PRIVACY POLICY

 1. INTRODUCTIONVRI VICTORIA ROYAL INVESTMENT LTD (hereinafter referred to as “VRI”, “the Company”, “we”, “us”, or “our”) is a private limited liability company incorporated and registered in the Republic of Cyprus, operating in the real estate development and property investment sector.VRI is committed to respecting and protecting the privacy, confidentiality and personal data of individuals who interact with our Company, website, services, representatives and business activities.This Privacy Policy explains how we collect, use, process, store, disclose and protect personal data, as well as the rights available to individuals under applicable data protection legislation.This Policy applies to:- Visitors to our official website;- Prospective and existing property purchasers;- Individuals enquiring about residential developments or investment opportunities;- Investors and business partners;- Individuals communicating with our sales, marketing or management teams;- Participants in property presentations, corporate events and promotional activities;- Individuals interacting with our social media accounts, advertisements and other digital channels;- Other individuals whose personal data is processed in connection with our legitimate business operations.By using our website or communicating with VRI, individuals are encouraged to review this Privacy Policy to understand how their personal information is handled.This Privacy Policy does not replace any additional privacy notices that may be provided in connection with specific transactions, services or processing activities.

 

2. IDENTITY OF THE DATA CONTROLLER  

For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Cyprus data protection legislation, the data controller is:

Registered Legal Name: VRI VICTORIA ROYAL INVESTMENT LTD

Company Registration Number: HE 456395

Legal Form: Private Limited Liability Company

Country of Incorporation: Republic of Cyprus

Date of Incorporation: 14 February 2024

Registered Office:53 Georgiou Griva Digeni, Shop 1 6036 Larnaca, Cyprus

Official Website: https://www.vridevelopments.com

Email: hello@vridevelopments.com

 

VRI determines the purposes and means of processing personal data in connection with its real estate development, property sales, investment-related enquiries, marketing, customer relationship management and associated business operations, insofar as it acts as an independent data controller.

 

3. APPLICABLE LEGAL FRAMEWORK

VRI processes personal data in accordance with applicable European Union and Cyprus legislation, including:- Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR);- The Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data Law of 2018, Law 125(I)/2018, as amended;- Directive 2002/58/EC concerning privacy and electronic communications, as amended, and applicable Cyprus implementing legislation;- Other applicable legal obligations concerning corporate administration, taxation, accounting, property transactions, regulatory compliance and anti-money laundering.Where VRI's processing activities fall within the scope of additional international data protection legislation, the Company will assess and comply with the applicable requirements.

 

4. PERSONAL DATA WE COLLECT

Depending on the nature of an individual's interaction with VRI, we may collect and process the following categories of personal data.

 

4.1 Identification and Contact Information

- Full name;

- Email address;

- Telephone or mobile number;

- Residential or postal address;

- Nationality or country of residence, where relevant;

- Preferred communication language;

- Identification information where necessary for a lawful transaction or compliance purpose.

 

4.2 Property and Investment Enquiry Information

- Property preferences and requirements;

- Preferred property location;

- Property type and size;

- Indicative purchasing budget;

- Intended property use;

- Purchasing or investment interests;

- Preferred purchasing timeframe;

- Property viewing requests;

- Communications and correspondence with our representatives.

​

4.3 Transactional and Financial Information

Where necessary for property transactions or applicable legal obligations, VRI may process:

- Reservation and purchase documentation;

- Contractual information;- Invoices and payment records;

- Relevant financial and billing information;

- Identification and due diligence documentation;

- Information required for applicable regulatory or anti-money laundering compliance.

​

4.4 Website and Technical Information

When individuals visit our website, certain technical information may be collected, including:

- Internet Protocol (IP) address;

- Browser and device information;

- Operating system;

- Website access times;

- Pages visited;

- Website interactions;

- Referral sources;

- Cookie identifiers and similar online information, where applicable.

​

4.5 Marketing and Communication Information

We may process information relating to:

- Property enquiries;

- Marketing subscriptions and preferences;

- Records of consent or objections;

- Responses to promotional campaigns;

- Social media interactions;

- Communications through authorised messaging platforms;

- Corporate event participation.

