Privacy Policy

Last updated: 13 October 2026

1. About this Privacy Policy

This Privacy Policy explains how SAINT CYPRUS MANAGEMENT LTD («Saint Cyprus», «we», «us» or «our») collects, uses, stores and shares personal data when you:

visit scyprus.com (the «Website»);
make or enquire about an accommodation booking;
stay at a property advertised or managed through Saint Cyprus;
contact us or request guest support;
submit an enquiry about property management or related services; or
otherwise interact with us.

We process personal data in accordance with the EU General Data Protection Regulation («GDPR»), the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data Law of 2018 (Law 125(I)/2018), and applicable Cyprus electronic communications laws.

2. Who we are

SAINT CYPRUS MANAGEMENT LTD is a company registered in the Republic of Cyprus.

Business and contact address:

Coral Bay Avenue, Aristo 13, Shop 3

Peyia, Paphos 8575

Cyprus

Telephone: +357 26 22 08 18

Email: info@scyprus.com

Website: https://scyprus.com

For data protection enquiries and requests, contact us at info@scyprus.com.

SAINT CYPRUS MANAGEMENT LTD is the controller and is responsible for the personal data described in this Privacy Policy. Where a property owner, accommodation provider, booking platform or payment provider independently determines how personal data is used, that party acts as a separate controller under its own privacy notice.

3. Personal data we collect

The personal data we collect depends on how you interact with us.

Contact and enquiry data

Your name, email address, telephone number, the content of your enquiry and any preferences or information you choose to provide.

Booking and guest data

Your name and contact details, selected property, arrival and departure dates, number of guests, details of the lead guest and travelling party, special requests, arrival information, booking channel, booking status and related communications.

Payment and transaction data

Booking value, currency, payment status, deposit, refund or chargeback information, transaction references and billing information.

Identity and compliance data

Identity, age or identification information where reasonably required to verify a booking, prevent fraud, comply with a legal obligation, register guests or respond to a lawful request from an authority. We will not request more information than is necessary for the relevant purpose.

Stay, property and service data

Property access information, check-in and check-out records, occupancy, services requested, maintenance or support requests, utility readings where relevant, security-deposit records, damage reports, complaints and other information needed to administer a stay.

Property-owner enquiry data

Your name, email address, telephone number, property type, property location, comments and communications relating to property-management services.

Preferences and special-category data

Information about accessibility, health, dietary or other assistance needs when you voluntarily provide it and it is necessary to support your stay. We process this information only where an additional GDPR condition applies, such as your explicit consent, or where processing is otherwise permitted by law.

Technical and usage data

IP address, device and browser type, operating system, language preference, referring page, pages viewed, dates and times of access, error and security logs, and cookie or similar-technology identifiers, subject to your consent choices where consent is required.

Marketing data

Your marketing preferences, consent or opt-out record, and information needed to send and measure communications that you have requested or that we are otherwise lawfully permitted to send.

Reviews and testimonial data

If you provide a review or testimonial, we may process your name, general location, review text, photographs and the related permission record. We publish it only with your consent or other lawful permission. Where we rely on consent, you may withdraw it at any time.

4. How we collect personal data

We collect personal data:

directly from you through the Website, booking process, email, telephone or other communications;
from a lead guest who provides information about members of a travelling party;
from property owners or their authorised representatives;
from booking platforms, channel managers or other travel partners involved in your enquiry or reservation;
from payment providers, banks and fraud-prevention providers;
automatically through the Website, server logs, security tools and cookies or similar technologies; and
from public authorities or professional advisers where lawful and necessary.

If you provide another person’s personal data, please make sure that you are authorised to do so and provide that person with access to this Privacy Policy.

5. Why we use personal data and our legal bases

Responding to enquiries and taking steps before a contract

We use contact, enquiry, property and booking data to answer questions, prepare a quotation, check availability and take steps you request before entering into a contract. The legal basis is Article 6(1)(b) GDPR. Where the enquiry does not relate to a possible contract, we rely on our legitimate interest in responding to relevant business enquiries under Article 6(1)(f).

