MY ESTIACY Terms & Legal Documentation

MY ESTIACY — COMPLETE LEGAL DOCUMENTATION

Website Legal Documentation Version: Final — 2026 Last document update: 17/06/2026 (GDPR review applied) Operated by: MY ESTIACY (the platform is branded as ESTIACY) In these documents, "MY ESTIACY" is the registered trading name (operated by Miltos Ioannidis as sole trader). "ESTIACY" is the public-facing brand. Both refer to the same platform. Business name registration no.: EE62897a Address: Ioulianou 30, Ekali, 3111, Limassol, Cyprus

TABLE OF CONTENTS

• Section 1 — About MY ESTIACY
• Section 2 — Terms & Conditions
• Section 3 — Privacy Policy
• Section 4 — Cookie Policy + Cookie Settings
• Section 5 — Listing Rules & Content Standards
• Section 6 — Verification Policy
• Section 7 — Fees, Payments & Refund Policy
• Section 8 — Safety & Scam Prevention Policy
• Section 9 — Reporting, Takedown & Complaints Procedure
• Section 10 — Copyright, IP & Photo Takedown Policy
• Section 11 — Equal Opportunities & Anti-Discrimination Policy
• Section 12 — Agent / Business Code of Practice
• Section 13 — Accessibility Statement
• Section 14 — FAQ / Help Centre
• Section 15 — Blog / Info & Advice — Editorial Policy
• Section 16 — Jobs
• Section 17 — Contact Us
• Section 18 — Third-Party Tools & Data Processors
• Appendix A — Data Retention Schedule

SECTION 1: ABOUT MY ESTIACY

1A) What is MY ESTIACY?

Last updated: 17/06/2026

MY ESTIACY is a Cyprus-focused property and flatmate marketplace designed to make it easier to:

• Rent a home
• Sell or buy a home
• Find a room or a flatshare
• Find a compatible flatmate
• Find short-stay accommodation, serviced accommodation, or hotel-style listings where available

We bring listings and people together in one place, with tools that help users connect and move forward faster.

What makes us different

A marketplace only works if users trust it. MY ESTIACY is built with safety and quality in mind:

• User verification: Where enabled, we offer or require identity verification to reduce fake profiles and scams.
• Verification with privacy: Where identity verification is enabled, identity checks are handled by a third-party provider, and we aim to configure that provider so that we do not retain copies of ID document images on our own systems. The exact configuration in force at any time is reflected in our Privacy Policy and Verification Policy.
• Property verification measures: We implement checks designed to reduce fake or misleading listings.
• Clear rules: We enforce listing standards and take action against scams, duplicate spam, bait-and-switch tactics, and abusive behaviour.
• Cyprus-first: We focus on properties located in Cyprus (with the option to expand later).

What we are (and what we're not)

MY ESTIACY is a marketplace platform. We help users connect. We are not:

• A real estate agent or broker
• A landlord or seller
• A party to your rental, sale, or flatshare agreement

Transactions and agreements happen directly between users. We only provide the platform and the tools to connect.

Legal operator

MY ESTIACY is a registered business name (Cyprus business name reg. EE62897a) operated by Miltos Ioannidis (sole trader).

Contact

• General support email: [email protected]
• Address: Ioulianou 30, Ekali, 3111, Limassol, Cyprus

1B) Why Use MY ESTIACY?

Finding property in Cyprus shouldn't feel like scrolling endless random posts and hoping you don't get scammed. MY ESTIACY is built for people who want a cleaner, safer, more structured way to rent, sell, buy, or find flatmates.

For tenants and buyers

• Search faster: Filters and structured listings help you compare properly.
• Better signals: Verified users and verified listing measures reduce risk.
• Direct contact: Message landlords, sellers, agents, and flatmates without chaos.
• Safer process: Scam warnings, reporting tools, and clear rules.

For landlords and sellers

• Quality leads: Reach people actively looking, not random audiences.
• Visibility tools: Featured and Boost options help you get attention when you need it.
• Trust features: Verified profiles and property verification helps serious users engage faster.
• Simple management: Edit, update, renew, and track your listing performance.

For flatmates

• Compatibility matters: Profiles and preferences help you find the right match.
• Less risk: Identity verification, where enabled, helps reduce fake accounts.
• More control: You decide what you share and when.

1C) How MY ESTIACY Works

MY ESTIACY has two sides: people who post and people who search. Both use the same simple flow.

A) If you're looking to rent or buy

• Search: Use filters for location, price, size, and features.
• Shortlist: Save listings you like and compare easily.
• Contact: Message the landlord/seller/agent directly through the Platform.
• View: Arrange a viewing. Ask questions. Verify authority.
• Agree and complete: Contracts, deposits, and payments happen directly between you and the other party.

B) If you're renting out or selling

• Create a listing: Add real photos, accurate details, and clear pricing.
• Verify where available: Complete identity verification, if enabled or required, to build trust.
• Publish: Your listing goes live for Cyprus users to discover.
• Respond to enquiries: Reply quickly and keep details updated.
• Boost visibility (optional): Use Featured or Boost tools to increase exposure.
• Complete the deal directly: Viewings, contracts, deposits, and payments happen between you and the tenant/buyer.

C) If you want a room or a flatmate

• Post a room / post what you're looking for — add photos and a clear description
• Match and message
• Meet and agree house rules
• Start sharing

Important: MY ESTIACY connects people. We are not part of the transaction. Always do your own checks before paying anything or signing any agreement.

SECTION 2: TERMS & CONDITIONS

Last updated: 17 June 2026

Operator: Miltos Ioannidis, trading as MY ESTIACY (sole trader) Business name: MY ESTIACY Business name registration no.: EE62897a Address: Ioulianou 30, Ekali, 3111, Limassol, Cyprus Support email: [email protected] Privacy contact: [email protected] Legal / notice-and-action contact: [email protected]

Key Points — Plain English Summary

• MY ESTIACY is a marketplace platform for property, rooms, flatshares, and related housing listings in Cyprus.
• We connect users, but we are not a real estate agent, landlord, seller, buyer, surveyor, valuer, financial adviser, or legal adviser.
• Any rental, sale, booking, flatshare, or other arrangement happens directly between users.
• You must be 18 or over to create an account, post listings, or contact other users.
• You are responsible for the truthfulness, legality, and accuracy of anything you post.
• Verification helps reduce risk, but it is not a guarantee.
• Paid visibility affects ranking and exposure only. It is not an endorsement.
• AI tools and expert consultation features are for information and convenience only. They are not professional advice and must be checked independently.
• We may remove listings, restrict features, or suspend accounts where necessary for safety, fraud prevention, legal compliance, or policy breaches.
• Cyprus law governs these Terms.

1. Acceptance of These Terms

These Terms & Conditions govern your access to and use of MY ESTIACY, including browsing, creating an account, posting listings, sending messages, purchasing paid features, and using any related services, tools, mobile applications, or future app functionality (together, the Platform).

By creating an account, ticking the "I agree to the Terms & Conditions and Privacy Policy" checkbox, or otherwise accessing or using the Platform, you confirm that you have read, understood, and agreed to these Terms. Where we have implemented our active click-wrap acceptance mechanism, you must affirmatively tick the acceptance checkbox at account registration, and again at each paid checkout. We will not rely on browse-wrap acceptance alone for material terms or paid features. If you do not agree, you must not use the Platform.

2. Other Documents That Apply

These Terms should be read together with any policies or notices made available on the Platform, including where relevant:

• Privacy Policy
• Cookie Policy
• Listing Rules & Content Standards
• Verification Policy
• Fees, Payments & Refund Policy
• Safety & Scam Prevention Policy
• Agent / Business Code of Practice
• Accessibility Statement
• Any feature-specific terms shown at the point of use or purchase

If there is a conflict, the more specific document will control for that issue.

3. Definitions

• "User": anyone who visits or uses the Platform (including advertisers and searchers).
• "Advertiser": a User who posts a property listing or flatmate/room listing.
• "Listing": any property, room, flatshare, or flatmate advertisement posted on the Platform.
• "Content": listings, text, photos, videos, messages, profiles, and other materials on the Platform.
• "Agent/Agency": a person or business advertising on behalf of a property owner/landlord/seller, or providing professional letting/sales services.
• "Transaction": any rental, sale, purchase, or co-living arrangement agreed between Users directly.

4. What MY ESTIACY Is

MY ESTIACY is a Cyprus-focused online marketplace that helps users:

• rent or let property
• buy or sell property
• find or advertise rooms and flatshares
• find or advertise flatmate arrangements
• use related property and housing tools

We provide the platform, search tools, profile tools, communication tools, moderation tools, safety tools, and optional paid visibility features.

5. What MY ESTIACY Is Not

Unless we expressly state otherwise in writing, MY ESTIACY:

• is not a real estate agent or broker
• is not the landlord, seller, buyer, tenant, flatmate, developer, or owner in any listing
• is not a party to any agreement between users
• does not handle the core property transaction between users
• does not guarantee listing accuracy, title, authority, legal compliance, payment safety, or transaction outcome
• does not provide legal, tax, surveying, valuation, investment, or financial advice

Any transaction, agreement, booking, deposit, payment, or handover takes place directly between users unless a specific feature expressly says otherwise.

6. Eligibility

You may use the Platform only if:

• you are at least 18 years old
• you have legal capacity to enter into binding agreements
• your use of the Platform is lawful in your jurisdiction
• you are not suspended or banned from the Platform

The Platform is not intended for minors.

7. Accounts

7.1 Account creation

You may be required to create an account to access certain features. You must provide accurate, complete, and current information.

7.2 One account rule

You may create only one personal account unless we expressly allow otherwise. Business, agency, or team structures may require a different account type.

7.3 Account security

You are responsible for maintaining the confidentiality of your password and for all activity carried out through your account. You must notify us immediately if you suspect unauthorised access.

7.4 Account types

We may offer different account types, including private users, landlords, sellers, buyers, tenants, room seekers, flatmates, agents, agencies, developers, or other business users.

7.5 Accurate status

You must not falsely present yourself as a private user if you are acting commercially or on behalf of others.

8. Listings and User Content

8.1 Your responsibility

You are solely responsible for any listing, message, image, video, text, profile content, review, or other material you upload, publish, send, or display on the Platform (Content).

8.2 Your promises when posting

By posting Content, you represent and warrant that:

• it is truthful, accurate, current, and not misleading
• you have the right to post it
• it does not infringe any third-party rights
• it complies with these Terms and applicable law
• any pricing, availability, and key details are genuine
• any photos or videos fairly represent the actual property, room, or situation

8.3 Updating listings

You must promptly update or remove content that is no longer accurate, active, lawful, or available.

8.4 Cyprus focus

Unless we state otherwise, listings must relate to properties or arrangements in the Republic of Cyprus.

9. Prohibited Content and Conduct

You must not:

• post fake, duplicated, unavailable, or bait-and-switch listings
• impersonate another person or business
• misrepresent ownership, authority, identity, licensing, or availability
• harass, threaten, abuse, or spam other users
• use the Platform for unrelated marketing or bulk solicitation
• scrape, crawl, harvest, or extract data by automated means without permission
• upload malware or interfere with the Platform's operation or security
• attempt to bypass verification, moderation, ranking, or safety mechanisms
• publish unlawful, defamatory, hateful, sexually exploitative, discriminatory, or otherwise harmful content
• use the Platform to facilitate fraud, money laundering, or other illegal activity
• use contact details or listing information for resale, marketing databases, lead scraping, or unrelated outreach

We may investigate and act on suspected breaches.

9A. Compliance with Advertising and Consumer Protection Laws

All users, and in particular business users and agents, must ensure that their listings and communications comply with applicable advertising and consumer protection laws, including Cyprus Law 92(I)/2000 on Misleading and Comparative Advertising, Cyprus Consumer Protection Law 31(I)/2021, and EU Directive 2005/29/EC on Unfair Commercial Practices.

10. Verification

10.1 Identity verification

We may require or offer identity verification to reduce fake accounts, scams, impersonation, and abuse.

10.2 Property verification measures

We may also apply property verification or authority-check measures, including document requests, ownership or authority checks, or other verification steps.

10.3 No guarantee

Verification reduces risk, but it is not a guarantee of identity, ownership, authority, legal compliance, listing accuracy, payment safety, or user conduct.

