GDPR - Protection of Personal Data
Alpha Real Estate Services LLC (“ARES”) is committed to protecting your personal data. ARES will collect, process and use your personal data in compliance with the applicable local legislation as amended and/or replaced from time to time, the provisions of Regulation (EU) 2016/679 (hereinafter the “General Data Protection Regulation” or “GDPR”), in force from 25 May 2018, and any other legal and/or regulatory requirements.
1. Purpose of this Privacy Notice
The purpose of this privacy notice is to provide you with information about the processing of your personal data within the context and/or in view of a business relationship with regard to a product or service of ARES. Additionally, for the purpose of informing you about the data protection rights you are entitled to under the current legislative and regulatory framework.
The type of data held and the scope of the data processing will largely depend on the type of products and services that you have requested or have been granted to you, or on your relationship with us.
If you are, for instance, an authorized representative/agent of a legal entity or of a natural person which/who is a customer or prospective customer, or a beneficial owner of a legal entity which is a customer or prospective customer, or a non-customer counterparty in a transaction of a customer, we shall need to collect and process your personal data which may include amongst others, identification data such as surname, forename, identity card/ passport number, date and place of birth and nationality, communication data, account identification data, whether you are a politically exposed person, FATCA/CRS information, and authentication data (e.g. signature).
2. Who is responsible for the data processing and who you can contact
The entity responsible for your data processing is:
Alpha Real Estate Services LLC
3, Lemesou Avenue
P.O.Box 21661
1596 Nicosia,
Cyprus
Telephone: 22888874
Fax: 22775391
Website: https://www.aresproperties.com.cy
The Data Protection Officer contact details at Alpha Real Estate Services LLC are:
Alpha Real Estate Services LLC
3, Lemesou Avenue
P.O.Box 21661
1596 Nicosia,
Cyprus
Telephone: 22888880
Email Address: DPO@alphabank.com.cy
If you have any questions, or want more details about how we use your personal information, you may contact us at the above contact details.
3. What personal data we process and where we collect personal information from
We process personal data that we receive from you in the context of our business relationship. To the extent necessary in order to provide our services we also process personal data obtained from publicly available sources such as the Department of Registrar of Companies and Official Receiver, the Land Registry, commercial registers, the media, the Internet and third parties we cooperate with (e.g. insurers, estate agents, advisers, legal firms, tracing agencies, debt collection agencies, credit reference agencies, public authorities etc.).
Personal data, or personal information, means any information about an individual from which that person can be identified. We may also sometimes collectively refer to e.g. collection, recording, retrieval, use, disclosure, erasure or transmission of any data or set of data as “processing” of personal data.
Relevant personal data may include, amongst others:
a) Identification data, such as surname, forename, identity card/passport number, tax identification number, date and place of birth, nationality and other demographic data.
b) Communication data, such as postal and e-mail address, landline and mobile phone number.
c) Economic data, property and family status data, for instance profession, earnings, dependent family members, tax and income data.
d) Data regarding failure to meet financial obligations, such as information regarding cheques that have not been honored, failure to make due payments on credit agreements, information regarding court proceedings and collections, bankruptcies, dismissal of debt orders and personal repayment schemes.
e) Transactional behavior data, including, where applicable, internet browsing data (cookies).
f) Data from your contract(s) with ARES and your use of the products granted.
g) Data from payment transactions and payment services.
h) Data relating to your identity, provided from devices or applications you use, such as the IP address, or other data provided through the devices used by you as location identifiers which, alone or in combination with unique identifying identifiers, may be used to identify you.
i) Data relating to telephone communications with you, which may be recorded in compliance with legal requirements.
We wish to bring to your attention that we do not process, without your explicit consent, personal data revealing e.g. racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, data concerning health or data concerning a natural person's sex life or sexual orientation, referred to as special categories of personal data in the GDPR, however we cannot rule out the possibility that such information is communicated to us by you.
