Get in Touch

Privacy Policy

Effective Date: 18/10/2026

  1. Who we are

This website is operated by TNT ESTATES LIMITED (trading as “Dio Homes”; “we”, “us”, “our”), a property development company registered in Cyprus under company number H.E. 394118, with its registered office at Kefallinias 23, Flat 1, Deryneia, 5380, Cyprus.

We are the data controller responsible for your personal data collected through this website and in the course of our property sales and marketing activities.

If you have any questions about this policy or about how we handle your personal data, contact us at:

  • Email: [email protected]
  • Phone: +357 99 68 12 12
  • Post: Kefallinias 23, Flat 1, Deryneia, Cyprus
  1. About this policy

This policy explains what personal data we collect when you use our website or contact us about a property, why we collect it, the legal basis on which we process it, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Cyprus Data Protection Law (Law 125(I)/2018).

Please read it alongside our Terms of Use. Information about the cookies and similar technologies we use is set out in section 5.

  1. The personal data we collect
    1. Information you give us directly. When you submit an enquiry form, request property plans or a viewing, or otherwise contact us, we collect:
      • your name;
      • your email address;
      • your phone number (if provided);
      • the contents of your message or enquiry;
      • any other details you choose to share about your property requirements or
    2. Information we collect automatically. When you visit the website, we and our service providers may collect, through cookies and similar technologies:
      • your IP address and approximate location;
      • browser type, device type, and operating system;
      • the pages you view, links you click, and time spent on the site;
      • the website or source that referred you to us.

We do not intentionally collect special-category data (such as health, religion, or political opinions), and we ask that you do not include such information in your enquiries.

  1. Why we use your data, and our legal basis

Under the GDPR we must have a lawful basis for each use of your personal data. Ours are:

What we do with your data

Purpose

Legal basis (GDPR Art. 6)

Respond to your enquiry and provide property information, plans, or viewings

To take steps at your request before entering a possible contract, and to answer you

Steps prior to a contract (Art. 6(1) (b)) and/or our legitimate interest in responding to enquiries (Art.

6(1)(f))

Send you marketing about our developments (only if you opt in)

To keep interested buyers informed of new units and projects

Your consent (Art. 6(1)(a))

Analyse how the website is used and measure our advertising, via analytics and advertising cookies

To improve the site and our marketing

Your consent (Art. 6(1)(a))

Keep records required for tax, accounting, and legal compliance

To meet our legal obligations in Cyprus

Legal obligation (Art. 6(1)(c))

Protect the website and prevent fraud or misuse

To keep our systems and data secure

Our legitimate interests (Art. 6(1) (f))

Where we rely on consent, you can withdraw it at any time (see §9). Where we rely on legitimate interests, you can object (see §9), and we have balanced our interests against your rights.

  1. Cookies and similar technologies

Our website uses cookies. Essential cookies are needed for the site to function and do not require consent. Non-essential cookies — including analytics and advertising cookies — are only set after you give consent through our cookie banner, and you can change your choice at any time via the “Cookie settings” link in the footer of the website.

We currently use the following non-essential tools. Each one is loaded only after you accept the relevant category in the cookie banner:

  • Google Analytics 4 (Google Ireland Limited) — usage statistics: which pages are viewed, how long visitors stay and how they found the website. Cookies: _ga and _ga_* (up to 2 years). Privacy notice: https://policies.google.com/privacy
  • Hotjar (Hotjar Ltd, Malta) — heatmaps and session recordings that show how visitors click, scroll and move around the site, so we can improve it. We configure Hotjar so that what you type into forms is not recorded. Cookies: _hjSessionUser_* (up to 1 year), _hjSession_* (30 minutes) and similar short-lived Hotjar cookies. Privacy notice: https://www.hotjar.com/privacy/
  • Meta (Facebook) Pixel (Meta Platforms Ireland Limited) — measures the performance of our advertising on Facebook and Instagram and helps us show relevant ads to people who have visited the website. Cookies: _fbp (up to 3 months). For the collection and transmission of data to Meta through the Pixel, Meta and we act as joint controllers. Privacy notice: https://www.facebook.com/privacy/policy/
  • Google Ads conversion tracking and remarketing (Google Ireland Limited) — measures how well our Google advertising performs and, where we run remarketing campaigns, helps us show relevant ads to people who have visited the website. Cookies: _gcl_au and _gcl_aw (up to 3 months), and Google advertising cookies such as IDE (up to 13 months). Privacy notice: https://policies.google.com/privacy