10.4 Refusal or failure

If you refuse or fail verification, we may restrict your access to some features, including messaging, posting, paid features, or account visibility.

11. Contacting Other Users

11.1 Verified contact requirement

To message or contact another user through MY ESTIACY, you may be required to hold a verified account if that requirement is enabled for the relevant feature, category, or account type.

11.2 Property-related use only

Any contact details, profile details, and listing information available through the Platform may only be used for legitimate property-related communication relating to the specific listing, room, property, or flatmate arrangement concerned.

11.3 No public or unrelated use

You must not use information obtained from the Platform for public reposting, scraping, resale, mass marketing, list-building, cold outreach, or unrelated commercial contact.

11.4 Safety

We strongly recommend that users keep communication within the Platform where possible, keep records, verify authority, and never send money before proper checks.

12. Transactions Between Users

All rentals, sales, purchases, bookings, room arrangements, flatshare agreements, and related negotiations happen directly between users.

You are solely responsible for:

• checking the other party's identity and authority
• inspecting the property or arrangement
• verifying the facts and documents provided
• obtaining legal, financial, tax, or other professional advice where needed
• agreeing terms, payments, deposits, contracts, and handover arrangements

Users must not rely solely on information displayed on MY ESTIACY before entering into any rental, sale, booking, reservation, flatshare, or other property-related agreement. Users are responsible for checking and confirming all relevant information directly with the advertiser, owner, agent, developer, or authorised representative, and for obtaining independent legal, financial, tax, surveying, or technical advice where appropriate.

We are not responsible for disputes, defaults, misrepresentations, or losses arising from user-to-user transactions, subject always to mandatory law.

13. Messaging, Moderation, and Safety Controls

We do not routinely monitor every message, but we may use automated tools and proportionate human review where reasonably necessary to:

• investigate fraud, abuse, or suspicious activity
• enforce these Terms and related policies
• comply with legal obligations
• protect users, the Platform, or the public

14. Paid Features

Differentiated treatment (Article 7, EU Regulation 2019/1150). MY ESTIACY does not currently offer or list its own properties, accommodation, or services on the Platform in competition with business users. We do not give preferential ranking, presentation, data access, payment terms, or feature access to our own goods or services compared to those of business users. If we ever introduce first-party listings or services, we will disclose the nature and reasons for any differentiated treatment in this section before doing so.

We may offer paid features including, for example:

• listing boosts
• featured placements
• premium plans or subscriptions
• expert consultation products
• enhanced analytics or profile features
• agency or business tools

All prices, durations, and inclusions will be shown at the point of purchase or in the relevant fees policy.

Pre-contractual information (Article 6, EU Directive 2011/83/EU). Before any consumer is bound by a paid digital service contract on the Platform, the following information is presented at the point of purchase in a clear and comprehensible manner: (a) the main characteristics of the service; (b) our legal name, trading name, geographical address, and contact email; (c) the total price including all taxes (or, where applicable, the manner in which it is calculated); (d) the arrangements for payment, performance, and the time by which the service will be provided; (e) the existence and conditions of the right of withdrawal under Clause 16.1, including the consequences of express performance during the withdrawal period; (f) the duration of the contract, conditions for renewal and termination; (g) our complaint handling process; (h) the existence of relevant codes of conduct.

15. Payments

Payments for paid features are processed by Stripe, our third-party payment provider. We do not store full card details or CVV information on our own systems.

By submitting payment details, you authorise the applicable charge.

16. Consumer Cancellation and Refunds

If you are a consumer resident in the EU or EEA, your mandatory rights under Cyprus and EU consumer law apply in full, including under EU Directive 2011/83/EU (Consumer Rights Directive) as implemented in Cyprus.

16.1 Fourteen-day right of withdrawal

You have the right to withdraw from a digital service contract within 14 days of purchase without giving any reason.

Exception — services that begin immediately: Where you expressly request that a paid digital feature or service begins immediately after purchase (for example, a listing boost or featured placement), and you acknowledge at the point of purchase that the withdrawal right will be lost once the service has been fully performed, you waive this right upon full performance. This consent and acknowledgement will be obtained via a dedicated checkbox at checkout — separate from the general T&Cs acceptance — that explicitly states: "I expressly request that the service begins immediately and I acknowledge that I will lose my right of withdrawal once the service is fully performed." Your tick will be recorded with a timestamp. Where the service has not yet begun, you may withdraw within 14 days by contacting [email protected].

16.2 Non-refundable features

Boosts, featured placements, or similar visibility services are generally non-refundable once activated or delivered, except where mandatory law requires otherwise or where we are at fault.

16.3 Subscriptions

Subscriptions renew automatically unless cancelled before the renewal date. We will send you a clear renewal reminder by email at least seven (7) days before each automatic renewal, stating the date the renewal will occur, the price, and a direct link to cancel. You may cancel a subscription at any time from your account settings via a one-click "Cancel subscription" control that is no harder to access or operate than the original sign-up flow; we do not use dark patterns to make cancellation harder than sign-up. Cancellation stops future renewals; access continues until the end of the current billing period. No partial refund is usually given for the current billing period unless required by law or unless we decide otherwise in a specific case (for example, a billing error or prolonged platform outage).

16.4 Expert services

Consultation or document review services are generally non-refundable once delivered or performed. If the service has not yet been performed, you may cancel and request a full refund by contacting [email protected] at least 24 hours before the scheduled time.

16.5 Statutory rights preserved

Nothing in these Terms limits or excludes any non-excludable statutory consumer rights.

17. Tax and VAT Responsibilities

MY ESTIACY is not responsible for any tax, VAT, stamp duty, or other fiscal obligations arising from transactions between users. It is the sole responsibility of each User to comply with applicable tax and VAT laws, including Cyprus VAT Law 95(I)/2000, Stamp Duty Law Cap. 19, and the Immovable Property (Tenure, Registration and Valuation) Law Cap. 224. MY ESTIACY draws your attention to these obligations but bears no responsibility for your compliance.

18. Rent Control

Tenancy agreements in Cyprus may be subject to the Rent Control Law Cap. 86 and its amendments, which governs certain protected/controlled tenancies. MY ESTIACY does not provide legal advice on which properties and tenancies are subject to rent control. Landlords and tenants should seek independent legal advice regarding the applicable rules for their specific property and tenancy type before entering into any agreement.

19. Mobile Application Terms

Where the Platform is accessed via a mobile application (iOS or Android):

• Your use is also subject to the terms of the applicable app store (Apple App Store Terms / Google Play Terms).
• The app store provider is not a party to these Terms and has no obligation to provide maintenance or support for the app.
• In the event of any conflict between these Terms and the app store terms, these Terms govern to the extent permitted.
• App store providers are third-party beneficiaries of these Terms in relation to your use of the app.
• By installing the app, you consent to the device permissions the app requests (e.g., camera for photo uploads, location for nearby search, notifications). You may withdraw consent to optional permissions in your device settings at any time.

20. Ranking, Visibility, and Paid Placement

Search results and visibility may be influenced by a combination of factors. In accordance with Article 5 of EU Regulation 2019/1150 (Platform-to-Business Regulation), we are transparent about the main parameters that determine default ranking:

• Recency — more recently published or renewed listings rank higher by default
• Listing completeness — listings with fuller information (photos, description, price, availability, EPC rating) rank higher than incomplete listings
• Verification status — where identity verification is enabled, listings posted by identity-verified users may receive a ranking advantage over unverified users
• Relevance to search filters — where a user applies filters (location, price, property type, bedrooms, area), listings that best match those filters rank higher within the filtered results
• Safety and quality signals — listings that have been flagged, reported, or identified as low-quality may rank lower

Effect of paid placements:

• Listing Boost — a boosted listing appears higher in search results than it would organically for the duration of the boost period. After expiry, the listing returns to its default position.
• Featured Listing — a featured listing is highlighted and receives priority placement at the top of relevant search results for the purchased duration.

Paid placements are always clearly labelled (e.g., "Boosted" or "Featured") so users can distinguish them from organic results.

User sorting: Users may re-sort results by price (low to high or high to low), date listed (newest or oldest first), number of bedrooms, or floor area.

Paid visibility affects exposure and ranking only. It does not mean that we approve, recommend, endorse, verify, or guarantee a listing, user, advertiser, or service.

21. AI Features

The Platform may include AI-powered or automated tools such as description generation, price estimation, image tagging, recommendation or matching tools, chatbot assistance, and market insights or analytics. Estia is MY ESTIACY's in-product AI guide/chatbot.

21.1 EU AI Act — transparency notice

In accordance with Article 50 of the EU AI Act (Regulation (EU) 2024/1689), we inform you that the features described in this clause are powered by AI systems. Where you are interacting with an AI-powered tool or chatbot, you are interacting with an AI system, not a human. Where AI-powered features are enabled, AI-generated or AI-assisted content (including listing descriptions, image tags or captions, summaries, and chatbot responses) will be labelled where required by applicable law, in accordance with Article 50(4) of the EU AI Act.

When you use Estia, you are interacting with an AI system, not a human adviser. Estia can be wrong, out of date, or incomplete. Do not rely on Estia for legal, financial, tax, valuation, mortgage, surveying, safety, emergency, or other professional advice. Verify any number, date, fee, eligibility rule, listing detail, or legal point with the relevant advertiser, authority, bank, licensed lawyer, tax adviser, surveyor, valuer, or other qualified professional.

By messaging Estia, you agree that Estia conversation transcripts may be saved by MY ESTIACY and, where your conversation relates to a property, agency, developer, viewing request, contact request, saved-property comparison, or other potential enquiry, may be used as lead or enquiry records and shared with the relevant advertiser, landlord, seller, agent, agency, developer, or authorised representative so they can respond to your request.

We do not use your personal data to train or fine-tune AI models without your explicit, informed, and freely given consent. Where any AI feature involves automated decision-making or profiling that may significantly affect you, you have the right to request human review under GDPR Article 22. To exercise this right, contact [email protected].

We have assessed our current AI features against the risk classification framework in the EU AI Act. None of our current AI features fall within the high-risk categories listed in Annex III of the Regulation. This assessment will be reviewed annually and updated if new features are introduced or if regulatory guidance changes.

21.2 Informational only

All AI outputs are suggestions, estimates, or informational tools only.

21.3 Not professional advice

They do not constitute legal, financial, tax, valuation, surveying, investment, or other professional advice.

21.4 User responsibility

You are solely responsible for reviewing, verifying, editing, and deciding whether to rely on any AI-generated output.

21.5 No guarantee

We do not guarantee the accuracy, completeness, suitability, safety, legality, or outcome of AI outputs.

22. Expert Consultation Services

If the Platform offers expert consultation, relocation help, document review, or similar services:

• those services are for general information and convenience only unless expressly stated otherwise
• MY ESTIACY acts only as the platform or facilitator
• MY ESTIACY is not itself the lawyer, valuer, adviser, surveyor, or other regulated professional
• users must independently verify any advice before relying on it
• no professional-client or fiduciary relationship is created with MY ESTIACY unless expressly stated in writing

Where an expert made available through the Platform holds specific professional qualifications (for example, an advocate registered with the Cyprus Bar Association or a licensed surveyor), this will be disclosed on their profile. You should verify any claimed qualifications independently before relying on advice. For binding legal decisions, engage a licensed advocate directly. For binding financial decisions, engage a regulated financial adviser. For property valuations, engage a licensed surveyor.

You remain solely responsible for any legal, financial, tax, relocation, surveying, valuation, rental, sale, purchase, or flatmate decision you make.

23. Intellectual Property

23.1 Our IP

All intellectual property rights in the Platform, including branding, layout, software, databases, design, and platform materials, belong to us or our licensors.

23.2 Your content

You retain ownership of your content, but by posting it you grant us a non-exclusive, worldwide, royalty-free licence to host, store, reproduce, display, distribute, moderate, adapt, and use that content as necessary to operate, secure, improve, and promote the Platform.

23.3 No scraping / no AI training

You must not scrape, mine, extract, copy at scale, or use Platform data or content for AI training, competitive replication, or derivative products without written permission.

24. Suspension, Restriction, and Termination

We may remove content, restrict features, suspend accounts, or terminate access where reasonably necessary for:

• safety and fraud prevention
• suspected policy breaches
• legal compliance
• abusive or unlawful conduct
• non-payment
• protection of other users or the Platform

You may stop using the Platform at any time. Account deletion or closure does not affect any rights or obligations accrued before closure.

