MY ESTIACY Privacy Policy
Last updated: 17/10/2026 Controller: Miltos Ioannidis, trading as MY ESTIACY ("MY ESTIACY", "we", "us", "our") — sole trader (controller will transfer to ESTIACY LTD upon incorporation, at which point this Privacy Policy will be updated). Business name registration no.: EE62897a Registered address: Ioulianou 30, Ekali, 3111, Limassol, Cyprus Privacy contact email: [email protected]
This Privacy Policy explains how we collect, use, share, and protect personal data when you use MY ESTIACY's website and mobile apps (the "Platform"). It also explains your rights under the EU General Data Protection Regulation (GDPR) and Cyprus Law 125(I)/2018.
Key Points — Plain English Summary - What we collect: Your name, email, phone, listings, messages, and (if you choose) verification and payment data. - Why we collect it: To run the Platform, keep it safe, process payments, and improve the service. - We do not sell your data: We never sell your personal data to third parties. - Your rights: You can access, correct, delete, or export your data at any time. Email [email protected]. - Marketing is opt-in: We only email you marketing if you said yes. You can unsubscribe any time — it won't affect your account. - Cookies: We use necessary cookies to run the site. Only if you say yes, we also use Google Analytics to see how the site is used, and Google Ads and the Meta (Facebook) Pixel to measure our advertising. You choose, and you can change your mind any time in Cookie Settings. - Cyprus law applies: We are subject to GDPR and Cyprus Data Protection Law 125(I)/2018. - Questions? Contact [email protected] For full details, read each section below.
The Platform is strictly for users aged 18 and over. We do not knowingly collect or process personal data of persons under 18. Under Cyprus Data Protection Law 125(I)/2018 (implementing GDPR Article 8), a child is defined as any person under 13 years of age. If we become aware that we have inadvertently collected personal data from anyone under 18, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected].
1. Who We Are and Our Role
1.1 Data Controller: For most processing described in this Policy, MY ESTIACY is the "data controller" — we decide why and how your personal data is processed.
1.2 When other parties are controllers: When you contact a landlord/seller/agent or any other user and share personal data with them (e.g., your phone number or email), that recipient may become an independent data controller for how they handle your information after receiving it. You should review their privacy practices.
1.3 Processors (service providers): We use third-party service providers ("processors") to run the Platform. They process personal data on our instructions under contractual safeguards including GDPR-compliant Data Processing Agreements (DPAs). See Section 8 for the full list of third-party processors.
2. What Data We Collect
2.1 Account and profile data:
- Name (or display name)
- Email address
- Phone number
- Password (stored as a secure hash — not readable by us)
- Account type (e.g., buyer/tenant, landlord/seller, flatmate, agent/business)
- Profile details you choose to provide (e.g., short bio, preferences)
- Language preference (English or Greek)
2.2 Listing and property data: Property details, photos, videos, pricing, and availability that you include in your Listings; location data (address, area, map pin) for the property.
2.3 Verification data: Where identity verification is enabled, our intended third-party provider, IDAnalyzer, will process your identity document. We receive and store only: verification status (verified/pending/failed), timestamp, and provider reference ID. We do not store copies of your identity document images in "no storage" mode. For full details see the Verification Policy.
2.4 Usage and technical data: IP address, browser type, operating system, device identifiers; pages visited, time spent, search queries, clicks, and interactions on the Platform; referring URL and exit pages.
If we introduce a "Last seen" or "Last active" timestamp feature, we will provide a privacy setting in Account Settings allowing you to control whether it is visible to other users. We do not store precise "Last seen" timestamps beyond 30 days where the feature is active.
2.5 Communications data:
- Messages sent via Platform messaging between users
- Support tickets and emails you send to us
- Calls to or from our support team (where applicable — see Section 13 on call recording)
- Messages you send to Estia, our in-product AI assistant, and replies Estia generates. By messaging Estia, you agree that Estia messages are processed by our AI backend provider to produce replies. Conversation data may also be stored temporarily in your browser/session storage and, where enabled on our backend, for up to 30 days for quality, security, abuse-prevention, and troubleshooting purposes. Where an Estia conversation indicates a potential property enquiry or lead, we may save the transcript and related lead metadata as a lead or enquiry record and may share relevant parts with the relevant advertiser, landlord, seller, agent, agency, developer, or authorised representative so they can respond. Estia conversations are not used to train AI models without your explicit consent.
