Privacy notice

1. Controller and contact

You can use this contact to ask about our processing and exercise your data protection rights.

2. Scope

This notice covers visits to paphos-hosted.com, including its www and German versions, and enquiries about furnishing and holiday rental management. It is intended particularly for owners, authorised landlords and their representatives.

A subsequent furnishing or management engagement may involve additional processing, for example invoicing, coordinating contractors or looking after guests. Further privacy information and any necessary processor agreements will be provided for the particular services. This website notice does not replace notices for guests or booking platforms.

3. Website delivery and security

Cloudflare Pages and the Cloudflare network deliver this website. Requests may involve your IP address, time, requested address, browser and device information, technical request information, data volumes and security events. This processing enables website delivery, troubleshooting and protection against misuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is an available, secure and stable website. Recipients include Cloudflare, Inc., its relevant affiliates and subprocessors. Technical data is needed only for delivery, troubleshooting or investigating security incidents; retention and deletion also depend on the actual Cloudflare services and their configuration.

Further information: Cloudflare privacy policy.

4. Contact form and individual enquiries

Name and email address are mandatory form fields. Telephone number, property location and type, requested service and message are optional. The selected language and acknowledgement of this notice are also transmitted. Technical request information is processed as explained in section 3.

We use these details to assess your enquiry, answer questions and, where appropriate, prepare a proposal. Article 6(1)(b) GDPR applies where you request steps before entering into a contract yourself. For general enquiries or where you represent a business or another person, Article 6(1)(f) GDPR applies; our legitimate interest is handling business communications.

The form acknowledgement is not a newsletter subscription or blanket consent to advertising. We cannot handle a form enquiry without a name and usable email address; other fields are not required. Please do not send identity document copies, health information or unnecessary information about guests or other people.

A hidden honeypot field helps identify automated submissions. Submissions filling that field are not delivered as ordinary enquiries. Where enabled, the form also uses Cloudflare Turnstile for abuse protection. In that case, Cloudflare processes verification information such as the browser challenge result and technical request data (which may include the IP address) to distinguish automated traffic; the website transmits the verification token to Cloudflare for server-side checking. The legal basis is Article 6(1)(f) GDPR (protecting the form against abuse). This does not produce a decision with legal or similarly significant effects.

5. Resend delivery and email

The website is set up to deliver enquiries through Resend. When delivery is enabled, form details are sent from our server to Resend (Plus Five Five, Inc., USA) and delivered by email to our designated mailbox. Resend processes sender/recipient details, message content, delivery status and technical sending data for this purpose. This supports reliable delivery and handling of your enquiry; the legal bases are those in section 4.

Our [email protected] mailbox is hosted by Purelymail (Add Rabbit LLC, USA). Purelymail processes message content, sender and recipient addresses and technical email information to receive, store and make messages available. Access is limited to the people handling the enquiry. Resend is a delivery service; it does not make your enquiry publicly available. Sending an enquiry does not subscribe you to Resend newsletters or third-party advertising.

Provider information and international transfer terms: Resend privacy policy and Resend data processing addendum. Further mailbox-provider information: Purelymail privacy policy.

6. Externally hosted images

The homepages load image files from images.unsplash.com and cdn.shopify.com. Your browser connects to those image servers and may transmit your IP address, request time, browser information and technical referrer information. Some images load only as you scroll.

The purpose is to illustrate our services and furnishing examples. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a functional, understandable presentation of those services. These are image requests, not a Shopify store embedded on this website. You can restrict external image loading in your browser to avoid such connections, although this will affect the appearance of the pages.

7. Instagram, cookies and tracking

Instagram links are ordinary links to @paphos.hosted. We do not embed an Instagram feed or social media plugins. Opening a link takes you to Meta's service, where its own privacy information applies. If you contact us there, we process your information to respond on the bases explained in section 4.

The current website code does not integrate Google Analytics, Meta Pixel, advertising trackers, external font services or a first-party analytics cookie. Necessary hosting security functions may use cookies or similar technologies depending on their configuration. Non-essential storage or access on your device requires prior consent where required by law. If additional analytics or marketing services are introduced, this notice and any required consent controls will be updated.

8. Other recipients and international transfers

Only people who need to handle enquiries have access to them. Beyond the technical providers named above, a particular requested or agreed service may require limited disclosure to delivery, installation or other contracted specialists. Only information necessary for that task is shared. We do not generally circulate complete enquiries to all partners. Necessary disclosures to authorities or professional advisers bound by confidentiality may also occur.

International providers may process information outside the European Economic Area, particularly in the United States. Transfers are subject to Articles 44 onwards GDPR. Depending on the recipient and processing, an applicable adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses may apply. Resend describes US processing and Standard Contractual Clauses in its data processing terms; Cloudflare also publishes data processing terms. Purelymail is a US provider and identifies US servers as its storage location; this also applies to email correspondence stored there. You can ask the contact above which basis applies to a particular transfer and request information or copies of relevant safeguards, with protected information redacted where necessary.

9. Retention

Retention depends on purpose and the status of the matter:

• Enquiries without a contract: while handling, necessary follow-up and clarification of an outstanding proposal remain necessary. Personal information no longer needed is then deleted unless another lawful retention reason applies.
• Contract and accounting records: during performance and thereafter to the extent required by applicable statutory retention duties or necessary to establish, exercise or defend specific legal claims.
• Delivery, security and error information: for necessary message delivery, troubleshooting and security investigation. Technical providers may have different service- and configuration-dependent deletion cycles and limited backup retention.

Longer retention does not permit unrelated use or advertising. Where a legal obligation prevents deletion, processing is restricted to the necessary purposes.

10. Your rights

Subject to the applicable conditions, you have rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20 GDPR). Where processing is based on consent, you can withdraw it at any time for the future without affecting the lawfulness of earlier processing.

Contact us using section 1. We normally respond within one month and explain any extension permitted by law. We may request proportionate identity verification to avoid disclosing information to an unauthorised person.

You can complain to a supervisory authority, particularly in the country of your usual residence, workplace or an alleged infringement. In Cyprus, contact the Commissioner for Personal Data Protection at [email protected]. The European Data Protection Board's authority directory provides further contact information.

11. Security and automated decisions

The website and form use HTTPS. Technical and organisational measures aim to prevent unauthorised access and unrelated use. Data transmission over the internet cannot be guaranteed to be entirely free of risk.

This website does not make decisions based solely on automated processing under Article 22 GDPR. In particular, an enquiry does not result in an automated creditworthiness decision, an instalment approval or binding acceptance of an engagement.

12. Updates

We update this notice when our services, providers or legal requirements change. The date above identifies the version.