25. Disclaimers

The Platform is provided on an "as is" and "as available" basis.

To the maximum extent permitted by law, we do not guarantee:

• that the Platform will be uninterrupted or error-free
• that listings are accurate, complete, current, lawful, or available
• that users are genuine, reliable, solvent, safe, or properly authorised
• that any transaction will complete successfully
• that any AI output or expert content is accurate or suitable

26. Limitation of Liability

To the maximum extent permitted by law, we are not liable for:

• user content or user conduct
• disputes between users
• losses arising from rentals, sales, purchases, deposits, bookings, room arrangements, or flatshare agreements between users
• indirect, incidental, special, or consequential loss
• reliance on listings, user statements, AI outputs, blog content, or expert content

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited, including liability for fraud, fraudulent misrepresentation, gross negligence, or death or personal injury caused by negligence, where applicable. This carve-out is mandatory under EU Directive 2011/83/EU and Cyprus Consumer Protection Law 31(I)/2021. Subject to the foregoing carve-outs, our total aggregate liability to you arising out of or in connection with these Terms or your use of the Platform shall not exceed the greatest of (i) the total fees you have paid to us for paid features in the twelve (12) months immediately preceding the event giving rise to the claim; (ii) the price paid for the specific paid feature, expert service, or other paid item that is the subject of the claim; or (iii) five hundred euros (€500).

27. Indemnity

To the extent permitted by law, you agree to indemnify and hold harmless the operator of MY ESTIACY from losses, liabilities, claims, damages, and reasonable costs arising from:

• your breach of these Terms
• your unlawful use of the Platform
• your content
• your dealings with third parties through the Platform

Consumer carve-out: This indemnity does not apply to consumers (as defined under EU Directive 2011/83/EU and Cyprus Consumer Protection Law 31(I)/2021) to the extent it would be unfair, unenforceable, or excluded under applicable consumer protection law (including the Unfair Contract Terms Directive 93/13/EEC). Consumer indemnity obligations are limited to losses directly and reasonably caused by the consumer's wilful breach of these Terms.

28. Privacy and Data Protection

We process personal data in accordance with our Privacy Policy and applicable data protection law, including the GDPR and Cyprus Law 125(I)/2018.

29. Complaints, Reports, and Illegal Content

29.1 General support and complaints

General support and complaints may be sent to [email protected]. We aim to acknowledge complaints within 2 business days and resolve them within 5 business days. Unresolved complaints may be escalated — see our Reporting, Takedown & Complaints Procedure (Section 9).

29.2 Privacy

Privacy matters may be sent to [email protected].

29.3 Legal notices and intellectual property

Legal notices and intellectual property notices may be sent to [email protected].

29.4 Illegal content — EU Digital Services Act

In accordance with Article 16 of the EU Digital Services Act (Regulation (EU) 2022/2065), users and third parties may report illegal content on the Platform by emailing [email protected] with the subject line "DSA — Illegal Content Report", including a description of the content, its URL or reference, and the reason you believe it is illegal under applicable law. We will acknowledge receipt and act without undue delay.

DSA single point of contact (Article 11): [email protected]. This contact is accessible from the Platform footer and this page for use by EU authorities and users.

29.5 Alternative Dispute Resolution (Cyprus)

If you are a consumer resident in Cyprus, the EU or EEA and your complaint is not resolved through our internal procedure, you may refer the matter to the Cyprus Consumer Protection Service (Υπηρεσία Προστασίας Καταναλωτή), under the Ministry of Energy, Commerce and Industry, at https://meci.gov.cy/en/services/consumer-protection-service. The previous EU Online Dispute Resolution (ODR) platform was discontinued on 20 July 2025 pursuant to Regulation (EU) 2024/3228, and complaints are now handled by national authorities and sector-specific ADR bodies. We are not obliged to participate in ADR before a particular consumer ADR body unless required by law, but you retain your statutory rights to pursue dispute resolution through the competent national authority or the Cyprus courts.

30. Business Users

If you use the Platform in a professional or commercial capacity, additional rules may apply, including business profile requirements, licensing disclosures, code-of-practice requirements, and rules connected to agency or developer listings. See the Agent / Business Code of Practice (Section 12) for full details.

Business users have additional rights under EU Regulation 2019/1150 (Platform-to-Business Regulation), including the right to a clear explanation of ranking parameters (see Clause 20), access to our internal complaints procedure, and at least 15 days' advance notice of material changes to these Terms.

Mediation for business users: For business-user disputes that are not resolved through our internal complaint-handling system, we are willing to engage in good faith with independent mediators established in Cyprus, where appropriate. Engagement with mediators does not deprive any party of the right to bring judicial proceedings. The cost of mediation is allocated in accordance with the mediator's rules.

31. General Provisions

31.1 Force Majeure: Neither party shall be liable to the other for any failure or delay in performing any obligation under these Terms where such failure or delay results from events beyond the affected party's reasonable control, including but not limited to: natural disasters (earthquake, flood, fire, storm); epidemic or pandemic; acts of war, terrorism, or civil unrest; government action, sanctions, or embargo; changes in law or regulation; cyberattack, distributed denial-of-service attack, or other malicious interference with IT systems; failure of third-party telecommunications or internet services; or failure of public utilities (electricity, water, gas). The affected party shall use reasonable efforts to mitigate the effects of the force majeure event and resume performance as soon as reasonably practicable. If a force majeure event continues for more than ninety (90) consecutive days, either party may terminate these Terms by giving written notice to the other.

31.2 Severability: If any provision (or part of any provision) of these Terms is found by any court, tribunal, or competent authority to be invalid, unlawful, or unenforceable under the laws of the Republic of Cyprus or applicable EU law, that provision (or part) shall be deemed severed from these Terms and the remaining provisions shall continue in full force and effect, to the maximum extent permitted by law.

31.3 Entire Agreement: These Terms, together with the documents referenced in Clause 2 (Other Documents That Apply) — including the Privacy Policy, Cookie Policy, Listing Rules & Content Standards, Verification Policy, Fees, Payments & Refund Policy, and Agent / Business Code of Practice — constitute the entire agreement between you and the operator with respect to your use of the Platform. They supersede all prior or contemporaneous oral or written communications, proposals, representations, or agreements relating to the same subject matter.

31.4 No Waiver: The failure or delay by us to exercise or enforce any right, remedy, or provision under these Terms shall not constitute a waiver of that right, remedy, or provision. A waiver of any right or provision shall be effective only if made in writing and signed by an authorised representative.

31.5 Assignment: We may assign, transfer, or delegate our rights and obligations under these Terms, in whole or in part, in connection with a merger, acquisition, reorganisation, or sale of all or substantially all of our assets, without your prior consent. You will be notified of any such assignment in accordance with Clause 32. You may not assign, transfer, or delegate your rights or obligations under these Terms without our prior written consent.

31.6 Third-Party Rights: Except as expressly stated in Clause 19 (Mobile Application Terms) regarding app store providers as third-party beneficiaries, a person who is not a party to these Terms has no right to enforce any term of these Terms.

31.7 Headings: Section and clause headings in these Terms are included for convenience of reference only and shall not affect the interpretation or construction of these Terms.

32. Changes to the Terms

We may update these Terms from time to time. For consumers, material changes will not take effect until at least 15 days after we notify you by email or prominent in-platform notice. If you do not accept a material change, you may terminate your account during the 15-day notice period without penalty by emailing [email protected]; on termination, any unused prepaid balance for paid features that have not yet been delivered will be refunded pro rata. For business users, material changes take effect at least 15 days after notice in accordance with Article 3 of EU Regulation 2019/1150. Continued use of the Platform after the notice period constitutes acceptance.

Continued use of the Platform after the effective date of an update means you accept the updated Terms.

We commit to reviewing these Terms and related policies at least annually.

33. Governing Law and Jurisdiction

These Terms are governed by the laws of the Republic of Cyprus, including the Contract Law Cap. 149, the Consumer Protection Law 31(I)/2021, and applicable EU regulations directly effective in Cyprus.

Any dispute arising out of or in connection with these Terms or the Platform shall be subject to the non-exclusive jurisdiction of the courts of Cyprus. Consumers domiciled in another EU Member State retain the right under Article 18 of EU Regulation 1215/2012 (Brussels I Recast) to bring proceedings in the courts of the Member State of their domicile, and may also be sued only in those courts. Nothing in this clause limits a consumer's mandatory rights under applicable consumer protection law.

Nothing in this clause affects your statutory rights as a consumer under Cyprus or EU law.

34. Estimator and Calculator Tools (Mortgage Calculator)

34.1 MY ESTIACY provides estimator tools on parts of the Platform — including, but not limited to, the Mortgage Calculator that appears on certain properties listed for sale. These tools are provided for general illustrative purposes only.

34.2 The Mortgage Calculator uses the listing price and inputs that you provide (such as deposit percentage, interest rate, mortgage term in years, buyer status (main residence or investment/second home), VAT treatment (resale, 19% VAT or eligible 5% VAT), property size, monthly income and existing debts) to compute indicative estimates, which may include an estimated loan amount, estimated monthly mortgage payment, deposit amount, VAT estimate, transfer fees, mortgage registration fee, estimated cash needed before completion, loan-to-value ratio and debt-service ratio.

34.3 These estimates are not: (a) a mortgage offer, credit quote, or pre-approval; (b) financial, tax or legal advice, or a personal recommendation; or (c) a binding statement of the taxes, duties or fees that will apply to any particular transaction.

34.4 Tax and fee figures used by the Calculator reflect Cyprus rules as at the "Last updated" date shown in the tool. These rules change from time to time. The Cyprus Tax Department and the Department of Lands & Surveys have the final say on what taxes and fees apply to your specific transaction; the bank you approach has the final say on the loan terms it will offer you, and assesses your eligibility under its own criteria, including the affordability checks required by Cyprus Law 41(I)/2017 (transposing Directive 2014/17/EU on credit agreements for consumers relating to residential immovable property).

34.5 You are responsible for verifying every number that matters to your decision with (a) the bank or licensed credit intermediary, (b) a qualified lawyer or licensed real-estate professional, and (c) the Cyprus Tax Department where relevant, before signing any commitment or paying any sum. We recommend that you do so.

34.6 The Calculator currently runs entirely in your browser. We do not transmit, log or store the values that you enter into it; refreshing or leaving the page deletes them. If we change this behaviour we will update the Privacy Policy and notify you.

34.7 MY ESTIACY does not lend money, does not broker or arrange mortgages, and does not provide credit intermediation services within the meaning of Cyprus Law 41(I)/2017. We currently have no commercial relationship with any bank, broker or credit intermediary in respect of the Calculator. If in future we introduce affiliate or referral arrangements with such parties, we will disclose those relationships clearly at the point of use.

34.8 Subject to your rights under Cyprus consumer-protection law (including remedies that cannot be excluded by contract), MY ESTIACY accepts no liability for loss or decisions arising from your reliance on the output of the Calculator or of any other estimator tool. The general limitation of liability at clause 26 applies to any such claim.

SECTION 3: PRIVACY POLICY

Last updated: 17/10/2026 Controller: Miltos Ioannidis, trading as MY ESTIACY ("MY ESTIACY", "we", "us", "our") — sole trader (controller will transfer to ESTIACY LTD upon incorporation, at which point this Privacy Policy will be updated). Business name registration no.: EE62897a Registered address: Ioulianou 30, Ekali, 3111, Limassol, Cyprus Privacy contact email: [email protected]

This Privacy Policy explains how we collect, use, share, and protect personal data when you use MY ESTIACY's website and mobile apps (the "Platform"). It also explains your rights under the EU General Data Protection Regulation (GDPR) and Cyprus Law 125(I)/2018.

Key Points — Plain English Summary - What we collect: Your name, email, phone, listings, messages, and (if you choose) verification and payment data. - Why we collect it: To run the Platform, keep it safe, process payments, and improve the service. - We do not sell your data: We never sell your personal data to third parties. - Your rights: You can access, correct, delete, or export your data at any time. Email [email protected]. - Marketing is opt-in: We only email you marketing if you said yes. You can unsubscribe any time — it won't affect your account. - Cookies: We use necessary cookies to run the site. Only if you say yes, we also use Google Analytics to see how the site is used, and Google Ads and the Meta (Facebook) Pixel to measure our advertising. You choose, and you can change your mind any time in Cookie Settings. - Cyprus law applies: We are subject to GDPR and Cyprus Data Protection Law 125(I)/2018. - Questions? Contact [email protected] For full details, read each section below.