​

4.6 Photographic and Audiovisual Information

VRI may collect photographs and audiovisual recordings during property presentations, corporate events, project launches and other business activities.Where individuals are identifiable, such material constitutes personal data and will be processed on an appropriate lawful basis, taking into account the nature of the event, the intended use of the material and applicable data protection requirements.Additional information or consent will be provided or obtained where legally required.

 

5. HOW WE COLLECT PERSONAL DATA

VRI may collect personal data through:

- Direct communications with individuals;

- Website interactions and enquiries;

- Email and telephone correspondence;

- Property consultations and viewings;

- Social media and messaging platforms;

- Corporate events and property presentations;

- Contractual and transactional documentation;

- Authorised real estate intermediaries and professional advisers;

- Existing customer records maintained in authorised business spreadsheets;

- Customer relationship management systems;

- Website analytics and other technologies, subject to applicable legal requirements.

Where personal data is obtained from sources other than the individual concerned, VRI will comply with applicable transparency obligations under Article 14 GDPR, unless a lawful exception applies.

 

6. PURPOSES AND LEGAL BASES FOR PROCESSING

VRI processes personal data only where an appropriate lawful basis exists under Article 6 GDPR.The principal purposes and lawful bases include:

 

6.1 Responding to Property Enquiries

To provide information about developments, available properties, pricing, specifications and purchasing opportunities.Legal basis: Legitimate interests under Article 6(1)(f), or taking steps at the individual's request before entering into a contract under Article 6(1)(b), depending on the circumstances.

 

6.2 Property Sales and Contractual Relationships

To arrange consultations and viewings, prepare reservation documents, negotiate agreements, administer property purchases and perform contractual obligations.Legal basis: Article 6(1)(b), where processing is necessary for a contract with the individual or requested pre-contractual steps.

 

6.3 Legal and Regulatory Compliance

To fulfil applicable accounting, taxation, corporate record-keeping, property transaction, anti-money laundering and other legal obligations.Legal basis: Article 6(1)(c), where a relevant legal obligation applies.

 

6.4 Customer Relationship Management

To organise enquiries, maintain customer relationships, coordinate sales activities and administer legitimate business communications.Legal basis: Article 6(1)(b) or Article 6(1)(f), depending on the processing purpose and circumstances.

 

6.5 Marketing and Promotional Communications

To communicate information about property developments, launches, events and other relevant opportunities where permitted by law.Legal basis: Consent under Article 6(1)(a), where required, or another lawful basis where applicable electronic communications and data protection legislation permits the relevant activity.

 

6.6 Website Analytics

To understand website usage and improve website performance and user experience.Legal basis: Consent where required for non-essential analytics technologies, and an appropriate GDPR lawful basis for any associated personal data processing.

 

6.7 Security and Legal Claims

To protect business systems, prevent unauthorised access, investigate incidents and establish, exercise or defend legal claims.Legal basis: Legitimate interests or compliance with legal obligations, as applicable.Where VRI relies on legitimate interests, the Company will assess the necessity of the processing and balance those interests against the rights and freedoms of the individuals concerned.

 

7. CUSTOMER RELATIONSHIP MANAGEMENT AND DATA MIGRATION

VRI maintains information relating to prospective purchasers, existing customers, investors and other business contacts through authorised business records and customer relationship management systems.The Company is transitioning from spreadsheet-based record management, including Microsoft Excel, to the monday.com customer relationship management platform.During this transition, personal data may be reviewed, organised, updated, transferred, consolidated and migrated between existing authorised business records and the CRM system.

Such processing may be undertaken for legitimate purposes including:

- Maintaining customer and prospective purchaser records;

- Managing property enquiries;

- Coordinating sales communications;

- Organising appointments and property viewings;

- Maintaining relevant communication histories;

- Administering ongoing customer relationships;

- Improving the accuracy and organisation of business records.VRI will assess the applicable lawful basis for these processing activities and take appropriate steps to protect personal data during migration.Where appropriate, outdated, duplicate or unnecessary records will be identified for correction, deletion or other lawful handling.The migration of existing customer information into a CRM system does not automatically establish permission to use that information for unrelated marketing purposes.Access to customer records should be restricted to authorised personnel according to their legitimate business responsibilities.

