Privacy Policy

Effective date: 11/08/2026

SQONEPROPERTYPARTNERS LTD (trading as Square One)

1. Introduction

This Website Privacy Policy (the “Policy”) applies to SQONEPROPERTYPARTNERS LTD, a company incorporated and registered in the Republic of Cyprus with registration number HE 444631 and having its registered office at 16 June 1943, 7, 3022 Limassol, Cyprus, together with its subsidiaries and related project entities (“Square One”, “us”, “we” or “our”), as owner and operator of the website https://squareone.com.cy/ and its associated domains (the “Service”).

Square One is committed to protecting the personal data of visitors to the Service and of individuals who contact us, register interest in a property, subscribe to updates, or otherwise interact with us online. This Policy explains what personal data we collect, why we collect it, how long we keep it, and what rights you have in relation to it. This Policy applies only where Square One determines the purposes and means of the processing, and therefore acts as Data Controller.

Unless otherwise defined in this Policy, terms used in this Policy have the same meaning as in our Terms and Conditions, accessible from the Service.

2. Definitions

Service: the website at https://squareone.com.cy/ and any related domains or subdomains operated by Square One.

Personal Data: any information relating to an identified or identifiable living individual.

Usage Data: data collected automatically from use of the Service or the Service infrastructure itself, such as page visit duration.

Cookies: small files placed on your device, as described in our separate Cookie Policy.

Data Controller: the natural or legal person who determines the purposes and means of processing Personal Data. Square One is the Data Controller of the Personal Data described in this Policy.

Data Processor (or Service Provider): any natural or legal person who processes data on the Data Controller's behalf, such as our hosting provider or Cloudflare (see Section 12 below).

Data Subject (or User): any living individual who uses the Service and is the subject of Personal Data.

3. Personal Data We Collect

We collect personal data through the following channels:

  • The website contact and enquiry forms, which we use to direct your enquiry to the appropriate department or member of staff.
  • Property registration, reservation, or brochure request forms, where you express interest in a specific development or unit.
  • Newsletter and marketing sign-up forms, where you provide your email address for updates relevant to your interests.
  • Direct telephone or email contact with our offices. Landline calls to our offices may be recorded for training and monitoring purposes and are ordinarily retained for a period of six months.

The categories of personal data we may collect include your full name, email address, telephone number, postal address, nationality, and any other information you choose to share with us in the course of an enquiry, together with Usage Data and Cookies described below. This information is used strictly to respond to your enquiry or request and will not be disclosed to third parties other than as set out in Section 7 (Disclosure of Data) or where required or permitted by law.

If you wish to withdraw your consent to any of the above purposes of processing, you may do so at any time by contacting our Data Protection contact point (see Section 11). Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

4. Usage Data and Cookies

We may also collect information on how the Service is accessed and used, including your device's Internet Protocol (IP) address, browser type and version, the pages of the Service that you visit, the time and date of your visit, time spent on those pages, unique device identifiers, and other diagnostic data.

We use cookies and similar tracking technologies, including session cookies (to operate the Service), preference cookies (to remember your settings), and security cookies (for security purposes, including the bot protection described in Section 12). Further detail is set out in our separate Cookie Policy.

5. Legal Basis for Processing (GDPR)

Where you are located in the European Economic Area, our legal basis for collecting and using personal data described in this Policy depends on the specific context, and will typically be one of the following:

  • Processing is necessary to take steps at your request prior to entering into, or to perform, a contract with you (for example, a reservation or sale agreement).
  • You have given your explicit consent, for example by submitting an enquiry form or subscribing to our newsletter.
  • Processing is necessary for our legitimate interests, such as improving the Service and preventing fraud or abuse, and is not overridden by your rights.
  • Processing is necessary to comply with a legal obligation, including AML/KYC obligations applicable to Square One as a Cyprus real estate developer.

6. Retention and Deletion of Data

We retain personal data only for as long as necessary for the purposes set out in this Policy, including to comply with our legal obligations (for example, AML/KYC record-keeping requirements), resolve disputes, and enforce our agreements and policies. Usage Data is generally retained for a shorter period, except where retained for security, functionality, or legal reasons. All personal data is deleted or securely destroyed at the end of its applicable retention period.