The Platform is strictly for users aged 18 and over. We do not knowingly collect or process personal data of persons under 18. Under Cyprus Data Protection Law 125(I)/2018 (implementing GDPR Article 8), a child is defined as any person under 13 years of age. If we become aware that we have inadvertently collected personal data from anyone under 18, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected].

1. Who We Are and Our Role

1.1 Data Controller: For most processing described in this Policy, MY ESTIACY is the "data controller" — we decide why and how your personal data is processed.

1.2 When other parties are controllers: When you contact a landlord/seller/agent or any other user and share personal data with them (e.g., your phone number or email), that recipient may become an independent data controller for how they handle your information after receiving it. You should review their privacy practices.

1.3 Processors (service providers): We use third-party service providers ("processors") to run the Platform. They process personal data on our instructions under contractual safeguards including GDPR-compliant Data Processing Agreements (DPAs). See Section 8 for the full list of third-party processors.

2. What Data We Collect

2.1 Account and profile data:

• Name (or display name)
• Email address
• Phone number
• Password (stored as a secure hash — not readable by us)
• Account type (e.g., buyer/tenant, landlord/seller, flatmate, agent/business)
• Profile details you choose to provide (e.g., short bio, preferences)
• Language preference (English or Greek)

2.2 Listing and property data: Property details, photos, videos, pricing, and availability that you include in your Listings; location data (address, area, map pin) for the property.

2.3 Verification data: Where identity verification is enabled, our intended third-party provider, IDAnalyzer, will process your identity document. We receive and store only: verification status (verified/pending/failed), timestamp, and provider reference ID. We do not store copies of your identity document images in "no storage" mode. For full details see the Verification Policy.

2.4 Usage and technical data: IP address, browser type, operating system, device identifiers; pages visited, time spent, search queries, clicks, and interactions on the Platform; referring URL and exit pages.

If we introduce a "Last seen" or "Last active" timestamp feature, we will provide a privacy setting in Account Settings allowing you to control whether it is visible to other users. We do not store precise "Last seen" timestamps beyond 30 days where the feature is active.

2.5 Communications data:

• Messages sent via Platform messaging between users
• Support tickets and emails you send to us
• Calls to or from our support team (where applicable — see Section 13 on call recording)
• Messages you send to Estia, our in-product AI assistant, and replies Estia generates. By messaging Estia, you agree that Estia messages are processed by our AI backend provider to produce replies. Conversation data may also be stored temporarily in your browser/session storage and, where enabled on our backend, for up to 30 days for quality, security, abuse-prevention, and troubleshooting purposes. Where an Estia conversation indicates a potential property enquiry or lead, we may save the transcript and related lead metadata as a lead or enquiry record and may share relevant parts with the relevant advertiser, landlord, seller, agent, agency, developer, or authorised representative so they can respond. Estia conversations are not used to train AI models without your explicit consent.

2.6 Payment data: If you purchase paid features, our payment processor Stripe handles your card details. We receive and store only a transaction reference, amount, date, and payment status. We do not store full card numbers or CVV codes.

2.7 Location data (optional): If you grant the mobile app permission to access your device's location (GPS), we may use this to show you properties nearby. This is optional — you may decline or withdraw this permission in your device settings at any time. We do not store precise GPS coordinates long-term.

2.8 Social / third-party login data: If you register or sign in using a third-party account (e.g., Google, Apple, Facebook), we receive your name, email address, and profile photo from that provider. You become our user from that point forward and this Privacy Policy applies to the data we hold. We do not receive your password for those services.

2.9 Roommate matching and compatibility data: If you use the Platform's roommate/flatmate matching feature, we collect the following preference data that you provide:

• Lifestyle preference (quiet / social / balanced)
• Gender preference for flatmates
• Pet policy (pets welcome / no pets / negotiable)
• Smoking preference (smoker / non-smoker / outside only)
• Room type preference (single / shared / studio / any)
• Budget range (minimum and maximum monthly rent)
• Availability dates (move-in date, minimum stay)
• Interests and hobbies (free-text, optional)
• Age
• Occupation
• Social media links (optional — provided at your discretion)

Legal basis for processing: Contract performance (GDPR Article 6(1)(b)) — this data is necessary to provide the roommate matching service you requested when you opted into the flatmate/room-seeker feature.

Special category data: Some preferences you provide (for example, gender preference for flatmates) may relate to characteristics that fall within the scope of GDPR special category data under Article 9.

Where preference data falls within GDPR special category data under Article 9, we process such data only with your explicit consent (GDPR Article 9(2)(a)). This data is collected via a standalone, specific consent screen presented at the point you opt into the flatmate/room-seeker feature, separate from general Terms acceptance. The consent screen explains: (a) what data is being collected; (b) why it is needed; (c) how it will be used; (d) that you can withdraw consent at any time.

DPIA requirement: A Data Protection Impact Assessment for the roommate matching algorithm must be completed and signed off by the Controller before this feature is made available in production, as required by GDPR Article 35.

Free-text fields and Article 9 GDPR: The DPIA for this feature must assess whether free-text fields ("interests and hobbies", "lifestyle notes", "about me") may inadvertently capture special category data revealing racial or ethnic origin, religious beliefs, political opinions, health conditions, or sexual orientation. We ask users not to include special category data in free-text fields. Where we identify such data during moderation or support review, we may remove it or ask the user to edit it. Where Article 9 data is detected, we rely on explicit consent under Article 9(2)(a) or remove the content.

You may withdraw consent at any time by updating your preferences in your account settings or by contacting [email protected]. Withdrawal of consent will result in the roommate matching feature being disabled for your account.

How matching data is used: Your preference data is processed by our roommate matching algorithm to generate compatibility scores between you and other Users who have also opted into the matching feature. Compatibility scores are algorithm-based estimates only.

Retention: Roommate matching preference data is retained for the duration of your account. If you deactivate the roommate matching feature, your preference data will be deleted within 30 days, unless retention is required for another lawful purpose (e.g., fraud prevention or legal proceedings). If you delete your account, roommate matching data is deleted in accordance with the retention schedule in Appendix A.

2.10 Estimator and calculator tools (Mortgage Calculator): The Mortgage Calculator and any other on-site estimator tools operate locally in your browser. We do not transmit, log or store the inputs you enter into these tools (such as deposit, interest rate, loan term, income or existing debts). Refreshing or leaving the page deletes them. If this changes — for example, if a future version saves scenarios to your account — we will update this Privacy Policy and notify you.

3. Special Category Personal Data

Identity documents (such as passports and national identity cards) may constitute biometric or special category data under GDPR Article 9. Where you submit identity documents through our verification process, this data is processed by our third-party verification provider IDAnalyzer under strict safeguards. The legal basis for this processing is:

• Your explicit consent (GDPR Article 9(2)(a)); and/or
• Processing necessary for reasons of substantial public interest — specifically, fraud prevention and platform safety (GDPR Article 9(2)(g) and Cyprus Law 125(I)/2018).

We will complete a Data Protection Impact Assessment (DPIA) in relation to biometric/identity data processing before enabling identity verification, as required by GDPR Article 35.

4. How We Use Your Data (Purpose and Legal Basis)

Legitimate Interests Assessment

Where we rely on legitimate interests (GDPR Article 6(1)(f)) as the legal basis for processing, we have carried out a three-part Legitimate Interests Assessment (LIA) considering: (a) the purpose of the processing; (b) whether the processing is necessary and proportionate to achieve that purpose; and (c) whether our interests are overridden by your rights and freedoms.

The key purposes for which we rely on legitimate interests, and why we consider our interests are not overridden, are as follows:

• Fraud prevention and platform safety: We process usage signals and account data to detect and prevent fraudulent activity. This is necessary to protect all users and the integrity of the Platform. Users benefit from a safer marketplace and the processing is limited to what is necessary for that purpose.
• Analytics and platform improvement: We use anonymised/pseudonymised usage data to understand how users interact with the Platform and improve it. This processing does not significantly impact individual users.

Personalised listing recommendations: We use your Platform behaviour (searches, saves, views) to suggest relevant listings. Under GDPR Article 4(4), this processing constitutes profiling — specifically, the automated processing of personal data to evaluate your property preferences. This profiling does not produce legal or similarly significant effects, and no automated decisions are made solely on this basis. You have the right to object to this profiling at any time under GDPR Article 21. You may object to personalised recommendations at any time by emailing [email protected]. Where we enable personalised recommendations, we will also provide an account-level opt-out setting.

• Call recording (where applicable): Calls are recorded for quality assurance and dispute resolution. Users are informed at the start of every call. Recordings are retained for 12 months only.

Your right to object: Under GDPR Article 21, you have the right to object to processing based on legitimate interests at any time. If you object, we will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for the establishment, exercise, or defence of legal claims. To exercise your right to object, contact [email protected].

Marketing Communications

We send marketing emails only where you have given us your prior, freely given, specific, informed and unambiguous consent (GDPR Article 6(1)(a) and EU ePrivacy Directive as implemented by Cyprus Electronic Communications Law 112(I)/2004).

You can opt out of marketing at any time, without giving a reason, by:

• Clicking the unsubscribe link in any marketing email
• Updating your notification preferences in Account Settings
• Emailing [email protected]

Opting out of marketing does not affect your access to the Platform or any free features. You will continue to receive service-related communications (e.g., booking confirmations, account security alerts, payment receipts) which are sent on the basis of contract performance and are not marketing.

For SMS marketing, we only send messages where you have separately and explicitly consented. You may opt out at any time by replying STOP to any marketing SMS or via Account Settings. We comply with the requirements of the EU ePrivacy Directive and Cyprus Electronic Communications Law 112(I)/2004 regarding unsolicited electronic marketing.

The 'soft opt-in' exception applies only where: (a) you are an existing customer; (b) the communication relates to our own similar products/services; and (c) you were given a clear opportunity to opt out when your details were collected and in every subsequent communication.

5. Data Retention Schedule

We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law.

After the applicable retention period, data is securely deleted or anonymised. See Appendix A for full justification of each retention period.

6. Automated Decision-Making and Profiling

We may use automated processes for the following:

• Ranking and ordering Listings in search results (based on relevance, recency, paid visibility features)
• Recommending Listings to users based on their search history and preferences
• Automated fraud and scam detection signals that may flag accounts for human review

Where automated processes are used to flag accounts, a human review is conducted before any significant account action (suspension/removal) is taken. We do not make solely automated decisions that produce legal or similarly significant effects without human oversight. Under GDPR Article 22, you have the right to request human review of any automated decision that significantly affects you. Contact [email protected] to exercise this right.

7. Who We Share Data With

7.1 Other users: Your profile information (name/display name, account type, verification status) is visible to other users as intended by the Platform's function. Your contact details are only visible if you include them in a Listing or choose to share them.

7.2 Third-party processors: See Section 8 for the full list of named third-party data processors.

7.3 Legal disclosures: We may disclose personal data to: law enforcement or regulatory authorities where required by law; the Cyprus Commissioner for Personal Data Protection; courts or legal proceedings; or to protect the rights, property, or safety of MY ESTIACY, our users, or the public.

7.4 Business transfers: If MY ESTIACY is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the Platform before your data is transferred and becomes subject to a different privacy policy.

8. Third-Party Data Processors

We use the following third-party processors. All are bound by GDPR-compliant Data Processing Agreements. This list will be updated as our processor relationships change.

Analytics and advertising tools: On our website we use Google Tag Manager to load Google Analytics 4 and Google Ads, and we use the Meta (Facebook) Pixel. Google Analytics runs only if you accept analytics cookies. Google Ads and the Meta Pixel run only if you accept marketing cookies. We use Google Consent Mode v2, with every consent setting defaulting to "denied" until you choose. What these tools receive: pages you view, your device and browser type, an approximate location derived from your IP address, and events such as searches, listings viewed or saved, enquiries sent, account sign-ups, and subscriptions started. We do not send them your name, email address, phone number, or the content of your messages. Search terms are checked for email addresses and phone numbers, which are removed before sending. Google Analytics 4 does not log or store IP addresses. Before you consent: Google tags are loaded but run in "denied" mode. In that mode they do not set or read cookies, and may send Google cookieless signals that Google uses to estimate aggregated measurement. Meta Pixel: For the collection and transmission of Pixel data, MY ESTIACY and Meta Platforms Ireland Limited are joint controllers. Meta is an independent controller for any processing it carries out afterwards; see Meta's Privacy Policy at https://www.facebook.com/privacy/policy.