4. Who we disclose your personal data to
Nothing relating to your personal data will be disclosed to anyone, other than in the cases permitted by the legal and regulatory framework in force from time to time. These are:
a) Where we (or any third party acting on our behalf) are legally compelled to do so.
b) Where it is in our legitimate interests to disclose information (e.g. to protect us from loss or to recover any loss that we have incurred).
c) Where disclosure is made at your request or with your consent or to satisfy our contractual obligations towards you.
d) Where disclosure is required for purposes of compliance with the legal and regulatory framework governing and binding ARES.
Personal data may be shared with companies within the Alpha Bank Group (that is, our holding company Alpha Astika Akinita S.A. and its subsidiary companies and our subsidiary companies and or other subsidiary companies of Alpha Bank Group and or ARES or principal.) for sales or rental purposes for internal audit reporting / assessment, AML Checks and reviews for credit assessment, collective risk assessment, group unified treatment where applicable, and compliance with regulatory requirements.
Your personal data is also shared with organisations and bodies including but not limited to:
a) Regulatory and other authorities, within the context of their legal obligations and/or authorities.
b) Any party linked with you or your business’s product or service, such as guarantors and security providers.
c) Independent financial and other advisors.
d) Companies or individuals you ask us to share your data with.
e) Natural or legal persons with which we have contracted, amongst others, for the provision of services to us, including services relating to the operation of your accounts and the provision of services to you, and which are bound by confidentiality provisions or professional secrecy obligations.
We may also share your personal information if the structure of Alpha Bank Group changes in the future or if we choose to sell, transfer, or merge parts of our business, or our assets, or seek to merge with other companies.
5. Why do we process your data (purpose of the processing) and on what legal basis
We process the aforementioned personal data in compliance with the provisions of GDPR, applicable local legislation as amended and/or replaced from time to time as well as any other relevant legislation, rules and/or regulations.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
We process your personal data for one or more of the following reasons:
a) For compliance with a legal obligation
As a registered limited company with the Registrar of Companies, we are subject to various legal obligations as well as other regulatory requirements.
b) For the entering into or performance of contractual obligations
The processing of personal data is carried out in order to provide the services pursuant to contracts with you or to take steps at your request prior to entering into a contract. The purposes of the data processing are primarily dependent on the specific product granted to you and the contract terms and conditions provide more details concerning the relevant purposes.
c) For the purposes of safeguarding legitimate interests
Where necessary, we process your data in order to safeguard our legitimate interests. Examples of such processing include but are not limited to:
i. Asserting legal claims and mounting a defence in the event of litigation.
ii. Actions to manage our business and further develop services and products.
iii. Safeguarding ARES IT security and IT operations.
iv. Monitoring CCTV footage to safeguard against trespassers, to gather evidence in the event of robbery or fraud.
v. Measures for premises’ and systems’ security.
vi. Risk management.
vii. Transferring, assigning (whether outright or as security for obligations) and/or selling to one or more persons of, and/or charging and/or placing an encumbrance over any or all of ARES rights, title or interest under any agreement between you and ARES.
d) On the basis of your consent
Insofar as you have granted us consent for the processing of your personal data, the lawfulness of such processing is based on your consent.
Any such consent granted, may be revoked at any time by contacting us. However, any processing of personal data prior to the receipt of your revocation will not be affected.
6. How long we keep your personal information for
We will keep your personal information for as long as you maintain any type of relationship with ARES.
After your relationship with ARES ends (e.g. completion of the sale process with respect to a specific property), we may keep your personal information for a period of up to 10 (ten) years. We may keep your data for longer than the said period if we cannot delete it for legal and/or regulatory and/or technical reasons. If we do so, we will ensure that your privacy is protected and the data is used only for the purposes stated in paragraph 5 above.
In case you provide us with personal data for the purposes of submitting a tender for the purchase of a specific property but the sale did not go through, all personal information with respect to your tender shall be kept for a period of 6 (six) months after the submission of the tender in question.
In case you provide us with personal data for the purposes of submitting an inquiry for a property, we shall keep your personal information for a period of up to 6 (six) months from the date of submission of your inquiry.
