Privacy Policy

Last updated: October 22, 2026 · Version 1.0

1. Who we are

Roxel Innovative Investment Ltd is a company incorporated in the Republic of Cyprus (registration number HE 472635) with its registered office at 13 Tepeleniou Street, Tepelenio Court, 2nd floor, 8010 Paphos, Cyprus. We are the controller of the personal data described in this Privacy Policy. You can contact us at info@roxelinvest.com

2. Scope

This Privacy Policy explains how we collect, use, share and protect personal data when you visit roxelinvest.com (the “Site”), submit an enquiry or request a consultation through our Investor Relations page, or otherwise deal with us about our properties and projects. It is written to meet the requirements of Regulation (EU) 2016/679 (GDPR) and the Cyprus Law 125(I)/2018.

3. Personal data we collect

  • Information you give us: your name, email address, telephone number, country of residence, preferred language, and the content of your message, such as your investment interests, budget and property preferences.
  • Information collected automatically: IP address, browser type, device information, pages viewed, referring page, date and time of visit, and cookie identifiers (see Section 5).
  • Information arising from our dealings: correspondence, meeting notes, and reservation and transaction records.
  • Information required by law before a transaction: identity documents, proof of address, and source-of-funds and source-of-wealth information, together with the results of sanctions and politically-exposed-person screening. We collect these directly, or through our legal representatives, over secure channels and never through the Site’s contact form. Please do not send such documents through the form.
  • Special categories of data: we do not ask for data revealing health, race, religion, political opinions or similar matters. Please do not include them in your message.
  • Children: the Site is not directed at persons under 18, and we do not knowingly collect their data.

4. How we use personal data and our legal bases

  • Responding to enquiries, arranging consultations and providing the property information you request. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in managing enquiries (Article 6(1)(f)).
  • Negotiating, preparing and performing a property transaction. Legal basis: performance of a contract (Article 6(1)(b)).
  • Complying with anti-money-laundering, counter-terrorist-financing, sanctions, tax, accounting and other legal obligations. Legal basis: legal obligation (Article 6(1)(c)).
  • Operating, securing and improving the Site, preventing fraud and misuse, and establishing or defending legal claims. Legal basis: legitimate interests (Article 6(1)(f)).
  • Sending you marketing communications. Legal basis: your consent (Article 6(1)(a)), or, for existing clients, the limited exception permitted by Law 112(I)/2004. You may withdraw consent at any time.
  • Non-essential cookies and similar technologies. Legal basis: your consent.

Where we rely on legitimate interests, we have weighed them against your rights and freedoms. You may ask us for details of that assessment.

5. Cookies and similar technologies

Strictly necessary cookies are used without consent because the Site cannot function without them. All other cookies, including analytics, preference and marketing cookies, are placed only after you give consent through our cookie banner, and you can change or withdraw your choice at any time through the cookie-settings link in the footer. Details of the cookies we use, their purposes and their duration are set out in our Cookie Policy. You can also control cookies through your browser settings, although blocking some cookies may affect how the Site works.

6. Marketing communications

We send newsletters, project launches or similar marketing messages only where you have agreed to receive them, or where the law otherwise permits. Every message includes a simple way to unsubscribe, and you can also write to us at any time. Submitting an enquiry does not by itself subscribe you to marketing.

7. Who we share personal data with

We do not sell or rent personal data. We share it only as follows:

  • Service providers acting on our instructions (processors), such as website hosting, IT support, email, customer-relationship-management and analytics providers, under written contracts that comply with Article 28 GDPR.
  • Professional advisers, such as Cyprus advocates, accountants, auditors, banks and insurers, who are bound by duties of confidentiality.
  • Partner real estate agencies and developers, only where necessary for a property enquiry you have asked us to pursue. They act as independent controllers and have their own privacy notices.
  • Public authorities, such as courts, tax authorities, the District Land Registry and District Administration (for example for property-acquisition permits), law-enforcement bodies and the Unit for Combating Money Laundering (MOKAS), where the law requires or permits disclosure.
  • A buyer or successor in the event of a merger, reorganisation or sale of our business, subject to equivalent protection of your data.

8. Transfers outside the European Economic Area

Many of our clients live outside the EEA, so we will communicate with you in your country of residence. Where we transfer personal data to a recipient outside the EEA, we do so only on the basis of an adequacy decision of the European Commission, appropriate safeguards such as the European Commission’s Standard Contractual Clauses (with supplementary measures where needed), or another lawful derogation under Article 49 GDPR, such as a transfer needed to take steps at your request. You may request a copy of the safeguards we use.

9. How long we keep personal data

  • Enquiries that do not lead to a relationship: 12 months after our last contact.
  • Clients and transactions: for the duration of the relationship and 6 years afterwards, which reflects the period within which civil claims may be brought.
  • Anti-money-laundering records: at least five years after the end of the business relationship or the transaction, as required by Law 188(I)/2007, and longer where an authority directs.
  • Marketing preferences: until you withdraw consent or object.
  • Cookie data: for the periods stated in the Cookie Policy.

When the retention period ends, we delete or anonymise the data securely.

10. Security

We apply appropriate technical and organisational measures, including access controls, encryption in transit and confidentiality obligations for staff and providers, to protect personal data against unauthorised access, loss, misuse or alteration. No transmission over the internet is completely secure. If a breach is likely to put your rights at risk, we will notify the Commissioner for Personal Data Protection and, where required, you, within the time limits set by law.

11. Your rights

You have the right to:

  • access the personal data we hold about you and receive a copy;
  • have inaccurate data corrected and incomplete data completed;
  • have your data erased (“right to be forgotten”) where the law allows;
  • restrict our processing in certain circumstances;
  • object to processing based on legitimate interests, and to direct marketing at any time;
  • receive your data in a structured, commonly used format and have it transmitted to another controller (data portability), where the processing is based on consent or a contract and is carried out by automated means;
  • withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, write to info@roxelinvest.com. We will respond within one month, which may be extended in complex cases as the law allows. We do not normally charge a fee. We may need to verify your identity, and some rights are limited by law, for example where we must retain anti-money-laundering records.

You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus (www.dataprotection.gov.cy) or with the supervisory authority of your country of residence within the EEA. We would be grateful for the chance to address your concern first. If you live outside the EEA and your local law gives you additional rights, we will respect them to the extent they apply to us.

12. Automated decision-making

We do not take decisions about you based solely on automated processing that produce legal or similarly significant effects.

13. Third-party websites

The Site may link to third-party websites. This Privacy Policy does not apply to them, and we encourage you to read their privacy notices.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version is always on this page with its “Last updated” date. If we make material changes, we will take reasonable steps to bring them to your attention.

15. Contact us

For any question about this Privacy Policy or to exercise your rights, contact us at info@roxelinvest.com, through roxelinvest.com/investor-relations, or by post at our registered office, 13 Tepeleniou Street, Tepelenio Court, 2nd floor, 8010 Paphos, Cyprus.