Transfer Impact Assessment (TIA): Where any processor receives personal data outside the EU/EEA (for example, US-based providers such as Mapbox, Google Translate, Google Analytics, or the Meta Pixel), we will complete a Transfer Impact Assessment compliant with the Schrems II decision (CJEU C-311/18) and EDPB Recommendations 01/2020 before activating that transfer. The TIA evaluates the relevant legal regime, supplementary technical and contractual measures (encryption in transit, data minimisation, no source IP relay where possible), and is reviewed annually. A summary is available on request to [email protected].

Our third-party processors may use sub-processors to provide their services (for example, cloud hosting infrastructure providers used by IDAnalyzer or Stripe). We require all processors to ensure that any sub-processors they engage are bound by equivalent data protection obligations under GDPR-compliant agreements. We do not directly control the sub-processor relationships of our processors. If you wish to obtain information about the sub-processors used by any of our processors, please contact [email protected]. Where any processor engages a new sub-processor that may affect your data, we will update this processor list at the next scheduled review and notify you of material changes in accordance with Section 16 (Changes to This Privacy Policy).

Note on processor list consistency: This list of third-party data processors is kept in sync with Section 18 (Third-Party Tools & Data Processors). Where there is any discrepancy between the processor list in this Privacy Policy and the list in Section 18, the more recently updated version shall prevail. Both lists are reviewed and reconciled at each document update.

Where processors are located outside the EU/EEA, transfers are made under Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, or other appropriate safeguards under GDPR Chapter V.

9. International Data Transfers

Your data is primarily processed within the EU/EEA. Where we transfer personal data to countries outside the EU/EEA (for example, where a processor's servers are located in a non-EEA country), we ensure appropriate safeguards are in place, including: EU Standard Contractual Clauses (SCCs); adequacy decisions by the European Commission; or binding corporate rules. You can request details of the specific safeguards applicable to your data by contacting [email protected].

10. Data Breach Notification

In the event of a personal data breach, we will:

• Notify the Cyprus Commissioner for Personal Data Protection within 72 hours of becoming aware of the breach, where required by GDPR Article 33
• Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34
• Keep an internal record of all data breaches regardless of whether notification is required

Notification to users will be by email and/or prominent notice on the Platform, and will include: the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed.

11. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage, in accordance with GDPR Article 32. These measures include:

• Encryption: Personal data is encrypted in transit using TLS (Transport Layer Security) and encrypted at rest where applicable.
• Access controls: Access to personal data is restricted to authorised personnel on a need-to-know basis. All staff with access to personal data receive data protection training.
• Password security: User passwords are stored as cryptographic hashes — they are not readable by us or our staff.
• Secure payment handling: Payment card data is handled entirely by Stripe. We do not store card numbers or CVV codes on our systems.
• Third-party processor vetting: All processors are required to maintain appropriate security standards under their Data Processing Agreements with us.
• Incident response: We maintain an internal data breach response procedure and will notify the Cyprus Commissioner for Personal Data Protection and affected users as required by GDPR Articles 33–34.

No system is completely secure. We cannot guarantee absolute security, but we take our obligations under GDPR Article 32 seriously and review our security measures regularly.

12. Cookies

We use cookies and similar tracking technologies. For full details of the cookies we use, your consent choices, and how to manage your preferences, see our Cookie Policy & Cookie Settings (Section 4).

13. Call Recording

Where you contact us by telephone for support, or where calls are facilitated through the Platform, calls may be recorded for quality assurance, training, and complaint resolution purposes. The legal basis for recording is our legitimate interests in maintaining service quality and resolving disputes. Recordings are retained for up to 12 months. You will be informed that a call is being recorded at the start of the call.

14. Your Rights Under GDPR

You have the following rights in relation to your personal data:

Your right to erasure is not absolute. We may refuse or partially refuse an erasure request where we are required to retain data for one or more of the following reasons:

(a) Compliance with a legal obligation (Art. 17(3)(b)): Payment transaction records are retained for 7 years under Cyprus tax and accounting law, and identity verification metadata is retained for 5 years for fraud prevention and legal compliance. We cannot delete this data early even upon request.

(b) Establishment, exercise, or defence of legal claims (Art. 17(3)(e)): We may retain data where it is necessary in connection with actual or anticipated legal proceedings.

(c) Public interest (Art. 17(3)(d)): We may retain data where erasure would impair fraud prevention, platform safety, or other public interest purposes.

When we refuse or partially refuse an erasure request, we will explain the specific reason and the data categories affected, and we will delete all data we are not legally required to retain. You have the right to lodge a complaint with the Cyprus Commissioner for Personal Data Protection if you are unhappy with our response.

To exercise any of these rights, contact us at: [email protected]. We will respond within one month (extendable by a further two months for complex requests). We may need to verify your identity before fulfilling a request.

If you are unhappy with how we handle your request or your data generally, you have the right to lodge a complaint with the Cyprus supervisory authority:

Office of the Commissioner for Personal Data Protection 1 Iasonos Street, 1082 Nicosia, Cyprus Tel: +357 22818456 Email: [email protected] Website: www.dataprotection.gov.cy

15. Data Protection Officer

We have formally assessed whether a Data Protection Officer (DPO) is required under GDPR Article 37 and Cyprus Law 125(I)/2018. Based on our current scale of operations as a pre-launch platform, we have determined that a DPO is not currently mandatory. However, we have designated a Data Protection Contact Point for all privacy-related queries: [email protected]

We commit to reassessing this determination as the Platform scales. If we reach a scale of operations that triggers the DPO requirement under Article 37, we will appoint a DPO and publish their contact details here.

Data Protection Impact Assessment (DPIA): In accordance with GDPR Article 35, we have identified the following high-risk processing activities. A completed DPIA is required before the relevant processing is enabled:

• Identity verification processing (biometric/special category data via IDAnalyzer)
• Roommate matching algorithm (processing lifestyle and preference data) — required before that feature goes live
• Automated listing ranking and fraud detection

A completed DPIA is a precondition to enabling each of the activities listed above. The relevant processing will not be activated until the DPIA has been signed off. Where a DPIA identifies residual high risks that cannot be mitigated, we will consult the Cyprus Commissioner for Personal Data Protection prior to commencing processing, as required by GDPR Article 36 and Cyprus Law 125(I)/2018.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and/or by prominent notice on the Platform. The updated Policy will be effective from the date stated at the top of this page. Where a change introduces new processing that requires a fresh legal basis or your consent under GDPR (for example, a new purpose, new categories of data, or new recipients), we will obtain that consent or rely on a clearly identified alternative legal basis separately, and we will not treat continued use of the Platform as deemed acceptance of those changes.

SECTION 4: COOKIE POLICY + COOKIE SETTINGS

Last updated: 17/10/2026 Operator: Miltos Ioannidis, trading as MY ESTIACY (sole trader) — Ioulianou 30, Ekali, 3111, Limassol, Cyprus. (Operator will transfer to ESTIACY LTD upon incorporation; this Cookie Policy will be updated accordingly.)

1. What Are Cookies?

Cookies are small text files placed on your device by websites and apps. They help the Platform function properly, remember your preferences, and allow us to analyse how the Platform is used. Similar technologies (e.g., pixel tags, local storage) work in a similar way and are also covered by this Policy.

2. Legal Basis for Cookies

Our use of cookies is governed by the EU ePrivacy Directive (implemented in Cyprus by the Regulation of Electronic Communications and Postal Services Law 112(I)/2004 as amended) and GDPR. Strictly necessary cookies do not require your consent. All other cookies require your prior, informed, and freely given consent before we set them.

3. Types of Cookies We Use

Known Cookies — Reference Table

Analytics and marketing cookies are set only after you accept that category in the cookie banner. Non-essential cookies (analytics, marketing, functional preferences) are only set after you have given consent. You may withdraw consent at any time via Cookie Settings in the footer. This table is reviewed at each cookie audit.

We use a cookie consent banner / Consent Management Platform (CMP) to manage cookie consent before any non-essential cookies are activated. The CMP will be configured so that:

• (a) All non-essential cookies are technically blocked by default until the user actively consents.
• (b) No pre-ticked boxes are used.
• (c) The "Reject All" option is equally prominent to "Accept All".
• (d) Consent is granular — users can accept or reject each category separately.
• (e) Consent records are stored with a timestamp, what the user was shown, and the choices made.

CMP provider: MY ESTIACY's cookie consent banner. If we adopt a third-party CMP provider in future, this policy will be updated with the provider name, processing location, and data processing terms.

Google Consent Mode v2: We use Google Consent Mode v2. All consent parameters default to "denied" and change only when you accept analytics or marketing cookies. While consent is denied, Google tags do not set or read cookies; they may send Google cookieless signals used for aggregated measurement. The Meta Pixel is not loaded at all until you accept marketing cookies.

Withdrawal of consent: Users can withdraw cookie consent at any time by clicking "Cookie Settings" in the website footer. Withdrawal is as easy as giving consent. Withdrawing consent does not affect the lawfulness of processing before withdrawal and does not prevent use of the Platform's core features.

Consent records are retained for the duration of consent + 1 year after withdrawal (see Appendix A).

Consent requirements: Pre-ticked boxes are not used. Consent is collected for each category separately (granular consent). You may accept, reject, or customise by category. Refusing non-essential cookies will not prevent you from using the Platform's core features.

4. Your Cookie Choices

When you first visit the Platform, you will see a cookie consent banner. You can:

• Accept all cookies
• Reject all non-essential cookies
• Customise your preferences by category

You can change your cookie preferences at any time by clicking "Cookie Settings" in the website footer. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

5. Third-Party Cookies

Some cookies on the Platform are set by third parties: Mapbox for map display, Google for Google Analytics and Google Ads, and Meta for the Meta Pixel. Google and Meta cookies are set only with your consent. These third parties have their own privacy/cookie policies which govern their use of that data. We recommend reviewing the privacy policies of any third-party services you encounter.

6. How to Manage Cookies in Your Browser

You can also manage cookies through your browser settings. Most browsers allow you to view, delete, and block cookies. Note that blocking strictly necessary cookies may prevent the Platform from working properly. Useful links:

• Chrome: Settings > Privacy and security > Cookies
• Firefox: Options > Privacy & Security
• Safari: Preferences > Privacy
• Edge: Settings > Privacy, search, and services

7. Contact

For questions about this Cookie Policy, contact: [email protected]

SECTION 5: LISTING RULES & CONTENT STANDARDS

Last updated: 17/06/2026

These Listing Rules form part of MY ESTIACY's Terms & Conditions. If you post a listing, you agree to follow them. MY ESTIACY is a marketplace connecting landlords/sellers with tenants/buyers and flatmates with flatmates. We do not take part in transactions, but we enforce these rules to keep the platform safe and useful.

1. Scope

These rules apply to:

• Properties for Rent (whole property)
• Properties for Sale
• Rooms / Flatshares
• Room Wanted / Flatmate Wanted ads
• Agent/Agency listings

Cyprus only: Listings must be for properties located within the Republic of Cyprus (for now).

2. Core Listing Requirements

Every listing must be:

• Accurate and truthful — no misleading price, availability, location, or photos
• Up to date — update immediately if anything changes
• Available — no dummy listings, no "testing", no bait
• Specific — a real, identifiable property/room
• Clearly priced — rent/sale price must be real; if negotiable, state it
• Clear about availability — available now / from [date]
• Clear about fees — see Section 6

Advertisers must promptly mark a listing as unavailable, rented, sold, reserved, expired, or remove it entirely once it is no longer available. Keeping unavailable listings live is prohibited and may result in removal or account restriction.

Listings must be posted in the correct category. MY ESTIACY may move, edit, reject, or remove listings posted in the wrong category, including where a short-stay listing is posted as a long-term rental, a room is posted as a whole property, or a project listing is posted as a standard resale listing.