7. Transfer and Disclosure of Data

7.1 Transfer of Personal Data

Your personal data may be transferred to, and processed in, locations outside your state, province, or country. If you are located outside Cyprus, please note that your data will be transferred to, and processed in, Cyprus. Where we transfer personal data to a service provider or subcontractor, such transfers are protected by appropriate safeguards, including contractual data processing clauses. We will not transfer your personal data to a third country or international organisation unless there are adequate safeguards in place, including the security of your data.

7.2 Disclosure of Data

We may disclose personal data where necessary to comply with a legal obligation, to protect and defend Square One's rights or property, to prevent or investigate possible wrongdoing in connection with the Service, to protect the personal safety of users or the public, or to protect against legal liability. We may also disclose personal data to our suppliers or subcontractors insofar as reasonably necessary to deal with your enquiry, subject to appropriate contractual safeguards. Where we need to transfer personal data to a third party for a purpose not covered above, we will ask for your consent unless another legal basis applies.

7.3 Security of Data

We use reasonable physical, technical, and organisational measures to protect your personal data. However, no method of transmission over the internet, or method of electronic storage, is completely secure, and we cannot guarantee absolute security.

8. Children

The Service is not directed at, and is not intended for use by, children. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have collected personal data from a minor without appropriate consent, we will take reasonable steps to delete that information promptly.

9. Your Data Protection Rights

If you are located in the European Economic Area, you have the following rights in relation to your personal data under Regulation (EU) 2016/679 (GDPR). To exercise any of these rights, please contact us using the details in Section 11.

9.1 Right of Access and Rectification

You may request access to the personal data we hold about you, and request that inaccurate or incomplete data be corrected.

9.2 Right to Erasure

You may request that we delete your personal data. We are obliged to erase your data where one of the following applies:

  • the data is no longer necessary for the purposes for which it was collected;
  • you withdraw consent and no other legal basis for processing exists;
  • you object to processing carried out on the basis of our legitimate interests and there are no overriding legitimate grounds for the processing; or
  • the data has been unlawfully processed.

An erasure request may be refused where an exemption applies, for example where retention is required to comply with a legal obligation, including AML/KYC record-keeping obligations.

9.3 Right to Restrict Processing

You may request that we restrict the processing of your personal data in certain circumstances.

9.4 Right to Object

You have the right to object at any time to the processing of your personal data, including for direct marketing purposes.

9.5 Right to Data Portability

Where the legal requirements of Article 20 GDPR are met, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to have it transferred directly to another controller, free of charge.

9.6 Right to Withdraw Consent

Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time.

9.7 Response Timelines

We aim to respond to requests within one month, provided the request does not impose an undue burden or compromise the privacy of other individuals. If we cannot respond in full within that period, we will provide you with an acknowledgement of receipt, any information located to date, details of any part of the request we are unable to fulfil and the reasons, an estimated date for the remaining response, an estimate of any applicable costs where the request is manifestly excessive, and the contact details of the relevant contact person.

You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus, or with the relevant supervisory authority in your country of residence within the European Economic Area, if you consider that our processing of your personal data infringes applicable law.

10. Analytics

We use Google Analytics, a web analytics service provided by Google, to monitor and analyse use of the Service. Google may use the data collected to contextualise and personalise advertising within its own advertising network. You may opt out of Google Analytics tracking by installing the Google Analytics opt-out browser add-on. Further information on Google's privacy practices is available at https://policies.google.com/privacy.

11. Amendments and Contact Details

We may update this Policy from time to time to reflect changes in the regulatory environment, our business needs, or the needs of our clients and partners. Updated versions will be posted on this page with a revised effective date. Where changes are significant, we may also notify you directly by email. Where required by law, we will obtain your consent before any such change takes effect.

If you have any questions, concerns, or requests relating to this Policy or to how we handle your personal data, or if you wish to exercise any of the rights described in Section 9, please contact us:

12. Bot Protection (Cloudflare Turnstile)

We use Cloudflare Turnstile on our contact forms to help distinguish humans from bots and to protect the Service from spam and abuse. Turnstile may process technical signals such as your IP address, browser and device characteristics (for example, TLS fingerprint and User-Agent), and the site key or page origin. Cloudflare states that it does not use these signals to directly identify individuals.

This check can run in the background, including in a non-interactive mode, when you use a protected form. We use it only for security and spam prevention purposes. Cloudflare processes these signals on our behalf for that purpose and may also use them to improve Turnstile's bot detection under its own policies.

For more information, please see Cloudflare's privacy documentation for Turnstile.