly Cyprus property-owner website at owners.trulycyprus.com, its enquiry forms and the owner enquiry records kept in our CRM at crm.trulycyprus.com. It supplements our general privacy policy. This specific notice explains the owner enquiry service.

Who is responsible?

G.T.Z. Truly Cyprus Ltd is responsible for the personal information used to manage your enquiry. Contact us at [email protected] or +357 25434043 about your enquiry or privacy rights.

What we collect and why

We collect the name, email address, phone number, property location, property type, bedroom details, requested services and any message you provide. We record the submission time, source and acknowledgement of this notice. Please do not include passports, payment details, access codes or other sensitive information in the form.

Your enquiry is saved in our access-controlled CRM. We use it to respond, assess your property, prepare a proposal, arrange an appraisal and manage related follow-up. Submission also triggers an internal email notification containing enquiry details. Sending the form does not subscribe you to newsletters or advertising.

We may add relevant correspondence, appraisal notes, agreed commercial terms and follow-up records during our discussions. If a lead is moved to Deleted Leads, its saved details, the deletion reason, staff identity and time are retained for management review. Moving a lead there is not permanent erasure.

Our lawful bases

Where you ask us to consider services for you, we process the information necessary to take steps at your request before entering into a contract (GDPR Article 6(1)(b)). For general enquiries or representatives of an owner, and for proportionate record administration, deletion review and fraud prevention, we rely on our legitimate interests in responding to requests, maintaining accurate records and protecting the service (Article 6(1)(f)), subject to your rights and interests. We rely on Article 6(1)(c) where processing is required by a legal obligation.

Optional tracking, if introduced, requires your separate consent. The form acknowledgement is not consent to advertising. You can submit an enquiry after rejecting optional cookies. Required form information is needed to process the enquiry; you can also contact us directly.

Who receives the information?

Enquiry information is available to authorised Truly Cyprus staff and service providers needed to operate the website, CRM, security and email service. These include eUKhost for public website hosting, enquiry processing and CRM storage, Cloudflare for DNS, website security and Turnstile, and our email service provider for internal enquiry notifications. We do not sell enquiry details or use this form to enrol you in marketing.

These providers may process information outside Cyprus or the European Economic Area. International transfers must use an applicable GDPR transfer mechanism, such as an adequacy decision or standard contractual clauses where required. Contact us for information about the arrangements applicable to your data; this notice does not imply that all data is stored within the EEA.

How long we keep enquiries

We retain active enquiries while responding to your request, conducting ongoing discussions and completing the related follow-up. Retention is assessed by whether discussions remain active, whether a proposal or service is still being considered, and whether a specific legal obligation or claim requires relevant records. Information no longer needed for these purposes should be erased or irreversibly anonymised. If you become a client, information needed for the resulting relationship is retained under the applicable contract and legal obligations.

Deleted enquiries: moving an enquiry to our internal Deleted Leads area removes it from active follow-up but does not erase the personal information. Any continued retention must remain necessary for a legitimate purpose, such as reviewing an accidental deletion or dealing with a documented legal matter.

Your right to request erasure: you may ask us to erase the personal details you submitted at any time by emailing [email protected]. We will assess your request and erase the information without undue delay where the right applies. If specific information must be retained to comply with a legal obligation or for the establishment, exercise or defence of legal claims, we will explain the reason and limit retention to what is necessary.

An erasure request is assessed separately and, where applicable, acted on without undue delay. Any necessary legal retention is limited to the relevant information and purpose. Email notifications, exports and provider backups are separate copies: moving a CRM record to Deleted Leads does not remove those copies. They must be addressed in the applicable retention or erasure process, including provider backup procedures.

Cookie policy and browser storage

This cookie policy applies to owners.trulycyprus.com. Cookie preferences are saved separately for each website domain. A choice made on our guest booking website or an earlier preview address does not automatically carry over to this website.

Cloudflare Turnstile helps distinguish genuine visitors from automated submissions using network and browser signals, such as an IP address and browser information. A short-lived verification token is checked when the form is sent. Turnstile is a security service, not an advertising tool. See Cloudflare’s Turnstile Privacy Addendum for its processing and roles.

Other challenge storage depends on Cloudflare configuration. In particular, Turnstile can issue cf_clearance in pre-clearance mode. That mode and its configured lifetime have not been verified for this deployment, so it is not presented as a confirmed cookie. Read Cloudflare’s cookie information for the provider’s descriptions. The staff CRM at crm.trulycyprus.com uses an essential, secure, HTTP-only cookie named __Host-tc_crm for email-and-password sign-in. It is limited to the CRM hostname and the browser session. Sessions expire after 30 minutes of inactivity or 12 hours from sign-in. Disabling a user or resetting their password revokes their existing sessions.

Our server also uses keyed hashes derived from IP addresses and email addresses to limit repeated submissions. These are server-side security records, not browser cookies. Their counting windows are 15 minutes and one hour respectively; expired records are removed by our scheduled maintenance process after a further day.

Your cookie choices

No optional analytics or advertising tools are currently configured on these enquiry pages. Optional choices default to off. You can accept, reject or change them using Cookie settings. Necessary delivery and security functions remain active. Cookie choices are independent of the details you choose to send in an enquiry. External links, including WhatsApp and the booking website, have their own privacy practices.

Your rights

Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your personal information, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. We may need proportionate information to verify your identity. We normally respond within one month; if a permitted extension is necessary, we will explain it within that period.

Email [email protected]. You may complain to the Cyprus Commissioner for Personal Data Protection or another competent supervisory authority. We do not use enquiry information for solely automated decisions producing legal or similarly significant effects.