Standard listings are active for 30 days and can be renewed for free. Boosted and Featured listings follow their purchased duration (7, 14, or 30 days for Boosts; as specified for Featured Listings).

Advertisers are reminded that under Cyprus Law 92(I)/2000 on Misleading and Comparative Advertising (implementing EU Directive 2006/114/EC), a listing or advertisement is considered misleading if its presentation — including descriptions, photos, pricing, or omissions — is likely to mislead users and influence their economic decisions. Misleading advertising may lead to regulatory penalties. MY ESTIACY reserves the right to remove listings that may constitute misleading advertisements under applicable law.

3. Who Is Allowed to Post

You may only list a property/room if you are:

• The owner, or
• An authorised agent/agency, or
• An authorised representative (e.g., power of attorney), or
• Otherwise legally authorised to advertise it

We may request evidence of authority at any time. If you cannot provide it, we may remove the listing and restrict your account.

4. Energy Performance Certificate (EPC) — Legal Requirement

Under the Cyprus Energy Performance of Buildings Law (Law 142(I)/2006 as amended by Law 101(I)/2017 and subsequent regulations implementing EU Directive 2010/31/EU), all properties offered for sale or rent must have a valid Energy Performance Certificate (EPC) issued by a licensed energy assessor.

Listing requirements:

• All for-sale and for-rent listings must include the property's EPC rating (A-G scale) or state that an EPC is being arranged (for newly built properties not yet certified).
• It is the advertiser's sole legal responsibility to obtain a valid EPC before marketing the property.
• Displaying an incorrect EPC rating is a breach of these rules and may be a criminal offence under Cyprus law.
• MY ESTIACY reserves the right to remove listings that do not include a valid EPC reference and to report persistent non-compliance to the Cyprus Energy Service.

Note for advertisers: Failure to obtain an EPC before marketing a property may constitute a breach of Cyprus law. Fines may apply. This requirement applies to most residential and commercial properties. Certain exemptions exist (e.g., listed buildings, places of worship, temporary buildings) — check with a licensed energy assessor.

5. Photos & Media Rules

5.1 Photos must be real: Use photos/videos of the actual property/room. Photos must reflect the current condition. Do not use AI-generated, stock, or misleading photos.

5.2 Minimum photo requirement: We recommend a minimum of 3 photos per listing. The main/cover photo must show the exterior or main living space of the property/room.

5.3 Copyright: Only upload photos/videos you own, have taken yourself, or have permission to use. Do not use photos from other listings or websites without permission. You grant MY ESTIACY a licence to display your photos on the Platform as described in the Terms & Conditions.

5.4 Forbidden photo content:

• No personal items that identify third parties (faces, documents)
• No offensive, violent, or sexually explicit content
• No watermarks from other platforms or competitor branding

5.5 Image content restrictions (contact details, promotional text)

Photos must be clean, clear, and accurate. Photos must not include phone numbers, email addresses, website links, social media handles, QR codes, addresses, or other contact details. Photos must also not include promotional text such as "urgent", "cheap", "best price", "for sale", "clearance", or similar wording. Misleading, edited, fake, or fraudulent images are not allowed.

5.6 Logos and watermarks (business users)

Business users may include a small, non-intrusive logo or watermark on listing photos, provided it does not cover the property, mislead users, include contact details, or reduce the quality of the image. MY ESTIACY may require the image to be replaced if the branding is excessive or unclear.

6. Pricing and Fees Rules

• Rent price: State monthly rent in EUR. If bills are included, say so. If negotiable, say so.
• Sale price: State the total asking price in EUR. If negotiable, say so.
• Agent fees/commission: If you charge a fee to tenants or buyers, you must disclose this clearly in the listing. Hiding fees is prohibited.
• VAT: If your supply is subject to VAT (typically commercial lettings and sales by VAT-registered businesses), state whether the price is VAT-inclusive or exclusive.

7. Prohibited Listings

The following are strictly prohibited:

• Fake, ghost, or test listings (properties that do not exist or are not genuinely available)
• Bait-and-switch listings (advertising one property and showing/offering another)
• Duplicate or repeated listings — each listing must relate to one specific property, room, unit, short-stay accommodation, or development unit. Generic "we have many properties available" listings are not allowed unless MY ESTIACY provides a dedicated agency portfolio, new development, or project listing feature
• Listings for properties outside Cyprus (unless we announce otherwise)
• Listings that advertise illegal activity or subletting without landlord consent
• Listings for timeshare or holiday lets (unless a specific category is enabled)
• Listings offering properties as collateral or investment schemes

8. Flatmate / Flatshare Listings

For flatshare and flatmate wanted listings:

• Be honest about house rules, existing housemates, and the property's condition
• You must have the right to sublet or take in a flatmate under your tenancy agreement — check with your landlord
• Do not discriminate based on protected characteristics (see Equal Opportunities & Anti-Discrimination Policy)
• "Wanted" ads must be genuine — you must be actively looking for a property/room in the area stated

8A. Short-Stay and Self-Catering Accommodation

If a listing relates to short-stay, serviced, holiday, hotel-style, or self-catering accommodation, the advertiser is solely responsible for ensuring that the accommodation complies with all applicable Cyprus tourism and accommodation laws. Where a registration number, licence, permit, or approval is required by the Deputy Ministry of Tourism or any competent authority, the advertiser must include the correct registration number or licence details in the listing. MY ESTIACY may reject, remove, or restrict short-stay listings that do not include required registration details or appear non-compliant.

8B. New Developments and Off-Plan Projects

Where developers, agents, or authorised representatives list new, under-construction, off-plan, or upcoming projects, all project information, specifications, floor plans, renders, availability, prices, expected completion dates, and promotional materials are provided by the advertiser. MY ESTIACY does not verify or guarantee the accuracy, completeness, delivery date, legal status, planning status, title status, construction quality, or commercial terms of any development project. Buyers must carry out independent legal, technical, and financial due diligence before reserving, purchasing, or paying any amount.

8C. No External Links in Listings

Listings must not include external links, redirect links, competing platform links, social media links, or attempts to move users away from MY ESTIACY, unless MY ESTIACY expressly allows this for an approved feature, business profile, integration, or partner page.

9. Enforcement

We may remove, restrict, or escalate listings or accounts that breach these rules. Repeat offences may result in permanent account suspension. We may also report matters to relevant authorities (including Cyprus police or regulatory bodies) where we believe there is criminal activity. MY ESTIACY may also require an advertiser to amend, clarify, correct, or improve a listing where we consider that the listing is inaccurate, incomplete, misleading, poor quality, wrongly categorised, non-compliant, or harmful to platform quality. We may edit, hide, reject, or remove listing content where necessary to protect users, comply with law, or maintain listing standards.

SECTION 6: VERIFICATION POLICY

Last updated: 17/06/2026

1. Why Verification Matters

MY ESTIACY uses, or may use, identity and property verification measures to reduce fake accounts, scam listings, and impersonation. Verification does not guarantee safety, but it significantly raises the bar for bad actors and builds trust between users.

2. User Identity Verification

2.1 How it works: Our intended identity verification provider is IDAnalyzer, a third-party KYC (Know Your Customer) provider. Identity verification will be enabled once the supporting compliance work (DPIA, DPA, configuration) is complete. The process involves:

• Submitting a government-issued photo ID (passport, national identity card, or driver's licence)
• A liveness check or selfie matching (depending on the verification tier)
• Automated checks by the provider's systems

2.2 What we store: We aim to configure our identity verification provider so that we do not retain copies of your ID document images on our own systems. We store only: verification status (verified / pending / failed), verification timestamp, and the provider's reference ID for audit purposes. The exact configuration in force at any time is reflected in this Policy and our Verification Policy.

2.3 Verification tiers: We may offer or require different levels of verification:

• Basic verification: email and/or phone confirmation
• Identity verified: government ID checked via IDAnalyzer
• Business verified: legal/trading name and registration confirmed (for agents/businesses)

2.4 Voluntary vs. mandatory: Where identity verification is enabled, it is recommended for all users and may be required to access certain features, such as posting listings or contacting other users. We may make verification mandatory for additional features in future.

2.5 Refusal or failure: If you refuse or fail verification, we may restrict your access to certain features. We will not automatically terminate accounts solely on the basis of a failed verification without further review.

3. Property Verification

MY ESTIACY may implement property verification measures including:

• Requesting proof of ownership or authority to advertise (title deed, authorisation letter, power of attorney)
• Cross-checking property details against public records where available
• Location verification or other checks

The specific steps may vary. Property verification badge (if displayed) means we have conducted checks at the time of verification. It does not guarantee ongoing accuracy or that the property is legally compliant in all respects.

4. No Guarantee

Verification reduces risk but is not a guarantee of: identity correctness in all cases; ownership or legal authority; listing accuracy; safety of a transaction; or user conduct. Users must still conduct their own due diligence (viewing, paperwork, contracts, legal advice) before entering any transaction.

5. Data Protection

Processing of verification data is subject to our Privacy Policy. For the processing of identity document data (special category / biometric data), please refer to Section 3 of the Privacy Policy.

6. Agent / Business Verification

Agents and business users are subject to additional verification requirements including proof of Cyprus Real Estate Agent licence (Law L.71(I)/2010) where applicable. See the Agent / Business Code of Practice for full requirements.

SECTION 7: FEES, PAYMENTS & REFUND POLICY

Last updated: 17/06/2026

This policy sets out the fees for using MY ESTIACY's paid features, how payments are processed, and our refund rules.

1. Free Features

The following are always free:

• Creating an account and setting up a profile
• Browsing and searching all listings
• Posting up to 5 standard listings (active for 30 days each, renewable for free)
• Profile page
• Basic analytics
• Basic profile badge, where available
• Community support
• Receiving messages via Platform messaging
• Basic identity verification

"Basic identity verification" (listed as a free feature above) means email and/or phone number confirmation only. This does not include government ID verification and does not grant an 'Identity Verified' badge. Where government ID verification via IDAnalyzer is enabled, the 'Identity Verified' badge is free to complete but is a separate, higher-tier process that may be required to access certain features such as messaging other users or posting listings.

2. Paid Features

2.1 Listing Visibility

2.2 Seeker Premium

2.3 Landlord Pro Subscriptions

2.4 Agent Pro Subscriptions

2.5 Expert Services (Not Available at Launch)

MY ESTIACY is not currently VAT-registered in Cyprus. While our taxable supplies remain below the statutory registration threshold of €15,600 (rolling 12-month basis) under Cyprus VAT Law 95(I)/2000, prices shown are not subject to Cyprus VAT and are payable as displayed. Once we cross the registration threshold (or register voluntarily), prices will be updated to reflect VAT at the then-applicable rate (currently 19%), VAT receipts/invoices will be issued in compliance with Cyprus VAT Law 95(I)/2000, and this section will be updated accordingly. MY ESTIACY reserves the right to change pricing. Any price changes will be communicated to users in advance and will not affect active subscriptions until their next renewal.

3. VAT

MY ESTIACY is not currently VAT-registered in Cyprus. Until we cross the statutory registration threshold of €15,600 (rolling 12-month basis) under Cyprus VAT Law 95(I)/2000, prices shown are not subject to Cyprus VAT and are payable as displayed; we issue payment receipts but not VAT invoices. Once VAT-registered (whether by reaching the threshold or by voluntary registration), prices displayed to consumers will be inclusive of Cyprus VAT at the then-applicable rate (currently 19%), prices to VAT-registered business users may be shown excluding VAT with VAT added separately, and valid VAT invoices/receipts will be issued for all purchases. This section will be updated when our VAT status changes.

4. Payment Processing

Payments are processed by Stripe, our third-party payment provider. We do not store your full card number or CVV. By submitting payment details, you authorise the relevant charge. All transactions are in Euros (EUR).

5. Consumer Right of Withdrawal (14-Day Cooling-Off Period)

If you are a consumer (non-business user) resident in the EU/EEA, you have a statutory right to withdraw from a digital service contract within 14 days of purchase, under Directive 2011/83/EU (Article 9) as implemented in Cyprus.

Exception — Immediate delivery: For Boost and Featured Listing services, where you expressly request that the service begin immediately upon purchase, you acknowledge that you lose your right of withdrawal once the service is fully performed. By completing the purchase of an immediately-delivered service, you expressly consent to immediate delivery and waive your withdrawal right upon full performance. This waiver will be clearly confirmed at the point of purchase.