 

8. BUSINESS EMAIL, CLOUD STORAGE AND COMMUNICATIONS

VRI uses Google Workspace, including business email and Google Drive, for corporate communications, collaboration and document management.These services may process personal data in connection with:

- Customer correspondence;

- Property enquiries;

- Contractual documentation;

- Internal business communications;

- Customer records;

- Relevant administrative and operational activities.

VRI may also use other authorised communication platforms, including telephone, messaging and social media services.The applicable contractual arrangements, processing roles, security safeguards and international transfer mechanisms depend on the services and configurations used.Where third-party service providers process personal data on behalf of VRI, appropriate contractual safeguards will be required in accordance with applicable law.

 

9. WEBSITE ANALYTICS, COOKIES AND EMBEDDED CONTENT

VRI uses Google Analytics to obtain information concerning website performance, visitor interactions and website usage.Google Analytics may process technical and usage information, including online identifiers and information relating to interactions with website content.Our website may also contain embedded videos or other content provided through third-party platforms, including YouTube or Vimeo.Such providers may process technical information in accordance with their own applicable privacy practices.VRI uses a cookie consent mechanism to provide visitors with information and choices concerning applicable website technologies.Where cookies or similar technologies require prior consent, they must not be activated before valid consent has been obtained.Visitors may manage or withdraw their consent through the available cookie preference controls.Further information regarding cookies, their purposes, providers and durations is provided through the website's Cookie Policy and applicable cookie preference information.

 

10. MARKETING, ADVERTISING AND SOCIAL MEDIA

VRI promotes its real estate developments, available properties, corporate events and business activities through various communication and advertising channels.These may include:

- The official Company website;

- Email communications;

- Facebook and Instagram;

- LinkedIn;

- YouTube;

- Google advertising services;

- Other authorised promotional channels.

Where marketing activities involve personal data, VRI will identify and apply an appropriate lawful basis.Electronic direct marketing communications will be sent only where permitted under applicable data protection and electronic communications legislation.Where consent is required, it must be freely given, specific, informed and unambiguous.Individuals may withdraw consent or object to direct marketing at any time.A person who contacts VRI to request information about a property will not automatically be considered to have consented to unrelated or recurring promotional communications.VRI will respect valid objections to direct marketing and cease processing personal data for that purpose.Limited information may be retained where necessary to ensure that an individual's objection continues to be respected.

 

11. DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

VRI may disclose personal data to authorised third parties where necessary and lawful for the relevant business purpose.Depending on the circumstances, recipients may include:

- Authorised Company employees and representatives;

- Customer relationship management providers;

- Website hosting and technical service providers;

- Cloud storage and business communication providers;

- Analytics and advertising service providers;

- Legal advisers and other professional consultants;

- Accountants and auditors;

- Financial institutions and payment service providers;

- Property transaction intermediaries;

- Competent public authorities and regulators;

- Other parties legitimately involved in a property transaction.

Where a third party acts as a processor on VRI's behalf, the processing must be governed by appropriate contractual arrangements meeting Article 28 GDPR.Some third parties may act as independent controllers and be responsible for their own processing activities.VRI does not sell personal data to data brokers as part of its ordinary business operations.

 

12. INTERNATIONAL TRANSFERS OF PERSONAL DATA

Given the international nature of VRI's business activities and the use of third-party technology providers, personal data may be transferred to or accessed by recipients outside the European Economic Area.Where such activities constitute international transfers under the GDPR, VRI will ensure that an appropriate transfer mechanism applies.Depending on the circumstances, this may include:

- An adequacy decision issued by the European Commission;

- European Commission-approved Standard Contractual Clauses;

- Other appropriate safeguards permitted under the GDPR;

- A specific derogation where its legal requirements are satisfied.

Where necessary, VRI will assess the relevant transfer risks and implement supplementary safeguards.Individuals may request information concerning applicable international transfer safeguards by contacting hello@vridevelopments.com.

