Live across Cyprus
Effective date: 22 September 2026
This policy explains what personal data Lazuli Management collects through lazulimanagement.com, why we collect it, who else sees it, and what you can do about it. We follow the EU General Data Protection Regulation (GDPR) and the Cyprus Personal Data Protection Law (Law 125(I)/2018).
Lazuli Management is the data controller for the personal data described here.
We have not appointed a Data Protection Officer. We are not a public authority, and we do not monitor people on a large scale or handle sensitive categories of data at scale, so one is not required. Privacy questions go to the address above.
When you send an enquiry. Our two forms collect your name, email address, phone number and your message. The “Submit your property” form also asks for the property type and location. We store the enquiry in this website’s database together with the IP address it was sent from, and we receive it by email.
When you subscribe to the newsletter. We collect your email address. We also keep a record that you consented: the date and time, a one-way scrambled version of your email address, a shortened IP address, your browser identification, and the exact wording you agreed to.
Automatically, when you browse.
We do not collect special categories of data, such as health, beliefs or biometrics, and we do not knowingly collect data from children. In Cyprus, children under 14 cannot consent to online services on their own.
| What we do | Legal basis |
|---|---|
| Reply to your enquiry and prepare a proposal | Steps taken at your request before entering a contract |
| Record the IP address with your enquiry, to block spam and abuse | Our legitimate interests |
| Manage your property under a signed agreement | Performance of that contract |
| Send you our newsletter | Your consent, confirmed by email |
| Keep proof that you consented to the newsletter | Our legitimate interests, and our duty to demonstrate consent |
| Measure how the website is used (Google Analytics) | Your consent, given in the cookie banner |
| Keep server and network logs, and protect the site | Our legitimate interests |
| Keep a short-term log of emails the website sends, to diagnose delivery failures | Our legitimate interests |
| Meet tax, accounting and other legal duties | Legal obligation |
Our legitimate interests, stated plainly: preventing automated spam and fraudulent submissions; keeping the site available and secure; being able to prove that a newsletter subscriber agreed; and diagnosing emails that fail to arrive. Each involves limited data, kept briefly, with no profiling and no sale of data. You can object to any processing we base on legitimate interests, as explained in section 7.
| Who | What they do | Where |
|---|---|---|
| Yoshiro Digital, our web agency | Receives a copy of every enquiry notification, so enquiries are not missed, and maintains the website | Cyprus / EU |
| Google Ireland and Google LLC | Deliver our outgoing email, provide Google Analytics, and serve the map on our Contact page | EU and United States |
| Intuit (Mailchimp) | Runs our newsletter list and sends the confirmation email | United States |
| Cloudflare, Inc. | Delivers this website and protects it from attacks; sees traffic data including IP addresses | United States and globally |
| Our hosting provider | Runs the server holding the website and its database | Amsterdam, Netherlands |
| Accountants, legal advisers, authorities | Only where a legal duty or a legal claim requires it | Cyprus / EU |
We do not sell your personal data, and we do not share it for other companies’ advertising.
If you contact us through the WhatsApp link on our Contact page, that conversation takes place on WhatsApp and Meta processes it under its own terms.
Some of the companies above are based in the United States, so personal data is transferred there: Google LLC, Intuit (Mailchimp) and Cloudflare, Inc.
These transfers rely on the EU-US Data Privacy Framework, under which those companies are certified, and on the European Commission’s Standard Contractual Clauses, which are built into their contracts with us as a fallback. Google states that it does not store the IP addresses of visitors from the EU. Mailchimp stores subscriber data on servers in the United States.
This website’s own server and database are located in Amsterdam, in the EU.
| Data | How long |
|---|---|
| Enquiries stored in the website database | For as long as we need them to deal with your enquiry and for our business records, normally no longer than 24 months after our last contact with you |
| Enquiry emails in our mailboxes and our agency’s mailboxes | For as long as the business relationship or our records require |
| Short-term log of emails sent by the website, which includes the message content | 14 days, then deleted automatically |
| Newsletter subscribers at Mailchimp | Until you unsubscribe or ask us to delete you |
| Newsletter signups that are never confirmed | Deleted automatically by Mailchimp after 60 days |
| Our record of your newsletter consent | 24 months, then deleted automatically |
| Google Analytics data | At most 14 months |
| Server and network access logs | Around 12 months |
You can ask us to:
Where we rely on your consent, which covers the newsletter and analytics, you can withdraw it at any time, and that does not affect anything done before you withdrew. Use the unsubscribe link in any newsletter, or the cookie preferences link in our footer.
Write to info@lazulimanagement.com. We answer without undue delay and within one month. If a request is complex we may extend that by up to two further months, and we will tell you why.
One honest limitation. We cannot identify you inside our Google Analytics data, because it does not carry your name or email address, so we cannot retrieve or delete it on request. You control it through our cookie banner and through your own Google account settings.
If you are unhappy with how we handle your data, you can complain to the Cypriot supervisory authority: Office of the Commissioner for Personal Data Protection, 15 Kypranoros Street, 1061 Nicosia, Cyprus, www.dataprotection.gov.cy.
No. Providing your details is not required by law or by contract. It is simply necessary if you want a reply: without a name, an email address and a message we cannot answer your enquiry. Subscribing to the newsletter is entirely optional, and refusing has no consequences.
We use Google Analytics 4 with Google Signals switched on.
We do not make decisions about you by automated means alone, and we do not profile you in a way that produces legal or similarly significant effects. Analytics groups visitors into statistical categories; it produces no decision about you.
The website is served over encrypted connections, sits behind a web application firewall, and access to the server and database is restricted to named administrators. Email sent by the website travels over authenticated, encrypted connections. No system is perfectly secure, but we take these measures seriously and review them.
We update this policy when what we do changes. The effective date at the top shows the most recent revision. For details of the cookies we use, see our Cookies Policy.
