Privacy Policy
Last updated: 9 November 2026
1. Who we are and how to contact us
The following companies (together "Nexton", "we", "us") are joint controllers of the personal data described in this policy:
Company | Registration number |
|---|---|
Nexton Ltd | HE 471673 |
Nexton Shbiro Ltd | HE 486319 |
Nexton Shbiro Developers Ltd | HE 491804 |
All three are registered in Cyprus. They have agreed between them that Nexton Ltd, Arch. Makarios III Avenue 117, 3021 Limassol, Cyprus, is the contact point for all privacy matters and handles requests to exercise your rights. You may still contact any of the three companies, and each remains responsible to you under the law.
We develop residential projects in Limassol, including Sarona, King George, LEV Limassol, Regent Royal and ParkOne, in partnership with Shbiro Group. When you reserve or buy a property, the company named in your agreement is also a controller of the data used for that agreement.
For any question about this policy or your personal data, contact us:
- Email: office@nextoncy.com (subject line "Data Protection")
- Phone: +357 25 554200
- Post: Data Protection, Nexton Ltd, at the address above
We have not appointed a Data Protection Officer because the law does not require one for our activities. The contact details above reach the person responsible for data protection.
2. Scope of this policy
This policy covers personal data we collect when you:
- visit nextoncy.com or submit its contact form;
- respond to our adverts or lead forms on Facebook, Instagram or other platforms;
- message us on WhatsApp, Messenger, Instagram, by email or by phone;
- attend our presentations, webinars or viewings;
- reserve or buy a property from a Nexton group company;
- work with us as a broker or agent, including through our broker portal (the "Login" area of the site).
It does not cover websites, apps or services run by others, even when we link to them. Facebook, Instagram, WhatsApp and Google have their own privacy policies.
3. Personal data we collect
We collect only what we need to answer you, sell you a property and run our business.
Category | Examples | Where it comes from |
|---|---|---|
Contact and enquiry data | Name, email, phone number, country, preferred language, the project and type of unit you are interested in, your message | You, via the website, a lead form, a message or a call |
Purchaser data | ID card or passport details, date of birth, nationality, address, tax identification number, company details if you buy through a company, proof of funds and source of funds, bank details, payment records, signed agreements | You, your lawyer, your broker or your bank |
Broker and agent data | Name, company, contact details, the clients you introduce, commission records, broker portal login and activity | You and your company |
Communications | Emails, WhatsApp and Messenger messages, notes of calls and meetings | You and our staff |
Website and device data | IP address, browser and device type, pages visited, how you arrived on the site, cookie and advertising identifiers | Collected automatically, subject to your cookie choices (Section 6) |
Marketing preferences | The marketing you agreed to receive, when, and any opt-outs | You |
We do not ask for sensitive data such as health, religion or political opinions. Please do not send it to us.
3.1 Data we receive from Facebook, Instagram and WhatsApp
Meta Platforms Ireland Ltd ("Meta") runs Facebook, Instagram, Messenger and WhatsApp. Through these services we receive:
- Lead ad forms: when you submit a lead form in one of our Facebook or Instagram adverts, Meta passes us the details in the form, usually your name, email, phone number and your answers to our questions. The form shows a link to this policy before you submit.
- Messages: the content of messages you send to our Facebook page, Instagram account or WhatsApp number, with your profile name and, for WhatsApp, your phone number.
- Meta Pixel and Conversions API: if you accept marketing cookies, the Meta Pixel on our website tells Meta which pages you visited and whether you submitted the contact form, so we can measure and target our adverts. Meta acts as joint controller with us for collecting and transmitting this data; Meta's own use is governed by the Meta Privacy Policy.
- Audience matching: We upload contact details of people who have enquired with us, in hashed form, so Meta can show them relevant adverts or exclude them from adverts. We only do this where you have consented to marketing, and we remove you from these lists when you withdraw consent or ask us to delete your data.
We do not receive your Facebook or Instagram password, private messages with other people, or your friends list.