​

13. PERSONAL DATA RETENTION

VRI processes and retains personal data in accordance with the GDPR principle of storage limitation.Personal data will be retained only for as long as necessary for the purposes for which it was collected or subsequently lawfully processed.Retention periods and criteria depend on:

- The nature and purpose of the processing;

- The duration of the relevant customer or business relationship;

- Applicable contractual obligations;

- Relevant statutory retention requirements;

- Accounting and taxation obligations;

- Applicable regulatory or anti-money laundering requirements;

- Relevant legal limitation periods;

- The necessity of retaining records for legal claims.

Prospective customer and enquiry information must not be retained indefinitely solely for speculative future marketing purposes.Where an individual withdraws marketing consent or objects to direct marketing, the relevant marketing processing will cease, subject to any limited retention necessary to respect the objection or comply with applicable law.Certain contractual, financial and compliance records may need to be retained for longer periods where required by law.Where personal data is no longer necessary and no lawful reason justifies continued retention, it will be deleted or anonymised.VRI's retention periods and procedures are subject to ongoing internal review and implementation.

 

14. INFORMATION SECURITY AND CONFIDENTIALITYVRI recognises the importance of protecting personal data against unauthorised access, accidental loss, alteration, disclosure, destruction or unlawful processing.In accordance with Article 32 GDPR, the Company is responsible for implementing technical and organisational security measures appropriate to the risks associated with its processing activities.Depending on the nature of the information and relevant systems, such measures may include:

- Individual user accounts and authentication controls;

- Role-based access restrictions;

- Confidentiality requirements;

- Secure document handling and storage;

- Appropriate security settings;

- Access reviews;- Incident response procedures;

- Security arrangements with relevant service providers.

Access to personal data should be limited to authorised individuals with a legitimate business need.VRI will review its information security arrangements as its systems and business operations develop.No electronic information system can be guaranteed to be completely secure.Where a personal data breach occurs, VRI will assess its notification obligations under Articles 33 and 34 GDPR and comply with applicable reporting requirements.

 

15. RIGHTS OF DATA SUBJECTS

Subject to the conditions and limitations established by applicable law, individuals have the following rights:

 

15.1 Right of Access**The right to request confirmation of whether their personal data is processed and to obtain access to that information.

15.2 Right to Rectification**The right to request correction of inaccurate or completion of incomplete personal data

15.3 Right to Erasure**The right to request deletion of personal data where the applicable legal conditions are satisfied.

15.4 Right to Restriction of Processing**The right to request restriction of processing in circumstances provided by law.

15.5 Right to Data Portability**The right to receive qualifying personal data in a structured, commonly used, machine-readable format and, where applicable, request its transmission to another controller.

15.6 Right to Object**The right to object to certain processing activities, including processing based on legitimate interests, subject to applicable legal conditions.Individuals have the right to object at any time to processing of their personal data for direct marketing purposes.

15.7 Right to Withdraw Consent**Where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

15.8 Rights Concerning Automated Decision-Making**The rights provided by Article 22 GDPR in relation to qualifying decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects.

15.9 Right to Lodge a Complaint**The right to lodge a complaint with a competent data protection supervisory authority.

 

16. EXERCISING DATA PROTECTION RIGHTSIndividuals may submit requests concerning their personal data by contacting:

VRI VICTORIA ROYAL INVESTMENT LTD

Email: hello@vridevelopments.com

Suggested Subject: Data Protection / GDPR Request

VRI will respond to requests without undue delay and, in principle, within one month of receipt.Where permitted by law, this period may be extended by up to two additional months, taking into account the complexity and number of requests.Where an extension is necessary, the individual will be informed within the initial one-month period.Requests will generally be handled free of charge, subject to the exceptions permitted under applicable legislation.Where necessary, VRI may request additional information to verify the identity of the person submitting the request.

