Detailed Privacy Policy (GDPR Compliance)

1. Detailed Privacy Policy (GDPR Compliance)

This Privacy Policy has been developed in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR).

1. identification of the Data Controller

Attribute	Details
Data Controller	OCM Real Consulting (Entity managing the RentVsLoan service)
Address	28 Makarios Avenue, Office 301, Limassol 3105, Cyprus
Contact Email	info@ocmconsulting.com (or designated DPO/Privacy Contact)
Supervisory Authority	Commissioner for Personal Data Protection, Cyprus (Commissioner for Personal Data Protection, Cyprus)

2. Personal Data We Collect

We collect personal data primarily to provide our services related to obtaining loans and facilitating the purchase of property presented in Cyprus.

Data Category	Specific Data to be Collected	Source/Method of Collection	Main Purpose of Processing	Legal Basis for GDPR (Article 6)
Identification and Contact Data	First Name, Last Name, Email Address, Phone Number, Date of Birth.	Mortgage Application Forms (online forms) and direct communication.	To liaise about your service request, verify your identity and manage your application.	Necessity of fulfilment of the contract (Art. 6(1)(b))
Financial and Employment Information	Employment status, Company name, Position, Length of service, Monthly income (€), Supplementary income (€), Down payment (€).	Mortgage Application Forms (online forms).	To assess your creditworthiness, process and submit your application to lending organisations.	Necessity of fulfilment of the contract (Art. 6(1)(b)) and Legal obligation (Art. 6(1)(c) - for anti-money laundering checks, if applicable).
Transaction data	Loan amount (€), Loan purpose (Home purchase/Investment), Details of the property.	Mortgage Application forms and service delivery process.	To fulfil our service obligations (document processing, brokerage services).	Necessity of fulfilment of the contract (Art. 6(1)(b))
Technical and Usage Data	IP address, browser type, operating system, pages visited, time spent on the site, cookie identifiers.	Automatic collection via website server logs and tracking/Cookie technology.	To ensure site security, diagnose technical issues and analyse site performance.	Legitimate interest (Art. 6(1)(f) - for security/necessary cookies) and Consent (Art. 6(1)(a) - for analytical/advertising cookies).

3. How and Why We Use Your Personal Data

We use your data strictly for the purposes listed below:

To Process Loan Applications: We use your Identification, Financial and Employment details to prepare your loan portfolio, submit it to banks/lenders and coordinate the entire application process.
To provide services in the property sector: We use your Identity Data and Transaction Data to link you to relevant properties and process the necessary legal documents to purchase a home in Cyprus.
Customer Service: We use your Contact Details to respond to enquiries, manage appointments and provide updates on the status of your application.
Safety and Operation: We use Technical Data to protect our systems from fraud, to maintain the security of our website and to ensure its proper functioning.
Marketing: We may use your Contact Data to send you information about related services (e.g. insurance, property investment) only if you provide us with explicit consent (or where legitimate interests apply, in accordance with Cyprus' strict local direct marketing regulations).

4. Data Transmission and Recipients

Your data is processed securely and only shared when it is necessary for the provision of our services or the fulfilment of legal obligations:

Credit Institutions: We pass your Identification, Financial and Employment details to selected banks, lending institutions and mortgage providers in Cyprus to process your loan application.
Professional Counsellors: We can share data with lawyers and accountants in Cyprus to complete property transactions and ensure legal compliance.
Regulatory Bodies and Authorities: We disclose data where required by law, for example by the Cyprus Police, the Tax Department, the Registrar of Companies or other regulatory authorities.
IT Providers/Service Providers: We use external companies (e.g. website hosting, CRM platforms) that process data on our behalf. We ensure that these processors are GDPR compliant through Data Processing Agreements (DPAs).

5. International Data Transfer

As our operations are centred in Cyprus, your personal data is mainly processed within the European Union (EU) or European Economic Area (EEA).

Where data is transferred outside the EU/EEA (e.g. to a third-party cloud service), we ensure that appropriate protection measures are in place, such as Standard Contractual Clauses (SCC) approved by the European Commission.

6. Security and Data Retention Period

Safety: We apply high technical and organisational measures, including bank-grade encryption (SSL/TLS) for data transmission, access control and regular security assessments, to protect your personal information.
Shelf Life: We only keep your personal data for as long as is necessary to fulfil the purposes for which we collected it, including to meet any legal, accounting or reporting requirements.
- Successful Applications/Transactions: Data related to successful loan/purchase transactions is held for a mandatory legal period in Cyprus, usually seven (7) years after the termination of the service relationship.
- Unsuccessful Applications/Requests: The data is usually deleted or anonymised through the six (6) months after the last contact, unless otherwise required by law or for ongoing legal disputes.

7. Your Rights to Data Protection under the GDPR

Under the GDPR, you have the following rights in relation to your personal data:

Right of Access (Art. 15): The right to request copies of your personal data.
Right to Correction (Art. 16): The right to request that we correct any information that you believe is inaccurate or incomplete.
Right of Removal / «Right to Oblivion» (Art. 17): The right to require us to delete your personal data, under certain conditions.
Right to Restriction of Processing (Art. 18): The right to request that we restrict the processing of your personal data, under certain conditions.
Right to Data Portability (Art. 20): The right to require us to transfer the data we collect to another organisation or directly to you, under certain conditions.
Right to Object to Processing (Art. 21): The right to object to the processing of your personal data, especially in cases of direct marketing or processing based on legitimate interest.
Right to Withdraw Consent: Where we rely on your consent to process your data (e.g. for non-binding cookies, certain types of marketing), you have the right to withdraw that consent at any time.

To exercise any of these rights, please contact us at the email address provided in Section 1. We will respond to your enquiry within one month.

8. Right to lodge a Complaint with the Oversight Body

If you have a complaint about the way we process your data, you have the right to lodge a complaint with the Personal Data Protection Commissioner in Cyprus:

Website: http://www.dataprotection.gov.cy