Controller

Sea & Sunlife Ltd
Dimitri Liperti 4
Liberty 5, Azure 2, Flat 2
CY-5290 Paralimni
Zypern
+357 95999403
info@seaandsunlife.eu

Data collected when you visit

When you open a page, your browser transmits technically necessary data to our server: IP address, date and time, the address requested, the volume of data transferred, a status message and browser and operating system identifiers. This is required to deliver the page and to fend off attacks.

The legal basis is our legitimate interest in a secure and functioning service (Art. 6(1)(f) GDPR). Server logs are deleted after 14 days at the latest and are not combined with other data.

Cookies

The public website sets no cookies for advertising or audience measurement. A cookie is set only when a member of staff signs in to our internal management system; it serves the login alone. A consent banner is therefore not required.

Visitor counting

We count which pages are viewed so that we can improve the website. This runs on our own server, without cookies and without any third party. We store neither your IP address, nor the full referring address, nor your browser identification.

What we do store: date and hour, the page viewed, the name of the site you came from (for example google.com, not your search term), any campaign identifier from the address bar, the language, and whether you are using a mobile device.

So that we can tell several page views of one visit apart, we form a short, non-reversible check value from your IP address and browser identification together with a secret that changes daily. The source data is not stored. Because the secret of the previous day is discarded, the value can afterwards no longer be attributed to anyone — not even by us. After 14 days it is deleted; only totals without any personal reference remain.

The legal basis is our legitimate interest in a functioning website (Art. 6(1)(f) GDPR). As nothing is stored on or read from your device, no consent is required.

Fonts, images and maps

Fonts and property images are served from our own server. No connection is made to Google Fonts or an external image service.

On pages with a map view we load map tiles from OpenStreetMap. Your IP address is transmitted to the OpenStreetMap Foundation in the United Kingdom. The legal basis is our legitimate interest in showing a location (Art. 6(1)(f) GDPR).

Your enquiry

If you contact us through the enquiry form or by email, we store your details — name, email address, telephone number, search criteria and message — in our management system in order to deal with your enquiry and to suggest suitable properties.

The legal basis is the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR) together with our legitimate interest in replying (Art. 6(1)(f) GDPR).

To arrange a viewing or a concrete offer we pass your details to the responsible local partner — agent or developer. Without this your enquiry cannot be processed. Your details are not passed to third parties for advertising purposes.

We delete your enquiry once it has been dealt with and no statutory retention periods apply, at the latest three years after the last contact.

Email updates

If you expressly agree, we will inform you by email about new properties matching your search profile. The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw it at any time via the unsubscribe link in every email or informally at the address above.

Your provider account

If you create an account in order to list a property, we store your name, your email address and an encrypted password, together with the time you accepted these terms. In addition we store the details and images you enter for your property.

The legal basis is performance of the contract you conclude with us (Art. 6(1)(b) GDPR). At the same time we create you as a contact in our customer records so that we can attribute your properties, enquiries and invoices.

Enquiries from interested parties about your property are forwarded to the email address of your account. Your data is deleted when you have your account deleted — unless statutory retention periods apply, in particular under tax law.

Payment processing

For payment of chargeable services we use Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

You enter your card details directly with Stripe. We neither see nor store them — we hold only the last four digits, the card type and the expiry date so that you can recognise your means of payment. We also transmit to Stripe your name, your email address, the invoice amount and what the payment is for.

The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Stripe processes the data partly on our behalf and partly under its own responsibility — for example for fraud prevention and to meet its own legal obligations. This may involve a transfer to Stripe, Inc. in the United States; Stripe relies on the European Commission’s standard contractual clauses for this.

What Stripe does with the data is set out in Stripe’s privacy policy at stripe.com/privacy.

Invoices and taxes

For invoicing we process, via Stripe, your name or company name, your billing address, the country and — for businesses — your VAT identification number. The country determines the tax rate; the VAT number is checked against the EU VAT Information Exchange System (VIES). The legal basis is performance of the contract and our tax obligations (Art. 6(1)(b) and (c) GDPR).

We retain invoices and payment records for six years, as required by Cypriot tax law. A copy of each invoice is kept in our own system so that reports and VAT returns are possible without access to Stripe.

Use of artificial intelligence

For certain tasks we use a language model provided by Anthropic, PBC, San Francisco, United States: translating property descriptions into our seven languages, classifying and answering enquiries and replies, and searching for companies that might list with us. Only what the task requires is transmitted — for example the text of an enquiry with name and company, never payment data and never identity documents.

Anthropic processes this data on our behalf and does not use it to train its models. For the transfer to the United States we rely on the European Commission’s standard contractual clauses and Anthropic’s certification under the EU-US Data Privacy Framework. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) or our legitimate interest in fast, multilingual handling (Art. 6(1)(f) GDPR).

Automated replies are recognisable as such and concern only information about our services. No decision with legal effect is taken by a program.

Contacting businesses

We contact property developers and estate agencies in coastal regions to offer them publication on our portal. The data for this — company name, address, business email address and, where published, the name of a contact person — is taken from the company’s own public website (information under Art. 14 GDPR). We do not use purchased address lists and do not contact private individuals.

The legal basis is our legitimate interest in acquiring business partners (Art. 6(1)(f) GDPR). Every message contains a link to decline further messages with one click; a short reply is equally sufficient. After a refusal we will not contact you again. If we receive no reply, contact ends after at most three messages, and the data is deleted twelve months after the last message.

Where your data is held

Our server is located in Finland, within the European Union. Sea & Sunlife Ltd is based in Cyprus, likewise within the European Union. In normal operation no transfer to third countries takes place.

Your rights

You have the right to information about the data stored about you, to rectification, to erasure, to restriction of processing, to data portability and to object to processing based on our legitimate interest. Consent once given may be withdrawn at any time with effect for the future.

An informal message to the address above is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority — in Cyprus the Commissioner for Personal Data Protection, in Germany the authority of your federal state.