4. Why we use your data and our legal basis
Each use of your data has a legal basis under Article 6(1) of the EU General Data Protection Regulation (GDPR).
What we do | Legal basis |
|---|---|
Reply to your enquiry, send the project information you asked for, arrange calls, meetings and viewings | Steps you asked us to take before a contract (Art. 6(1)(b)); our legitimate interest in answering enquiries (Art. 6(1)(f)) |
Prepare, negotiate, sign and carry out reservation and sale agreements, take payments, deliver your property and provide after-sales service | Performance of a contract (Art. 6(1)(b)) |
Verify your identity and source of funds, screen against sanctions lists, and meet tax, VAT, anti-money-laundering, Land Registry and accounting obligations | Legal obligation (Art. 6(1)(c)) |
Arrange rental management of your unit where your agreement provides for it | Performance of a contract (Art. 6(1)(b)) |
Manage brokers and agents, their introductions, commissions and portal access | Performance of a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
Send you news and offers about our projects | Your consent (Art. 6(1)(a)); for existing customers, email about similar projects as allowed by Cyprus Law 112(I)/2004 |
Measure and target our adverts, including through the Meta Pixel, Google Analytics and audience matching | Your consent (Art. 6(1)(a)) |
Keep the website secure, run strictly necessary cookies, prevent fraud and misuse | Legitimate interest (Art. 6(1)(f)) |
Establish, exercise or defend legal claims | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, we have weighed it against your rights. You can object at any time (Section 11).
If you do not give us the data we need to sign or perform an agreement, or that the law requires us to collect, we cannot proceed with the purchase. We do not make decisions about you based solely on automated processing.
5. Marketing
We send marketing only on the channels you agreed to: email, SMS, WhatsApp or phone. Agreeing to marketing is never a condition of making an enquiry or buying a property.
You can stop marketing at any time, free of charge:
- click "unsubscribe" in any marketing email;
- reply "STOP" to an SMS or WhatsApp message;
- tell us during a call; or
- email office@nextoncy.com.
Withdrawing consent does not affect marketing sent before you withdrew. We keep a record of your opt-out so that we do not contact you again.
6. Cookies and similar technologies
Cookies are small files stored on your device when you visit a website. We use strictly necessary cookies on their own; all other cookies run only after you accept them in our cookie banner.
Type | What it does | Examples | Your consent needed |
|---|---|---|---|
Strictly necessary | Makes the site work: page loading, security, language choice, broker portal login, remembering your cookie choice | Our own cookies | No |
Analytics | Counts visits and shows how people use the site, so we can improve it | Such as Google Analytics | Yes |
Marketing | Measures our adverts and shows you relevant adverts on other platforms | Meta Pixel and similar advertising tags, such as Google Ads | Yes |
You can change your choice at any time through the "Cookie settings" link at the bottom of every page, or by deleting cookies in your browser. The cookie banner lists each cookie we use, who provides it and how long it lasts. Analytics and marketing cookies are kept for no more than 13 months.
You can also control adverts you see on Facebook and Instagram in your Meta ad preferences.
7. Who we share your data with
We do not sell your personal data. We share it only with the recipients below, and only what each needs.
Recipient | Why |
|---|---|
Between Nexton Ltd, Nexton Shbiro Ltd and Nexton Shbiro Developers Ltd, and with the company that owns your project | To handle your enquiry, reservation, purchase and rental arrangements |
Our project partner Shbiro Group and its companies | Joint development and marketing of the projects |
Brokers and agents | When they introduced you, or when you ask us to deal with them |
Lawyers, accountants, auditors, banks and payment providers | To prepare agreements, receive payments and keep our accounts |
Service providers acting on our instructions: website hosting, CRM and broker portal, email, cloud storage, messaging (WhatsApp), analytics and advertising (Meta, Google) | To run our systems and communications. They may use the data only as we instruct, under written agreements required by Article 28 GDPR |
Public authorities, including the Department of Lands and Surveys, the Tax Department, the Unit for Combating Money Laundering (MOKAS), courts and police | Where the law requires it or to protect our legal rights |
A buyer or successor of all or part of our business | If we sell, merge or restructure, under confidentiality terms |
8. Transfers outside the European Economic Area
We mainly process your data in Cyprus and the EU. Some recipients are outside the European Economic Area (EEA). When we transfer data there, we use one of these safeguards:
- Israel, where Shbiro Group operates: the European Commission has decided that Israel provides an adequate level of protection.