For subscriptions and other services not yet delivered, you may withdraw within 14 days of the purchase date by contacting [email protected].

6. Automatic Renewal

Subscription plans (Landlord Pro, Agent Pro, Seeker Premium, Expert Plus) renew automatically at the end of each billing period (monthly or as specified) unless cancelled. We will send you a reminder email at least 7 days before renewal. You can cancel at any time through your account settings. Cancellation takes effect at the end of the current billing period — you will retain access until that date.

7. Refund Policy

7.1 Boosts and Featured Listings: No refund once activated or delivered, except where required by mandatory law or where MY ESTIACY is at fault (e.g., the service was not delivered as described).

7.2 Subscriptions: Cancellation stops future renewals. No partial refunds for the current billing period unless required by law or granted at MY ESTIACY's discretion for exceptional circumstances (e.g., billing error, prolonged platform outage).

7.3 Expert Services (not available at launch): Expert Consultation, Document Review, and Relocation Pack services are not offered at launch. This section will be updated and a dedicated Expert Services sub-Terms will be published before any expert service is enabled, setting out the qualifications of the experts, the role and liability of MY ESTIACY as facilitator, the professional indemnity arrangement of the expert, the complaints route, and the refund/cancellation policy.

7.4 Account suspension / removal for breach: If MY ESTIACY suspends or removes your account for a breach of our Terms or policies, paid fees are generally non-refundable. This does not affect your statutory rights.

7.5 Statutory rights: Nothing in this Refund Policy limits your statutory consumer rights under Cyprus or EU law. If you believe you are entitled to a refund under law, contact [email protected] with your order reference, purchase date, and reason for the request.

8. Refund Requests

To request a refund, contact [email protected] with your order reference, purchase date, and reason for the request. We will respond within 5 business days.

SECTION 8: SAFETY & SCAM PREVENTION POLICY

Last updated: 17/06/2026

MY ESTIACY is a marketplace that connects landlords/sellers with tenants/buyers and flatmates with flatmates. We do not take part in transactions. This page explains how to use the platform safely, how scams typically work, and what we do when something is reported.

1. The Reality: Risks Exist

Most users are genuine. Some are not. Even where identity verification and property verification measures are used, no platform can guarantee that every listing or user is legitimate. Your safety and due diligence matter.

2. The Five Golden Rules

If you follow only five rules, follow these:

• View before paying. Never send a deposit or rent/payment before you've seen the property/room and confirmed details in person.
• Verify authority. Confirm the person advertising has the right to rent/sell — ask for proof (title deed, authorisation letter).
• Be suspicious of "too good to be true." Unrealistically low prices are a classic scam signal.
• Keep proof. Keep messages, receipts, and written agreements.
• Report fast. The sooner you report, the easier it is to take action.

3. Common Scams and How to Spot Them

3.1 "Owner abroad / keys will be posted": They claim to be overseas and ask you to pay before viewing. Never pay without viewing. Insist on a physical viewing and proof of ownership/authority.

3.2 Deposit-first pressure: "Many people are interested — pay now to reserve." High-pressure urgency is a red flag. Legitimate landlords do not require payment before you've viewed and agreed in writing.

3.3 Fake photos / stolen listings: Photos copied from other websites or other listings. Do a reverse image search. Ask for a video call tour. Ask for a specific photo (e.g., "today's date on a piece of paper in the kitchen").

3.4 Fake agent / fake landlord: They pretend to be an agent or owner. Request proof of identity and authority. Ask to see the title deed. For agents, ask for their Cyprus Real Estate Agent licence number and verify it with the competent Cyprus real estate agent registration authority.

3.5 Upfront fee scams: Fake "application fees", "credit check fees", or "insurance deposit" requests before you have even viewed a property. Legitimate landlords and agents do not typically charge upfront admin fees before a viewing.

3.6 Overpayment scams (targeting landlords/sellers): A "tenant" sends a cheque/bank transfer for more than the agreed amount and asks you to return the difference. The original payment will bounce. Never refund overpayments to unknown parties.

4. What MY ESTIACY Does to Protect You

• Identity verification: Where enabled, we verify user identities via a third-party provider to reduce fake accounts.
• Property verification measures: We implement checks to reduce fake or misleading listings.
• Scam detection: We use automated signals to flag suspicious listing patterns and account behaviour.
• Reporting tools: Easy-to-use reporting tools on every listing and profile.
• Fast takedowns: We aim to act on credible scam reports promptly.
• Scam warnings: We display safety reminders at key points in the user journey.

5. Reporting a Scam or Suspicious Listing

If you suspect a scam or see a suspicious listing:

• Use the "Report" button on the listing or user profile
• Email us at: [email protected]
• If you have lost money to a scam, report it to the Cyprus Police (dial 1460 for financial crime)

We take all reports seriously. We do not share reporter identity with the reported user.

6. Our Limits

MY ESTIACY is not a party to transactions between users. We cannot: recover money already paid to a third party; act as police or investigators; guarantee outcomes of reports; or be held liable for losses arising from scams between users. We strongly advise using Platform messaging (which creates a record) and never transacting outside the Platform where avoidable.

7. Tax and Money Laundering

We remind all users that transactions must comply with applicable tax law (see Terms & Conditions, Section 17). If you become aware of or suspect money laundering activity in connection with a property transaction, you should report it to MOKAS (the Cyprus Unit for Combating Money Laundering, Tel: +357 22805905, Email: [email protected]) or your legal adviser.

SECTION 9: REPORTING, TAKEDOWN & COMPLAINTS PROCEDURE

Last updated: 17/06/2026

This page explains how to report content or users, how we handle takedown requests, and how to make a formal complaint.

1. Reporting Content or Users

1.1 How to report: You can report a listing, user, or message by:

• Clicking the "Report" button on any listing or user profile on the Platform
• Emailing [email protected] with details of the issue
• For urgent matters (e.g., imminent harm, active fraud): mark your email "URGENT"

1.2 What to include:

• The URL or reference number of the listing/user being reported
• The nature of the issue (e.g., fake listing, scam, discriminatory content, copyright infringement)
• Any supporting evidence (screenshots, messages, etc.)

We do not share reporter identity with the reported user.

2. Illegal Content Reporting — EU Digital Services Act (DSA) Channel

Under the EU Digital Services Act (Regulation (EU) 2022/2065, Article 16), online platforms must provide a mechanism for reporting illegal content. MY ESTIACY's dedicated channel for reporting illegal content is:

Email: [email protected] Subject line: "DSA — Illegal Content Report"

Please include: description of the content, URL/reference, and why you believe it is illegal under applicable law.

We will acknowledge receipt and assess the report in accordance with our obligations under the DSA. We will notify the reporter of the outcome of our decision (including any action taken or reasons for not acting) without undue delay.

MY ESTIACY's single point of contact for EU authorities under DSA Article 11 is: [email protected]

This contact is linked from the Platform's footer and from the Contact Us page (Section 17) to ensure it is accessible to authorities and users at all times.

MY ESTIACY is not currently designated as a Very Large Online Platform (VLOP) under the DSA (threshold: 45 million monthly active EU users). This status is formally assessed annually as the Platform grows. If VLOP status is reached, additional obligations under DSA Articles 33–43 will apply, including annual risk assessments, independent audits, and data access obligations for researchers.

3. Copyright and IP Takedown Requests

For copyright or intellectual property infringement reports, see the Copyright, IP & Photo Takedown Policy (Section 10). Copyright takedown requests should be sent to: [email protected].

4. How We Handle Reports — Our Process

On receiving a report we will:

• Acknowledge receipt (for emailed reports) within 2 business days
• Assess the report against our Terms, Listing Rules, and applicable law
• Take action where appropriate — which may include: removing or editing the content; issuing a warning to the user; suspending or terminating the account; or referring the matter to authorities
• Notify the reporter of the outcome, to the extent we are able to do so

We act as promptly as possible. Urgent/safety reports are prioritised.

5. Actions We May Take

• Content removal: Delete or hide a listing, message, photo, or other content
• Listing edit: Require the user to correct inaccurate content
• Warning: Issue a formal warning to a user's account
• Feature restriction: Restrict a user's ability to post, message, or use paid features
• Account suspension: Temporarily suspend an account pending investigation
• Account termination: Permanently remove an account for serious or repeated breaches
• Authority referral: Report matters to Cyprus police, MOKAS, or other relevant authorities

6. Appeals — If You Believe Action Was Taken Against You Unfairly

If your listing or account has been removed or restricted and you believe this was done in error or unfairly:

• Email [email protected] with the subject "APPEAL — [your account reference]"
• Include: your account details, the action taken, and your reasons for the appeal
• We will review your appeal within 5 business days and respond with our decision

Appeals are reviewed by a team member who was not involved in the original decision where possible.

7. Formal Complaints Procedure

7.1 Step 1 — Contact Support: Email [email protected] with your complaint. We aim to resolve most issues within 5 business days.

7.2 Step 2 — Escalation: If your complaint is not resolved to your satisfaction at Step 1, request escalation to a senior team member. We will respond within 10 business days.

7.3 Step 3 — External Resolution: If your complaint remains unresolved, you may:

• Contact the Cyprus Consumer Protection Service (for consumer complaints): www.mcit.gov.cy
• Refer the matter to the Cyprus Consumer Protection Service: https://meci.gov.cy/en/services/consumer-protection-service (the EU ODR platform was discontinued on 20 July 2025)
• Pursue the matter through the courts of Cyprus

For data protection complaints, you may contact the Cyprus Commissioner for Personal Data Protection: www.dataprotection.gov.cy

DSA Article 17 — Statement of Reasons. Where we remove or restrict access to a listing, restrict your account or paid features, suspend or terminate your account, or demote a listing’s visibility on grounds related to content moderation, we will provide you with a clear and specific statement of reasons in accordance with Article 17 of EU Regulation 2022/2065 (Digital Services Act). The statement will set out: (a) whether the decision affects visibility, access, monetisation, or account status; (b) the facts and circumstances relied on; (c) where applicable, the use of automated means; (d) the legal or contractual ground (specific Term, Listing Rule, or law); (e) the redress options including internal appeal under our complaints procedure, out-of-court dispute settlement under Article 21 DSA, and judicial remedy. We submit qualifying statements of reasons to the Commission’s DSA Transparency Database.

DSA Article 20 — Internal complaint-handling system for content moderation decisions. For complaints challenging a content-moderation decision (removal, demotion, restriction of a listing, suspension of an account, or refusal to act on a notice), we operate a free, electronic, internal complaint-handling system. Complaints are handled by qualified staff who did not make the original decision and who have the authority to reverse it. We respond within a reasonable time and in any event without undue delay. We will not rely on automated means alone to decide such complaints. You retain the right to out-of-court dispute settlement under Article 21 DSA via a certified body, and judicial remedy.

8. Business Users — P2B Regulation

Business users (agents, landlords with multiple listings) have additional rights under EU Regulation 2019/1150 on promoting fairness and transparency for business users of online intermediation services (P2B Regulation). This includes the right to:

• Receive a clear explanation of ranking parameters (see Terms & Conditions, Clause 20)
• Access our internal complaint-handling system (this procedure)
• Be informed of material changes to these Terms with at least 15 days' notice

Business users may also contact us via the P2B complaint route at: [email protected].

9. Law Enforcement and Authority Requests

9.1 Handling requests from authorities: MY ESTIACY may receive requests for user data or content from law enforcement agencies, courts, regulatory authorities, or other government bodies. We handle such requests as follows:

• We verify the identity and authority of the requesting body before disclosing any information
• We disclose personal data to law enforcement only where required by applicable law or a valid legal order (court order, subpoena, regulatory notice)
• Where permitted by law, we will notify the affected user before disclosing their data
• We maintain a log of all authority requests received and actions taken, in accordance with our GDPR accountability obligations
• We do not disclose more data than is strictly required to comply with the legal obligation

9.2 Preservation requests: Where we receive a valid legal order to preserve data (e.g., pending investigation), we will preserve the relevant data for the period specified, even if it would otherwise be deleted under our standard retention schedule.

9.3 Escalation and legal review: All authority requests are reviewed by a designated responsible person before any data is disclosed. Requests of uncertain validity are referred for legal advice before action is taken.

9.4 Transparency: To the extent permitted by law, we will publish aggregate statistics on authority requests received (e.g., in an annual transparency report) as part of our commitment to user trust and accountability.