Creating and administering bookings and stays

We use booking, guest, transaction and stay data to process reservations, send confirmations, arrange check-in, provide support, communicate changes and deliver requested services. The legal basis is Article 6(1)(b) GDPR.

Processing payments, deposits and refunds

We use booking and transaction data to collect or confirm payments, manage deposits, issue refunds, prevent payment fraud and deal with chargebacks. We rely on Article 6(1)(b) for the booking contract, Article 6(1)(c) for legal, tax and accounting obligations, and Article 6(1)(f) for proportionate fraud prevention and legal claims.

Complying with law and protecting rights

We process data where necessary to meet tax, accounting, guest-registration, safety, regulatory or public-authority requirements, relying on Article 6(1)(c). We may also use relevant records to establish, exercise or defend legal claims, investigate suspected misuse and protect guests, properties and our business, relying on Article 6(1)(f).

Providing property-management and owner services

We use owner contact, property and communication data to respond to owner enquiries, prepare proposals and provide agreed management services. We rely on Article 6(1)(b), or on Article 6(1)(f) where necessary for a legitimate business relationship and those interests are not overridden by your rights.

Operating, securing and improving the Website and services

We use essential technical information to keep the Website available, detect errors, prevent abuse and maintain security. We rely on Article 6(1)(f). We use non-essential analytics, advertising or optional embedded technologies only after obtaining consent where required, relying on Article 6(1)(a).

Remembering your selected language

We may store the language you actively select so that the Website can provide the requested version. Where this storage is strictly necessary to provide that preference, it does not require consent under applicable electronic communications rules. If related information constitutes personal data, we rely on our legitimate interest in providing the requested Website experience.

Marketing

We use your contact details to send marketing only where you have consented or where a limited existing-customer exception is lawfully available. You can unsubscribe at any time. We keep service and booking messages separate from optional marketing.

Special-category data

Where you voluntarily provide health, accessibility or similar sensitive information, we process it only when necessary and when both an Article 6 basis and a condition under Article 9 GDPR apply, normally your explicit consent. You can withdraw consent, but this may affect our ability to meet a particular request.

Consent can be withdrawn at any time. Withdrawal does not affect processing carried out lawfully before withdrawal.

6. If you do not provide personal data

Where information is required to answer your enquiry, enter into or perform a booking, comply with law or provide a requested service, we may be unable to proceed if you do not provide it. We will explain when information is mandatory and, where practical, the consequences of not providing it.

7. Who we share personal data with

We share personal data only where necessary and proportionate. Recipients may include:

the property owner, accommodation operator, local manager or authorised representative connected with your booking;
booking platforms, channel managers or travel partners through which a reservation is made;
payment processors, banks and fraud-prevention providers;
Website hosting, technical support, email, communications, customer-management and cybersecurity providers;
cleaning, maintenance, transport or other service providers where needed to deliver a service you request;
accountants, auditors, insurers, lawyers and other professional advisers;
public authorities, regulators, courts or law-enforcement bodies where disclosure is required or permitted by law; and
a prospective buyer, investor or successor in connection with a genuine business transaction, subject to appropriate confidentiality and legal safeguards.

Service providers acting as processors may use personal data only on our documented instructions, for the agreed purpose and with appropriate security obligations. Other recipients, such as a payment provider, booking platform or property operator, may act as independent controllers under their own privacy notices.

We do not sell personal data for money.

8. International data transfers

Some service providers may process personal data outside Cyprus or the European Economic Area. Where the destination is not covered by an EU adequacy decision, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, and supplementary measures where required. You may request information about applicable safeguards by emailing info@scyprus.com.

9. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes described in this Policy, including to meet legal, tax, accounting, insurance, fraud-prevention and dispute-resolution requirements. In deciding how long to keep data, we consider its amount, nature and sensitivity, the risk of harm from unauthorised use or disclosure, the purpose of processing, whether that purpose can be achieved in another way and applicable legal requirements.

Booking, payment, invoice and other records supporting tax returns are generally kept for at least six years, calculated in accordance with applicable Cyprus tax law. They may be kept longer where an audit, complaint, chargeback, legal claim or other legal obligation is ongoing. Enquiries that do not lead to a booking are kept only as long as reasonably necessary for follow-up. Marketing data is kept until you opt out, after which we may retain a minimal suppression record so that we can respect your choice.

When personal data is no longer needed, we securely delete it or irreversibly anonymise it. You may ask about the retention period for a particular category of data by emailing info@scyprus.com.

10. Security

We use technical and organisational measures appropriate to the nature and risk of the processing. These measures may include encrypted connections, access controls, role-based permissions, confidentiality obligations, software updates, backups, monitoring and incident-response procedures. If a personal data breach occurs, we will notify affected individuals and the relevant supervisory authority where required by law.

No internet transmission or storage system is completely secure. Please do not send full payment-card credentials, identity documents or unnecessary sensitive information through ordinary free-text forms or unencrypted email unless we specifically provide a secure method.

11. Your data protection rights

Subject to GDPR conditions and exceptions, you may have the right to:

ask for access to your personal data and a copy of it;
ask us to correct inaccurate or incomplete data;
ask us to erase personal data;
ask us to restrict processing;
receive personal data you provided in a structured, commonly used and machine-readable format, and transmit it to another controller where applicable;
object to processing based on legitimate interests;
object at any time to direct marketing;
withdraw consent at any time; and
not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to GDPR exceptions.

To exercise a right, email info@scyprus.com. Please describe your request clearly. We may ask for information reasonably necessary to verify your identity. We normally respond within one month, although GDPR permits an extension in certain complex cases. Exercising your rights is normally free, but GDPR permits a reasonable fee or refusal for manifestly unfounded or excessive requests.

We do not currently make decisions about you based solely on automated processing that produce legal or similarly significant effects.

12. Complaints

You have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus or with the competent supervisory authority in the EU or EEA country where you live or work. Further information is available at https://www.dataprotection.gov.cy.

13. Cookies

The Website uses essential cookies and, with your consent, optional cookies. You can change or withdraw your consent at any time through the Cookie Settings control available at the beginning of our Cookie Policy, which is linked in the Website footer.

14. Direct marketing

Where permitted by law, we may send you information about our properties and services. You can ask us to stop at any time by replying to the message or emailing info@scyprus.com. This will not affect essential communications relating to your enquiry, booking or stay.

15. Children

The Website is intended for adults. A booking must be submitted by an adult with authority to act for the travelling party. We may process limited information about children travelling as guests when it is necessary to administer the booking, provide requested assistance or comply with law. Such information should be provided by a parent, guardian or authorised lead guest and must not include unnecessary details.

16. Property security devices

Some properties may use lawful exterior security devices, smart locks or safety and noise-monitoring systems. Where any such technology processes personal data, the relevant property listing, booking information or a separate notice will explain its location, purpose, controller, retention period and who may receive the data. Saint Cyprus does not permit surveillance in private indoor guest areas.

17. Third-party websites and platforms

The Website may link to or integrate with third-party booking, payment, mapping, social-media or other services. Those parties may process personal data as independent controllers under their own privacy notices. Please review the relevant notice when you use their service.

18. Changes to this Privacy Policy

We may update this Privacy Policy when our services, systems or legal obligations change. The current version will be published on the Website with a revised «Last updated» date. If a change materially affects how we use personal data, we will provide additional notice where appropriate.

19. Contact us

For questions, concerns or requests relating to this Privacy Policy or your personal data, contact:

SAINT CYPRUS MANAGEMENT LTD