2.6 Payment data: If you purchase paid features, our payment processor Stripe handles your card details. We receive and store only a transaction reference, amount, date, and payment status. We do not store full card numbers or CVV codes.
2.7 Location data (optional): If you grant the mobile app permission to access your device's location (GPS), we may use this to show you properties nearby. This is optional — you may decline or withdraw this permission in your device settings at any time. We do not store precise GPS coordinates long-term.
2.8 Social / third-party login data: If you register or sign in using a third-party account (e.g., Google, Apple, Facebook), we receive your name, email address, and profile photo from that provider. You become our user from that point forward and this Privacy Policy applies to the data we hold. We do not receive your password for those services.
2.9 Roommate matching and compatibility data: If you use the Platform's roommate/flatmate matching feature, we collect the following preference data that you provide:
- Lifestyle preference (quiet / social / balanced)
- Gender preference for flatmates
- Pet policy (pets welcome / no pets / negotiable)
- Smoking preference (smoker / non-smoker / outside only)
- Room type preference (single / shared / studio / any)
- Budget range (minimum and maximum monthly rent)
- Availability dates (move-in date, minimum stay)
- Interests and hobbies (free-text, optional)
- Age
- Occupation
- Social media links (optional — provided at your discretion)
Legal basis for processing: Contract performance (GDPR Article 6(1)(b)) — this data is necessary to provide the roommate matching service you requested when you opted into the flatmate/room-seeker feature.
Special category data: Some preferences you provide (for example, gender preference for flatmates) may relate to characteristics that fall within the scope of GDPR special category data under Article 9.
Where preference data falls within GDPR special category data under Article 9, we process such data only with your explicit consent (GDPR Article 9(2)(a)). This data is collected via a standalone, specific consent screen presented at the point you opt into the flatmate/room-seeker feature, separate from general Terms acceptance. The consent screen explains: (a) what data is being collected; (b) why it is needed; (c) how it will be used; (d) that you can withdraw consent at any time.
DPIA requirement: A Data Protection Impact Assessment for the roommate matching algorithm must be completed and signed off by the Controller before this feature is made available in production, as required by GDPR Article 35.
Free-text fields and Article 9 GDPR: The DPIA for this feature must assess whether free-text fields ("interests and hobbies", "lifestyle notes", "about me") may inadvertently capture special category data revealing racial or ethnic origin, religious beliefs, political opinions, health conditions, or sexual orientation. We ask users not to include special category data in free-text fields. Where we identify such data during moderation or support review, we may remove it or ask the user to edit it. Where Article 9 data is detected, we rely on explicit consent under Article 9(2)(a) or remove the content.
You may withdraw consent at any time by updating your preferences in your account settings or by contacting [email protected]. Withdrawal of consent will result in the roommate matching feature being disabled for your account.
How matching data is used: Your preference data is processed by our roommate matching algorithm to generate compatibility scores between you and other Users who have also opted into the matching feature. Compatibility scores are algorithm-based estimates only.
Retention: Roommate matching preference data is retained for the duration of your account. If you deactivate the roommate matching feature, your preference data will be deleted within 30 days, unless retention is required for another lawful purpose (e.g., fraud prevention or legal proceedings). If you delete your account, roommate matching data is deleted in accordance with the retention schedule in Appendix A.
2.10 Estimator and calculator tools (Mortgage Calculator): The Mortgage Calculator and any other on-site estimator tools operate locally in your browser. We do not transmit, log or store the inputs you enter into these tools (such as deposit, interest rate, loan term, income or existing debts). Refreshing or leaving the page deletes them. If this changes — for example, if a future version saves scenarios to your account — we will update this Privacy Policy and notify you.
3. Special Category Personal Data
Identity documents (such as passports and national identity cards) may constitute biometric or special category data under GDPR Article 9. Where you submit identity documents through our verification process, this data is processed by our third-party verification provider IDAnalyzer under strict safeguards. The legal basis for this processing is:
- Your explicit consent (GDPR Article 9(2)(a)); and/or
- Processing necessary for reasons of substantial public interest — specifically, fraud prevention and platform safety (GDPR Article 9(2)(g) and Cyprus Law 125(I)/2018).