7. Data transferred to a country outside the European Union
ARES may transfer your personal data to countries outside the European Union (third countries) in the following cases:
a) Where the European Committee has issued delegated acts for the adequate protection of the personal data in the specific country or to an international organisation.
b) Where you have been specifically informed and have provided your explicit consent to ARES and the other conditions of the legislative framework are met.
c) Where the transfer is necessary for the execution of a contract.
d) Where such transfer is necessary to establish, exercise or support legal claims or defend ARES rights.
e) Where there is an obligation under a legal provision or a transnational or international convention.
f) In the context of complying with obligations on the automatic exchange of information in the tax area, as these result from the regulatory framework.
In any event, transfers to third countries and international organisations may only be carried out in compliance with GDPR.
For the fulfillment of the obligations set out in e) or f) above, ARES may transfer your personal data to relevant national authorities so that they can convey them to the relevant third country authorities.
8. What data protection rights you have
The following are the rights you have pursuant to the provisions of the GDPR as well as any other relevant legislation in relation to data protection:
a) Right to request access to your personal data.
b) Right to request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
c) Right to request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no valid reason for us to continue processing it. Note, however, that we may not always be able to satisfy your request of erasure, for specific legal reasons which will be notified to you.
d) Right to object. You have the right to object to the processing of your personal data, at any time and for reasons related to your particular situation where the legal basis on which the processing activity is based on our legitimate interests. In the event where you exercise this right we will no longer process your personal data, unless we can prove compelling legitimate grounds, which override your interests, rights and freedoms.
e) Right to request restriction of processing of your personal data (i) if it is not accurate; (ii) where processing may be unlawful, however you do not want us to erase your data but rather to restrict it; (iii) where you need us to hold the data even if we no longer require it; or (iv) where you may have objected to our use of your data but we need to verify whether we have legitimate grounds to use it.
If you exercise the abovementioned right, the data in question, other than being stored, will be processed only with your consent or for the establishment, exercise or support of legal claims, or for the protection of the rights of another natural or legal person, or for important public interest reasons in the European Union or member state.
f) Right to request the receipt of your personal data or its transfer to a third party.
g) In case the processing of the data is performed subject to your consent, you may withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.
Exercising your abovementioned rights is free of charge. However, please note that we may charge you with an administrative fee, in cases where requests are deemed unfounded or excessive, in particular because of their repetitive character.
9. If you choose not to give your personal information
In the context of our business relationship we may need to collect personal information due to legislative or regulatory obligations, or under the terms of a contract we have, or may potentially enter into, with you. Without this data, we are, in principle, not in a position to enter into or perform the terms of a contract with you, including the execution of transactions to and from your account and the provision of services to you.
Where data collection is optional, this is made clear at the point of collection.
10. To what extent we use automated decision making and profiling
ARES does not make decisions solely on the basis of automated processing.
Please be advised that part of your data may be automatically processed as part of our assessment of certain personal aspects (profiling), indicatively for marketing of new products and services of ARES and/or of companies within the Alpha Bank Group or of third parties cooperating with ARES, as long as you have given your consent.
11. Lodging a complaint
Please let us know if you are unhappy with how we have used your personal information. You can contact us using the contact details stated in paragraph 2 of this privacy notice.
You also have the right to lodge a complaint to the Commissioner for the protection of personal data.
12. Cookies
When you visit our website, our system automatically collects information about your visit, such as your browser type, your IP address and the referring website. You can set your browser not to save any cookies of this website and you may also delete cookies automatically or manually. However, please note that by doing so you may not be able to use all the provided functions of our website in full.
13. Changes to our privacy notice
We may modify this privacy notice from time to time. We will notify you appropriately when we make changes to this privacy notice and we will amend the issue date of this privacy notice.
The revised privacy notice will be available on our website https://www.aresproperties.com.cy and at our offices and it is our recommendation that you review it periodically so as to be always informed as to how we protect and process your personal information.