None of these tools is activated until you give your consent through the cookie banner. You can accept or refuse each category, and change or withdraw your choice at any time via the “Cookie settings” link in the footer. Refusing non-essential cookies does not affect your use of the website.

  1. Who we share your data with

We do not sell your personal data. We share it only with:

  • Service providers (“processors”) who help us run the website and our business — for example our website hosting provider, our email and CRM providers, and the analytics and advertising providers listed in section 5. They act on our instructions under a written data-processing agreement.
  • Professional advisers such as our lawyers, accountants, and auditors, where necessary.
  • Public authorities, courts, or regulators, where we are required to by law.
  • A buyer or successor, if our business is sold or reorganised, subject to this policy.
  1. International data transfers

Some of our service providers (for example certain analytics or advertising tools) are based outside the European Economic Area, including in the United States. Where your data is transferred outside the EEA, we ensure an appropriate safeguard is in place, such as:

  • the provider’s certification under the EU–US Data Privacy Framework (which replaced the invalidated EU–US Privacy Shield in 2023); or
  • the European Commission’s Standard Contractual Clauses; or
  • transfer to a country with an EU adequacy decision.

You can ask us for more detail on the safeguards that apply (see §9).

  1. How long we keep your data

We keep your personal data only as long as necessary:

  • Enquiries that don’t lead to a purchase: for up to 24 months after our last contact, then deleted.
  • Customers / completed purchases: for as long as needed to perform the contract, and then for the period required by Cyprus tax and accounting law (generally at least 6 years).
  • Marketing consents: until you unsubscribe or withdraw consent.
  • Analytics and advertising data: Google Analytics data is kept for 2 months and then automatically deleted; Hotjar data is kept for up to 12 months; data held by Meta is governed by Meta’s own retention practices (see its privacy notice in section 5). The cookies themselves expire as stated in section 5.

When data is no longer needed, we securely delete or anonymise it.

  1. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • rectify inaccurate or incomplete data;
  • erase your data (“right to be forgotten”) in certain circumstances;
  • restrict our processing of your data in certain circumstances;
  • data portability — receive your data in a portable format;
  • object to processing based on our legitimate interests, and to direct marketing at any time;
  • withdraw consent at any time, where we rely on it (this does not affect processing done before withdrawal).

To exercise any of these, contact us using the details in §1. We will respond within one month, as required by the GDPR. There is normally no charge.

  1. Complaints

If you believe we have handled your personal data unlawfully, we’d like the chance to put it right, so please contact us first. You also have the right to lodge a complaint with the Cyprus supervisory authority:

Office of the Commissioner for Personal Data Protection 15 Kypranoros Street, 1061 Nicosia (P.O. Box 23378, 1682 Nicosia), Cyprus Website: www.dataprotection.gov.cy

  1. How we protect your data

We use appropriate technical and organisational measures — including secure hosting, encryption in transit (HTTPS), access controls, and staff confidentiality — to protect your personal data against loss, misuse, and unauthorised access. No online transmission is ever completely secure, but we work to protect your information and review our measures regularly.

  1. Children

Our website and services are directed at adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

  1. Links to other websites

Our website may link to third-party sites (for example map or social-media links). We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy notices.

  1. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. Significant changes will be highlighted on the website.

  1. Contact us

For any question about this policy or your personal data:

TNT ESTATES LIMITED, KEFALLINIAS 23, FLAT 1, DERYNEIA, CYPRUS

Email: [email protected] · Phone: +357 99 68 12 12