We will complete a Data Protection Impact Assessment (DPIA) in relation to biometric/identity data processing before enabling identity verification, as required by GDPR Article 35.
4. How We Use Your Data (Purpose and Legal Basis)
| Purpose | Legal Basis (GDPR) |
|---|---|
| Create and manage your account | Contract performance (Art. 6(1)(b)) |
| Display your listings to other users | Contract performance (Art. 6(1)(b)) |
| Enable messaging between users | Contract performance (Art. 6(1)(b)) |
| Process payments for paid features | Contract performance (Art. 6(1)(b)) |
| Identity verification | Legitimate interests (Art. 6(1)(f)) — fraud prevention and platform integrity. Where identity verification is enabled, it may be mandatory for users who post listings or initiate messages. |
| Fraud prevention and platform safety | Legitimate interests (Art. 6(1)(f)) |
| Enforce Terms and investigate abuse | Legitimate interests (Art. 6(1)(f)) |
| Comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Send service-related notifications | Contract performance (Art. 6(1)(b)) |
| Send marketing emails (if opted in) | Consent (Art. 6(1)(a)) |
| Analytics and platform improvement (our own aggregated usage data) | Legitimate interests (Art. 6(1)(f)) |
| Website analytics cookies (Google Analytics) | Consent (Art. 6(1)(a)) — only if you accept analytics cookies |
| Advertising measurement (Google Ads, Meta Pixel) | Consent (Art. 6(1)(a)) — only if you accept marketing cookies |
| Personalised listing recommendations | Legitimate interests / consent (Art. 6(1)(a)/(f)) |
Legitimate Interests Assessment
Where we rely on legitimate interests (GDPR Article 6(1)(f)) as the legal basis for processing, we have carried out a three-part Legitimate Interests Assessment (LIA) considering: (a) the purpose of the processing; (b) whether the processing is necessary and proportionate to achieve that purpose; and (c) whether our interests are overridden by your rights and freedoms.
The key purposes for which we rely on legitimate interests, and why we consider our interests are not overridden, are as follows:
- Fraud prevention and platform safety: We process usage signals and account data to detect and prevent fraudulent activity. This is necessary to protect all users and the integrity of the Platform. Users benefit from a safer marketplace and the processing is limited to what is necessary for that purpose.
- Analytics and platform improvement: We use anonymised/pseudonymised usage data to understand how users interact with the Platform and improve it. This processing does not significantly impact individual users.
Personalised listing recommendations: We use your Platform behaviour (searches, saves, views) to suggest relevant listings. Under GDPR Article 4(4), this processing constitutes profiling — specifically, the automated processing of personal data to evaluate your property preferences. This profiling does not produce legal or similarly significant effects, and no automated decisions are made solely on this basis. You have the right to object to this profiling at any time under GDPR Article 21. You may object to personalised recommendations at any time by emailing [email protected]. Where we enable personalised recommendations, we will also provide an account-level opt-out setting.
- Call recording (where applicable): Calls are recorded for quality assurance and dispute resolution. Users are informed at the start of every call. Recordings are retained for 12 months only.
Your right to object: Under GDPR Article 21, you have the right to object to processing based on legitimate interests at any time. If you object, we will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for the establishment, exercise, or defence of legal claims. To exercise your right to object, contact [email protected].
Marketing Communications
We send marketing emails only where you have given us your prior, freely given, specific, informed and unambiguous consent (GDPR Article 6(1)(a) and EU ePrivacy Directive as implemented by Cyprus Electronic Communications Law 112(I)/2004).
You can opt out of marketing at any time, without giving a reason, by:
- Clicking the unsubscribe link in any marketing email
- Updating your notification preferences in Account Settings
- Emailing [email protected]
Opting out of marketing does not affect your access to the Platform or any free features. You will continue to receive service-related communications (e.g., booking confirmations, account security alerts, payment receipts) which are sent on the basis of contract performance and are not marketing.
For SMS marketing, we only send messages where you have separately and explicitly consented. You may opt out at any time by replying STOP to any marketing SMS or via Account Settings. We comply with the requirements of the EU ePrivacy Directive and Cyprus Electronic Communications Law 112(I)/2004 regarding unsolicited electronic marketing.