 

17. DATA PROTECTION COMPLAINTS

Individuals who believe their personal data has been processed unlawfully may lodge a complaint with the competent supervisory authority.In Cyprus, the competent supervisory authority is:

Office of the Commissioner for Personal Data Protection*Republic of CyprusOfficial Website: https://www.dataprotection.gov.cy

Individuals may also have the right to lodge a complaint with another competent supervisory authority under the GDPR.VRI encourages individuals to contact the Company regarding privacy concerns so that they may be investigated and addressed.However, contacting VRI first is not a prerequisite for exercising the right to lodge a complaint.

 

18. CHILDREN'S PERSONAL DATA

VRI's real estate development, property sales and investment-related services are not directed at children.The Company does not intentionally solicit personal data from children for independent property purchasing or investment enquiries.Where personal data concerning a child must be processed for a lawful transaction or other legitimate purpose, VRI will comply with applicable legal requirements and safeguards.Where information concerning a child has been collected unlawfully, appropriate corrective measures will be taken.

 

19. AUTOMATED PROCESSING AND PROFILING

VRI may use digital systems to support customer relationship management, organise enquiries, analyse website performance and assist with business administration.Such processing may include the organisation or categorisation of customer information according to property preferences or enquiry characteristics.Where any activity constitutes profiling or automated decision-making within the meaning of the GDPR, VRI will assess and comply with the applicable lawful basis, transparency and safeguard requirements.VRI will not undertake solely automated decision-making producing legal or similarly significant effects unless permitted by applicable law and accompanied by the required safeguards.

 

20. CORPORATE EVENTS, PHOTOGRAPHY AND VIDEO RECORDINGS

VRI may organise or participate in property presentations, development launches, business networking events, corporate gatherings and promotional activities.In connection with such events, VRI may process registration information, attendance details, photographs and audiovisual recordings.Where identifiable individuals appear in photographs or recordings, VRI will assess the appropriate lawful basis for the relevant collection, publication or other use.Where legally required, consent will be obtained.Individuals may contact hello@vridevelopments.com regarding concerns about the use of identifiable photographic or audiovisual material.Any request will be assessed in accordance with applicable data protection legislation.

 

21. THIRD-PARTY WEBSITES AND EXTERNAL LINKS

The VRI website may contain links to third-party websites, social media platforms, professional service providers and other external resources.Such third parties may operate under their own privacy policies and processing practices.VRI does not control all processing activities independently undertaken by external website operators.Visitors are encouraged to review the relevant privacy policies before providing personal information to third parties.Nothing in this section excludes or limits any legal responsibility VRI may have where it acts as a controller or joint controller.

 

22. LEGAL COMPLIANCE AND DISCLOSURE TO AUTHORITIES

VRI may process or disclose personal data where necessary to comply with applicable legal obligations, lawful requests from competent authorities, judicial proceedings or legally binding orders.Such processing may relate to:

- Corporate governance and administration;

- Taxation and accounting;- Property transactions;

- Regulatory compliance;

- Applicable anti-money laundering obligations;

- Legal proceedings and investigations;

- Establishment, exercise or defence of legal claims.

Any disclosure will be assessed in accordance with applicable legal requirements, including necessity and proportionality where relevant.

 

23. CHANGES TO THIS PRIVACY POLICY

VRI reserves the right to review and update this Privacy Policy to reflect changes in:

- Applicable legislation;

- Regulatory guidance;

- Business activities;

- Technology systems;

- Third-party service providers;

- Personal data processing practices;

- Internal data protection procedures.

The latest version will be published on the Company's official website together with its revision date.

Where material changes require additional notification or consent under applicable law, VRI will take the necessary steps.

 

24. CONTACT INFORMATION

For any questions, concerns or requests regarding this Privacy Policy or the processing of personal data, please contact:

VRI VICTORIA ROYAL INVESTMENT LTD

Company Registration Number:HE 456395

Registered Office: 53 Georgiou Griva Digeni, Shop 1 6036 Larnaca, Cyprus

Email: hello@vridevelopments.com

Website: https://www.vridevelopments.com

 

VRI VICTORIA ROYAL INVESTMENT LTD is committed to respecting individual privacy rights and maintaining responsible personal data processing practices in accordance with applicable European Union and Cyprus law.

 

© 2026 VRI VICTORIA ROYAL INVESTMENT LTD. All Rights Reserved.