- United States, where some of our technology and advertising providers are based (for example Meta, Google and our hosting and CRM providers): the provider is certified under the EU-US Data Privacy Framework, or we use the European Commission's Standard Contractual Clauses.
- Other countries: the European Commission's Standard Contractual Clauses, with extra measures where needed.
You can ask us for a copy of the safeguards that apply to your data at office@nextoncy.com.
9. How long we keep your data
We keep data only as long as we need it, then delete or anonymise it.
Data | How long |
|---|---|
Enquiries that do not lead to a reservation | 36 months from our last contact with you |
Marketing consent and opt-out records | Until you withdraw consent; the opt-out record is kept for as long as needed to make sure we do not contact you again |
Reservation and purchase records, including identity and source-of-funds checks | The life of the agreement, then 10 years after completion, title transfer or termination, to cover legal claims including latent building defects, or longer if the law requires it |
Broker and agent records | The life of the relationship, then 6 years |
Website logs | Up to 12 months |
Cookies | Up to 13 months, as shown in the cookie banner |
We keep data longer if it is needed for an ongoing or expected legal claim, until that claim is resolved.
10. How we protect your data
We use technical and organisational measures suited to the risk, including encrypted connections (HTTPS) on our website, access controls so staff and brokers see only the records they need, password-protected systems, confidentiality obligations for our staff, and written data protection terms with our service providers.
If a personal data breach is likely to put your rights at risk, we will report it to the Commissioner for Personal Data Protection within 72 hours where the law requires, and tell you without undue delay if the risk to you is high.
11. Your rights
Under the GDPR and Cyprus Law 125(I)/2018 you have the right to:
- access your personal data and get a copy;
- correct data that is wrong or incomplete;
- delete your data (see below);
- restrict how we use your data;
- receive data you gave us in a portable format;
- object to processing based on our legitimate interest, and to direct marketing at any time;
- withdraw consent at any time, without affecting processing before you withdrew.
Email office@nextoncy.com to use any of these rights. We reply within one month. For complex or numerous requests we may extend this by up to two more months and will tell you why. We may ask you to confirm your identity first. There is no charge unless a request is clearly unfounded or excessive.
How to delete your data
To ask us to delete your personal data, including data we received from Facebook or Instagram lead forms or messages:
- Email office@nextoncy.com with the subject line "Delete my data".
- Include your name and the email address or phone number you used with us.
- We will confirm by email when your data has been deleted, within one month.
We will delete your data from our website systems, CRM, mailing lists and advertising audiences. If you have reserved or bought a property, we must keep the records the law requires (Section 9) and will tell you which ones.
Complaints
You can complain to the Cyprus supervisory authority:
Commissioner for Personal Data Protection P.O. Box 23378, 1682 Nicosia, Cyprus Tel: +357 22 818456 Email: commissioner@dataprotection.gov.cy Website: www.dataprotection.gov.cy
You can also complain in the EU country where you live or work. We would appreciate the chance to resolve your concern first.
12. Other information
Children. Our website and services are for adults. We do not knowingly collect data from anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it.
Links to other sites. Our website links to Facebook, Instagram, LinkedIn, X and WhatsApp. These services are run by other companies under their own privacy policies.
Changes to this policy. We may update this policy when our practices or the law change. The date at the top shows the latest version. If a change materially affects how we use data of customers or brokers we work with, we will tell them by email.
Governing law. This policy is governed by the GDPR and the laws of the Republic of Cyprus.