The 'soft opt-in' exception applies only where: (a) you are an existing customer; (b) the communication relates to our own similar products/services; and (c) you were given a clear opportunity to opt out when your details were collected and in every subsequent communication.
5. Data Retention Schedule
We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law.
| Data Category | Retention Period |
|---|---|
| Account data | Duration of account + 6 years after deletion (matching the general Cyprus limitation period under Contract Law Cap. 149). Non-essential profile fields are anonymised after 2 years; essential identifiers (user ID, hashed email, transaction records, dispute correspondence) are retained for 6 years. |
| Listing data (active) | Duration of listing + 12 months after removal |
| Platform messages | 12 months from last message in the conversation |
| Verification metadata | 5 years (fraud prevention / legal obligation) |
| Payment transaction records | 7 years (Cyprus tax and accounting law) |
| Support / complaint records | 3 years from resolution |
| Call recordings (if applicable) | 12 months |
| Analytics / usage data | 26 months (standard analytics retention) |
| Google Analytics event data | 14 months, then deleted by Google |
| Marketing consent records | Until consent is withdrawn + 1 year |
| Job application data (CVs) | 12 months after recruitment process ends |
After the applicable retention period, data is securely deleted or anonymised. See Appendix A for full justification of each retention period.
6. Automated Decision-Making and Profiling
We may use automated processes for the following:
- Ranking and ordering Listings in search results (based on relevance, recency, paid visibility features)
- Recommending Listings to users based on their search history and preferences
- Automated fraud and scam detection signals that may flag accounts for human review
Where automated processes are used to flag accounts, a human review is conducted before any significant account action (suspension/removal) is taken. We do not make solely automated decisions that produce legal or similarly significant effects without human oversight. Under GDPR Article 22, you have the right to request human review of any automated decision that significantly affects you. Contact [email protected] to exercise this right.
7. Who We Share Data With
7.1 Other users: Your profile information (name/display name, account type, verification status) is visible to other users as intended by the Platform's function. Your contact details are only visible if you include them in a Listing or choose to share them.
7.2 Third-party processors: See Section 8 for the full list of named third-party data processors.
7.3 Legal disclosures: We may disclose personal data to: law enforcement or regulatory authorities where required by law; the Cyprus Commissioner for Personal Data Protection; courts or legal proceedings; or to protect the rights, property, or safety of MY ESTIACY, our users, or the public.
7.4 Business transfers: If MY ESTIACY is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the Platform before your data is transferred and becomes subject to a different privacy policy.
8. Third-Party Data Processors
We use the following third-party processors. All are bound by GDPR-compliant Data Processing Agreements. This list will be updated as our processor relationships change.
Analytics and advertising tools: On our website we use Google Tag Manager to load Google Analytics 4 and Google Ads, and we use the Meta (Facebook) Pixel. Google Analytics runs only if you accept analytics cookies. Google Ads and the Meta Pixel run only if you accept marketing cookies. We use Google Consent Mode v2, with every consent setting defaulting to "denied" until you choose. What these tools receive: pages you view, your device and browser type, an approximate location derived from your IP address, and events such as searches, listings viewed or saved, enquiries sent, account sign-ups, and subscriptions started. We do not send them your name, email address, phone number, or the content of your messages. Search terms are checked for email addresses and phone numbers, which are removed before sending. Google Analytics 4 does not log or store IP addresses. Before you consent: Google tags are loaded but run in "denied" mode. In that mode they do not set or read cookies, and may send Google cookieless signals that Google uses to estimate aggregated measurement. Meta Pixel: For the collection and transmission of Pixel data, MY ESTIACY and Meta Platforms Ireland Limited are joint controllers. Meta is an independent controller for any processing it carries out afterwards; see Meta's Privacy Policy at https://www.facebook.com/privacy/policy.
