Privacy notice

Last updated: September 2026

1. Who we are

Lappas & Co Limited (HE 199355), a company incorporated in the Republic of Cyprus, with registered office at 2 Andrea Araouzou Street, Stefano Plaza, Floor 1, Office 101, 4150 Limassol, Cyprus.

Where you engage Lappas Accounting Ltd for accounting, VAT, payroll or related services, that company is the controller of your personal data in respect of those services. Both companies apply this notice.

Work presented under the RelocateNow or Lappas Properties names is carried out by one of those two companies, and this notice applies to it.

For the purposes of the GDPR we act as data controller, and, depending on the nature of the services, may also act as data processor in relation to personal data processed in connection with our engagement with you.

2. Categories of personal data we collect

We may collect and process the following categories of personal data:

• Personal identification information, full name, date of birth, nationality, ID or passport number
• Contact details, residential address, correspondence address, email address, telephone number
• Professional information, occupation, employer, position
• Financial and banking information, bank account details, payment details
• Corporate information, shareholding, directorships, beneficial ownership information
• Due diligence documentation required under applicable anti-money laundering legislation
• Technical data, IP address, browser type, device information, cookies
• Any other information you provide to us in the course of our engagement

Where necessary for regulatory compliance, such as anti-money laundering and know-your-client obligations, we may also process special categories of data strictly as required by law.

3. How we collect personal data

Directly from you, when you enter into an engagement letter with us, communicate with us by email, telephone or in writing, complete forms, declarations or due diligence documentation, or use this website.

Indirectly, from professional advisers such as lawyers, accountants and auditors; financial institutions; public registers and regulatory authorities; other corporate service providers; credit reference agencies; and other third parties where disclosure is lawful and necessary.

4. Our lawful basis for processing

We process personal data on one or more of the following lawful bases:

• Performance of a contract, Article 6(1)(b) GDPR
• Compliance with legal obligations, including anti-money laundering and regulatory requirements, Article 6(1)(c) GDPR
• Legitimate interests pursued by us, provided those interests are not overridden by your rights, Article 6(1)(f) GDPR
• Consent, where required, Article 6(1)(a) GDPR

5. Purposes of processing

• Provision of the agreed services under the engagement letter
• Client onboarding and due diligence procedures
• Compliance with legal and regulatory obligations
• Communication with clients and relevant authorities
• Invoicing, accounting and internal administration
• Risk management and fraud prevention
• Improvement of our services

We do not use personal data for automated decision-making or profiling that produces legal effects.

6. Disclosure of personal data

We may disclose personal data to regulatory authorities and government bodies; courts and law enforcement authorities; banks and financial institutions; auditors, accountants and legal advisers; IT service providers and cloud storage providers; group companies or affiliated entities; and other third parties where required by law or necessary for the provision of services.

All third-party service providers are contractually bound to process personal data confidentially and in accordance with applicable data protection laws.

7. International transfers

Where personal data is transferred outside the European Economic Area, such transfers take place only to countries subject to an adequacy decision by the European Commission, subject to appropriate safeguards such as Standard Contractual Clauses, or where otherwise permitted under the GDPR.

8. How long we keep your data

We retain personal data only for as long as necessary for the duration of the engagement, and for compliance with our legal and regulatory obligations. Anti-money laundering record-keeping requirements are typically five years following termination of the business relationship, unless a longer period is required by law.

On expiry of the retention period, personal data is securely deleted or anonymised.

9. This website

When you use this website we process a limited amount of data separately from any client engagement.

Enquiry forms. Where you submit an enquiry or an application, we process the details you provide in order to respond to you. Our lawful basis is our legitimate interest in responding to enquiries about our services, or the steps taken at your request prior to entering into a contract.

Calculators and tools. The calculators on this site run entirely in your browser. The figures you enter are not transmitted to us and we do not see them.

Cookies and analytics. See our cookie policy.

How long we keep enquiries. Where an enquiry does not lead to an engagement, we keep the correspondence for up to two years and then delete it. Where it does, the information becomes part of the client record and is kept as described in section 8.

10. Data security

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures include secure servers, restricted access controls, encryption where appropriate, internal data protection policies, and confidentiality obligations on our staff.

11. Your rights

Subject to applicable law, you have the right to:

• Access, to obtain confirmation and a copy of your personal data
• Rectification, to correct inaccurate or incomplete data
• Erasure, to request deletion, subject to legal limitations
• Restriction of processing
• Object to processing based on legitimate interests
• Data portability
• Withdraw consent, where processing is based on consent
• Lodge a complaint with the supervisory authority

We will respond to any request within one month, as required under the GDPR.

Certain records we are required by law to retain cannot be erased on request. Where that applies we will tell you which records and on what basis.

12. Complaints

You may complain to the competent supervisory authority in Cyprus:

Office of the Commissioner for Personal Data Protection
www.dataprotection.gov.cy

13. Contact

For any question about how we handle personal data, contact our data protection point of contact:

Antonis Lappas
2 Andrea Araouzou Street, Stefano Plaza, Office 101, 4150 Limassol, Cyprus
[email protected]
+357 25 392 592

14. Amendments

We may amend this notice at any time. The most recent version is always available on this page.