Legal

GDPR Compliance

GDPR (EU) 2016/679 · Cyprus Law N.125(I)/2018 · Last updated: April 2026

1. Data Controller Identity

Organisation: VELORÉ Cyprus
Website: veloreai.com
Email: info@veloreai.com
Address: Limassol, Cyprus
EU Member State: Republic of Cyprus

As a platform primarily operating in Cyprus (EU), we are fully subject to the GDPR and the Cyprus Personal Data Protection Law N.125(I)/2018 implementing it.

2. Legal Bases for Processing (Article 6 GDPR)

Processing ActivityDataLegal Basis
Property inquiry matchingName, email, phone, budget, city, messageArt. 6(1)(b) — Contract
Sharing lead with agenciesName, email, budget, preferencesArt. 6(1)(b) — Contract
Website analytics (GA4)IP (anonymized), pages, deviceArt. 6(1)(a) — Consent
Fraud preventionIP address, submission patternsArt. 6(1)(f) — Legitimate interest
System security / audit logsAPI access logsArt. 6(1)(f) — Legitimate interest

3. Cookie Policy (Article 5(1)(a) GDPR — Transparency)

Cookie NamePurposeDurationLegal Basis
velore_langLanguage preference storage12 monthsNecessary
velore_consentRecords user's cookie consent decision12 monthsNecessary
_gaGoogle Analytics 4 — unique user identifier24 monthsConsent
_ga_[ID]GA4 session state24 monthsConsent

No advertising, retargeting, or social media cookies are used on this website. Analytics cookies are activated only after explicit consent via the cookie banner.

4. Sub-processors and Third-Party Data Processors (Article 28 GDPR)

ProviderRoleProcessing LocationSafeguard
Supabase Inc.Database (stores lead inquiries)EU — Frankfurt, GermanyDPA in place · ISO 27001
Vercel Inc.Website hosting / CDNEU — Frankfurt, GermanyDPA in place · SOC 2
Google LLC (GA4)Analytics (with consent)USA / EUEU–US DPF · SCCs · DPA
Licensed AgenciesReceive matched lead dataCyprus (EU)Independent data controllers

All sub-processors are bound by data processing agreements (DPAs) ensuring GDPR compliance. We do not use any sub-processor that does not provide adequate data protection safeguards.

5. Record of Processing Activities (Article 30 GDPR)

Processing Activity 1 — Property Inquiry Matching

  • Purpose: Match user's property preferences with suitable licensed agencies
  • Data categories: Name, email, phone (optional), budget, city, property type, message
  • Legal basis: Art. 6(1)(b) — necessary for the performance of a service
  • Recipients: Licensed real estate agencies in Cyprus matching the stated criteria
  • Retention: 24 months from submission
  • Security: TLS 1.3 in transit · AES-256 at rest · Row-level security access control

Processing Activity 2 — Website Analytics

  • Purpose: Understand aggregate usage patterns; improve user experience
  • Data categories: Anonymized IP, browser type, device, pages visited, session duration
  • Legal basis: Art. 6(1)(a) — consent (cookie banner)
  • Recipients: Google LLC (GA4)
  • Retention: 14 months (GA4 default)
  • IP anonymization: Enabled — full IP addresses are never stored

6. International Data Transfers (Articles 44–49 GDPR)

Google Analytics 4 (USA): Transfers protected by the EU–U.S. Data Privacy Framework (DPF, in force since July 2023) and Standard Contractual Clauses (SCCs) per Commission Implementing Decision (EU) 2021/914.

Supabase and Vercel: Data processed within the EU (Frankfurt). No international transfer occurs.

7. Data Subject Rights and How to Exercise Them

You may exercise the following rights at any time by contacting info@veloreai.com:

  • Right of access (Art. 15): Receive a copy of your data we hold
  • Right to rectification (Art. 16): Correct inaccurate information
  • Right to erasure (Art. 17): Request deletion of your personal data
  • Right to data portability (Art. 20): Receive data in JSON/CSV format
  • Right to object (Art. 21): Object to legitimate-interest processing
  • Right to withdraw consent: Disable cookies via browser localStorage at any time
  • Right to restriction (Art. 18): Limit how we process your data

We will respond to all requests within 30 days. Complex requests may be extended to 60 days with notice. We do not charge for reasonable requests.

8. Data Breach Response Procedure (Articles 33–34 GDPR)

In the event of a personal data breach, we will:

  1. Within 24 hours: Detect, assess severity, and contain the breach
  2. Within 72 hours: Notify the Cyprus Commissioner for Personal Data Protection if the breach poses a risk to individuals' rights and freedoms (Art. 33)
  3. Without undue delay: Notify affected individuals if the breach is likely to result in a high risk to their rights (Art. 34)
  4. Ongoing: Document the breach in our internal breach register

9. Supervisory Authority

Commissioner for Personal Data Protection — Cyprus
1 Iasonos Street, 1082 Nicosia, Cyprus
dataprotection.gov.cy · commissioner@dataprotection.gov.cy
Tel: +357 22818456

We encourage you to contact us directly first at info@veloreai.com to resolve any concerns.

10. Privacy by Design Measures (Article 25 GDPR)

  • IP anonymization enabled in GA4 — no full IP stored
  • Phone number field is optional — not required for service delivery
  • Analytics active only after affirmative cookie consent
  • Data minimization: we collect only what is necessary for the matching service
  • Automatic 24-month deletion of lead data
  • Row-level security prevents any unauthorized data access