| Processor | Purpose | Location / Adequacy Basis |
|---|---|---|
| IDAnalyzer | User identity verification (KYC) | EU/EEA |
| Stripe (https://stripe.com/en-cy) | Payment processing for paid features | EU/EEA or SCCs |
| Mapbox (mapbox.com) | Map display and location services for property listings | US — SCCs in place |
| Google Translate API | Translation services for multilingual content | US — SCCs in place |
| Google Ireland Limited (Google Analytics 4, Google Tag Manager, Google Ads) | Website analytics and advertising measurement — only with your consent | EU/EEA; transfers to Google LLC (US) under the EU-US Data Privacy Framework and SCCs |
| Meta Platforms Ireland Limited (Meta Pixel) | Advertising measurement — only with your consent (joint controller, see note above) | EU/EEA; transfers to Meta Platforms, Inc. (US) under the EU-US Data Privacy Framework and SCCs |
| MyMemory API | Translation services (EU-based alternative) | EU/EEA |
| Internal email service | Transactional and marketing emails (where consented) | EU/EEA |
| Internal support system | Customer support tickets and communication | EU/EEA |
| CLOUDLAYER8 LIMITED | Platform hosting, databases, file storage, CDN | Cyprus (EU/EEA) |
Transfer Impact Assessment (TIA): Where any processor receives personal data outside the EU/EEA (for example, US-based providers such as Mapbox, Google Translate, Google Analytics, or the Meta Pixel), we will complete a Transfer Impact Assessment compliant with the Schrems II decision (CJEU C-311/18) and EDPB Recommendations 01/2020 before activating that transfer. The TIA evaluates the relevant legal regime, supplementary technical and contractual measures (encryption in transit, data minimisation, no source IP relay where possible), and is reviewed annually. A summary is available on request to [email protected].
Our third-party processors may use sub-processors to provide their services (for example, cloud hosting infrastructure providers used by IDAnalyzer or Stripe). We require all processors to ensure that any sub-processors they engage are bound by equivalent data protection obligations under GDPR-compliant agreements. We do not directly control the sub-processor relationships of our processors. If you wish to obtain information about the sub-processors used by any of our processors, please contact [email protected]. Where any processor engages a new sub-processor that may affect your data, we will update this processor list at the next scheduled review and notify you of material changes in accordance with Section 16 (Changes to This Privacy Policy).
Note on processor list consistency: This list of third-party data processors is kept in sync with Section 18 (Third-Party Tools & Data Processors). Where there is any discrepancy between the processor list in this Privacy Policy and the list in Section 18, the more recently updated version shall prevail. Both lists are reviewed and reconciled at each document update.
Where processors are located outside the EU/EEA, transfers are made under Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, or other appropriate safeguards under GDPR Chapter V.
9. International Data Transfers
Your data is primarily processed within the EU/EEA. Where we transfer personal data to countries outside the EU/EEA (for example, where a processor's servers are located in a non-EEA country), we ensure appropriate safeguards are in place, including: EU Standard Contractual Clauses (SCCs); adequacy decisions by the European Commission; or binding corporate rules. You can request details of the specific safeguards applicable to your data by contacting [email protected].
10. Data Breach Notification
In the event of a personal data breach, we will:
- Notify the Cyprus Commissioner for Personal Data Protection within 72 hours of becoming aware of the breach, where required by GDPR Article 33
- Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34
- Keep an internal record of all data breaches regardless of whether notification is required
Notification to users will be by email and/or prominent notice on the Platform, and will include: the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed.
11. Security Measures
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage, in accordance with GDPR Article 32. These measures include:
- Encryption: Personal data is encrypted in transit using TLS (Transport Layer Security) and encrypted at rest where applicable.
- Access controls: Access to personal data is restricted to authorised personnel on a need-to-know basis. All staff with access to personal data receive data protection training.
- Password security: User passwords are stored as cryptographic hashes — they are not readable by us or our staff.
- Secure payment handling: Payment card data is handled entirely by Stripe. We do not store card numbers or CVV codes on our systems.
- Third-party processor vetting: All processors are required to maintain appropriate security standards under their Data Processing Agreements with us.
- Incident response: We maintain an internal data breach response procedure and will notify the Cyprus Commissioner for Personal Data Protection and affected users as required by GDPR Articles 33–34.
No system is completely secure. We cannot guarantee absolute security, but we take our obligations under GDPR Article 32 seriously and review our security measures regularly.
12. Cookies
We use cookies and similar tracking technologies. For full details of the cookies we use, your consent choices, and how to manage your preferences, see our Cookie Policy & Cookie Settings (Section 4).
13. Call Recording
Where you contact us by telephone for support, or where calls are facilitated through the Platform, calls may be recorded for quality assurance, training, and complaint resolution purposes. The legal basis for recording is our legitimate interests in maintaining service quality and resolving disputes. Recordings are retained for up to 12 months. You will be informed that a call is being recorded at the start of the call.
14. Your Rights Under GDPR
You have the following rights in relation to your personal data:
| Right | What it means |
|---|---|
| Right of access (Art. 15) | Request a copy of the personal data we hold about you |
| Right to rectification (Art. 16) | Ask us to correct inaccurate or incomplete data |
| Right to erasure (Art. 17) | Ask us to delete your data ("right to be forgotten") where applicable — see important exceptions below |
| Right to restriction (Art. 18) | Ask us to restrict processing of your data in certain circumstances |
| Right to data portability (Art. 20) | Receive your data in a structured, machine-readable format |
| Right to object (Art. 21) | Object to processing based on legitimate interests or for direct marketing and profiling |
| Rights re. automated decisions (Art. 22) | Request human review of automated decisions that significantly affect you |
| Right to withdraw consent (Art. 7(3)) | Withdraw consent at any time where processing is based on consent |
Your right to erasure is not absolute. We may refuse or partially refuse an erasure request where we are required to retain data for one or more of the following reasons:
(a) Compliance with a legal obligation (Art. 17(3)(b)): Payment transaction records are retained for 7 years under Cyprus tax and accounting law, and identity verification metadata is retained for 5 years for fraud prevention and legal compliance. We cannot delete this data early even upon request.
(b) Establishment, exercise, or defence of legal claims (Art. 17(3)(e)): We may retain data where it is necessary in connection with actual or anticipated legal proceedings.
(c) Public interest (Art. 17(3)(d)): We may retain data where erasure would impair fraud prevention, platform safety, or other public interest purposes.
When we refuse or partially refuse an erasure request, we will explain the specific reason and the data categories affected, and we will delete all data we are not legally required to retain. You have the right to lodge a complaint with the Cyprus Commissioner for Personal Data Protection if you are unhappy with our response.
To exercise any of these rights, contact us at: [email protected]. We will respond within one month (extendable by a further two months for complex requests). We may need to verify your identity before fulfilling a request.
If you are unhappy with how we handle your request or your data generally, you have the right to lodge a complaint with the Cyprus supervisory authority:
Office of the Commissioner for Personal Data Protection 1 Iasonos Street, 1082 Nicosia, Cyprus Tel: +357 22818456 Email: [email protected] Website: www.dataprotection.gov.cy
15. Data Protection Officer
We have formally assessed whether a Data Protection Officer (DPO) is required under GDPR Article 37 and Cyprus Law 125(I)/2018. Based on our current scale of operations as a pre-launch platform, we have determined that a DPO is not currently mandatory. However, we have designated a Data Protection Contact Point for all privacy-related queries: [email protected]
We commit to reassessing this determination as the Platform scales. If we reach a scale of operations that triggers the DPO requirement under Article 37, we will appoint a DPO and publish their contact details here.
Data Protection Impact Assessment (DPIA): In accordance with GDPR Article 35, we have identified the following high-risk processing activities. A completed DPIA is required before the relevant processing is enabled:
- Identity verification processing (biometric/special category data via IDAnalyzer)
- Roommate matching algorithm (processing lifestyle and preference data) — required before that feature goes live
- Automated listing ranking and fraud detection
A completed DPIA is a precondition to enabling each of the activities listed above. The relevant processing will not be activated until the DPIA has been signed off. Where a DPIA identifies residual high risks that cannot be mitigated, we will consult the Cyprus Commissioner for Personal Data Protection prior to commencing processing, as required by GDPR Article 36 and Cyprus Law 125(I)/2018.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email and/or by prominent notice on the Platform. The updated Policy will be effective from the date stated at the top of this page. Where a change introduces new processing that requires a fresh legal basis or your consent under GDPR (for example, a new purpose, new categories of data, or new recipients), we will obtain that consent or rely on a clearly identified alternative legal basis separately, and we will not treat continued use of the Platform as deemed acceptance of those changes.