9.5 Crisis management: In the event of a serious incident (major data breach, significant fraud event, or legal proceedings), MY ESTIACY will:

• Convene an internal response team immediately
• Follow our data breach notification procedure (see Privacy Policy Section 10) where personal data is involved
• Preserve all relevant evidence and records
• Cooperate with the Cyprus Commissioner for Personal Data Protection, Cyprus Police, and other relevant authorities as required
• Communicate with affected users as soon as practicable, subject to any legal restrictions on disclosure

SECTION 10: COPYRIGHT, IP & PHOTO TAKEDOWN POLICY

Last updated: 17/06/2026

1. Ownership of Platform IP

All intellectual property rights in and to the MY ESTIACY Platform — including the brand, name, logo, design, software code, databases, algorithms, and compiled content — are owned by or licensed to the operator of MY ESTIACY (currently Miltos Ioannidis as sole trader; rights will transfer to ESTIACY LTD upon incorporation). Nothing in these Terms grants you any rights in the Platform IP other than the limited right to use the Platform for its intended purpose.

2. Your Content — Your Ownership, Our Licence

You retain all ownership rights in the Content you post (listings, photos, text, etc.). By posting Content on the Platform, you grant MY ESTIACY a worldwide, non-exclusive, royalty-free, sub-licensable licence to: host, store, reproduce, and display the Content on the Platform; create thumbnails and optimised versions of your photos; use Content in marketing and promotional materials for the Platform (you may opt out by contacting support). This licence ends when you delete the Content or close your account (subject to any retention obligations).

3. Copyright Rules for All Users

• Only upload photos, videos, and text that you own, took yourself, or have written permission to use.
• Do not copy or re-use photos from other listings, other websites, or third-party sources without clear permission.
• Do not use AI-generated images that mimic real properties in a misleading way.
• Do not reproduce copyrighted written content (e.g., property descriptions from agents) without permission.

4. Photo Takedown Requests

If you believe a photo posted on MY ESTIACY infringes your copyright, please submit a takedown request to:

Email: [email protected] Subject: "Photo Takedown Request"

Your request must include:

• Your name and contact information
• Identification of the copyrighted work you claim is infringed
• URL/reference of the infringing photo on our Platform
• A statement that you have a good-faith belief the use is not authorised by the copyright owner
• A statement that the information in your notice is accurate
• Your signature (electronic is acceptable)

We will acknowledge receipt within 2 business days and act on valid requests promptly. If a counter-notice is received from the user who posted the photo, we will notify you and may restore the content.

5. Trademark

The MY ESTIACY name, logo, and associated marks are trademarks of the operator of MY ESTIACY (currently Miltos Ioannidis as sole trader; trademark rights will transfer to ESTIACY LTD upon incorporation). You must not use them without our written permission.

5A. No Misleading Use of MY ESTIACY Name or Branding

Users must not use the MY ESTIACY name, logo, badge, or branding in any listing, message, image, or external communication in a way that suggests endorsement, approval, partnership, verification, or guarantee unless MY ESTIACY has expressly authorised this in writing.

6. No Scraping / No Data Mining

You must not use any automated tool (spider, bot, scraper, crawler) to extract or replicate content or data from the Platform — including for AI training, competitive analysis, or building derivative products — except where we have given written authorisation. Breach of this rule may result in account termination and legal action.

7. DMCA / EU Copyright Directive

MY ESTIACY operates under the principles of notice-and-takedown consistent with the EU Directive on Copyright in the Digital Single Market (2019/790/EU) and the EU E-Commerce Directive (2000/31/EC). We respond to valid takedown notices promptly and do not facilitate or encourage copyright infringement.

SECTION 11: EQUAL OPPORTUNITIES & ANTI-DISCRIMINATION POLICY

Last updated: 17/06/2026

1. Our Commitment

MY ESTIACY is committed to providing a platform that is fair, safe, and accessible to all users, regardless of their protected characteristics. We do not tolerate discrimination in any form — including in how listings are posted, how users interact, or how the Platform is operated.

2. Protected Characteristics

Under Cyprus law (including the Equal Treatment in Employment and Occupation Law 58(I)/2004, the Combating of Racial and Some Other Forms of Discrimination Law 59(I)/2004, and EU Directives 2000/43/EC and 2000/78/EC) and applicable EU law, the following characteristics are protected:

• Race, ethnicity, or national origin
• Religion or belief
• Sex / gender
• Sexual orientation
• Gender identity or expression
• Age
• Disability
• Pregnancy or maternity
• Marital or civil partnership status
• Family status

3. What Is and Is Not Allowed in Listings

3.1 Prohibited:

• Stating or implying preferences for or against tenants/buyers based on any protected characteristic
• Using coded or indirect language that effectively discriminates (e.g., "professionals only" used as a pretext for excluding certain groups)
• Refusing to respond to, or blocking, users based on protected characteristics
• Advertising properties as "not suitable for" any protected group

3.2 Permitted:

• Listing a property as suitable for specific uses (e.g., non-smoking, pet-friendly) — these are property features, not personal characteristics
• Flatmate preferences related to lifestyle compatibility (e.g., "quiet household", "no smoking indoors") — where not used as a pretext for discrimination
• Single-sex shared accommodation where genuinely justified for privacy and dignity reasons, on a case-by-case proportionality basis under general EU anti-discrimination principles (genuine occupational/situational requirement). This is not relied on as an express statutory exception under Cyprus law.

If you are unsure whether a listing description is acceptable, contact us before posting.

4. Reporting Discrimination

If you believe you have experienced or witnessed discrimination on the Platform, report it via:

• The "Report" button on the relevant listing/profile, or
• Email: [email protected] — subject: "Discrimination Report"

We will investigate all credible reports and take appropriate action including warning, restriction, or account removal.

5. Accessibility

We are committed to making the Platform accessible to users with disabilities. See our Accessibility Statement (Section 13) for details of our current conformance and improvement plans.

6. Internal Equal Opportunities (MY ESTIACY as an Employer)

MY ESTIACY is an equal opportunities employer. We do not discriminate in hiring, promotion, pay, or any other employment decisions based on any protected characteristic. All job applications are assessed on merit. See our Jobs page for current opportunities. All applicants are subject to our Candidate Privacy Notice.

SECTION 12: AGENT / BUSINESS CODE OF PRACTICE

Last updated: 17/06/2026

This Code of Practice applies to agents, agencies, property managers, developers, and any professional/business users ("Agents") using MY ESTIACY. It supplements our Terms & Conditions and Listing Rules. We welcome Agents, but Agents have higher obligations because they advertise at scale and influence platform trust.

1. Who Counts as an Agent

You are an Agent/Business user if you:

• Advertise properties/rooms on behalf of owners/landlords/sellers
• Operate a letting or sales business
• Provide property management services
• Run a "rent-to-rent" / guaranteed rent / subletting business model
• Advertise multiple properties commercially as part of a business

Simple rule: If you are not the owner and you are advertising for someone else as a service, you must register as an Agent/Business user.

2. Registration and Transparency

2.1 Correct account type: Agents must register as Agent/Business and must not register as a private landlord/seller.

2.2 Business identity: You must provide accurate business details including: legal/trading name; business contact details; authorised representative name; and any licensing or registration details required by Cyprus law.

2.3 Cyprus Real Estate Agent Licence: If you are practising as a real estate agent in Cyprus, you must hold any licence, registration, or authorisation required under applicable Cyprus real estate agency law. You must:

• Include your Cyprus real estate agent licence number in your agent profile on MY ESTIACY
• Ensure your licence is current and renewed as required by law
• Not operate under an expired or suspended licence

We reserve the right to request proof of licence and to suspend or remove accounts where a valid licence cannot be confirmed.

2.4 Authority to advertise: You must have written authority from the owner/landlord/seller for each listing you post and must provide proof if requested.

3. Listing Standards for Agents

3.1 No generic listings: Listings must represent a specific, identifiable property and not a general "we have many units" advertisement, unless MY ESTIACY offers a dedicated projects/new developments product.

3.2 No duplicates / no spam: Do not post multiple ads for the same property. Do not spam the Platform with bulk listings that are not genuine or current.

3.3 Accurate and current: Agents must keep listings up to date. Remove or update listings immediately when: the property is let/sold; the price changes; availability changes; or the authority to advertise ends.

3.4 Fee transparency: Any agent fees or commissions charged to tenants or buyers must be disclosed clearly in the listing. Hidden fees are prohibited.

4. Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF)

This section applies to all Agent/Business users and any user involved in property sale transactions.

4.1 Legal obligation: The real estate sector is a designated high-risk sector under the Cyprus Prevention and Suppression of Money Laundering Activities Laws 188(I)/2007 to 2022 (implementing EU AMLD4, AMLD5, and AMLD6). Cyprus-licensed real estate agents are "obliged entities" under this legislation and must comply with all applicable AML/CTF obligations including customer due diligence (CDD), enhanced due diligence (EDD) for high-risk transactions, suspicious transaction reporting, and record keeping.

4.2 Platform obligations: MY ESTIACY is a platform and is not itself a licensed real estate agent. However:

• We support compliance by requiring agent licence verification
• We may suspend listings or accounts where we have reasonable grounds to suspect money laundering or financial crime
• We may report suspicious activity to MOKAS where we consider this appropriate

4.3 Agent responsibility: As an Agent using this Platform, you confirm that:

• You are aware of and comply with your AML/CTF obligations under Cyprus law
• You conduct customer due diligence on your clients as required by law
• You maintain required AML records and have an AML compliance programme in place
• You will report suspicious transactions to MOKAS as required by law
• You will not use this Platform to facilitate or assist money laundering or financial crime in any form
• You maintain AML/CTF records for a minimum of five years from the date of the transaction or the end of the business relationship, as required by Cyprus Prevention and Suppression of Money Laundering Activities Laws 188(I)/2007 to 2022.

4.4 Cash transactions: Under Cyprus law and EU AML regulations, cash payments above EUR 10,000 in a single transaction (or linked transactions) require enhanced due diligence and reporting. As an agent, you are prohibited from facilitating cash transactions above these thresholds without completing required AML checks.

4.5 MOKAS contact: MOKAS — Unit for Combating Money Laundering Tel: +357 22805905 Email: [email protected] Website: www.mokas.law.gov.cy

4A. Listings via Feeds, APIs, and Integrations

Where listings are uploaded manually, by bulk import, API, XML feed, CSV feed, channel manager, property management software, or any other integration, the advertiser remains fully responsible for ensuring that all listing information is accurate, current, lawful, and promptly updated. The use of an upload method, feed, or integration does not transfer responsibility for listing accuracy to MY ESTIACY.

5. VAT and Tax Obligations

Agents are reminded that they are solely responsible for their own VAT and tax compliance. If you are a VAT-registered business making taxable supplies of agency services or lettings (where applicable), you must: account for VAT at the applicable rate (currently 19% standard rate in Cyprus); issue valid VAT receipts/invoices to clients; and comply with Cyprus VAT Law 95(I)/2000 and all related regulations. MY ESTIACY bears no responsibility for your tax or VAT compliance.

6. Professional Indemnity Insurance

We strongly recommend that all Agent/Business users maintain adequate professional indemnity (PI) insurance appropriate to the nature and scale of their business. Where Cyprus law or a client contract requires PI insurance, agents must ensure it is in place. MY ESTIACY does not verify PI insurance but reserves the right to require evidence of cover for high-volume accounts.

7. User Reviews and Ratings

Agents may be subject to ratings and reviews from users. Reviews must reflect genuine experiences. Agents must not: solicit fake positive reviews; pressure users to remove negative reviews; or post fake negative reviews about competitors. We will remove reviews that are clearly defamatory, false, or in breach of these rules. Agents may respond to reviews publicly.

8. Enforcement

Breaches of this Code by Agents may result in: formal warning; listing removal; account suspension or termination; and/or referral to relevant authorities (including the competent Cyprus real estate agent registration authority, Cyprus Police, or MOKAS). Serious or repeated breaches will result in permanent removal from the Platform.

SECTION 13: ACCESSIBILITY STATEMENT

Last updated: 17/06/2026

1. Our Commitment

MY ESTIACY is committed to making our Platform accessible to as many users as possible, including those with disabilities. We aim to meet the requirements of the Web Content Accessibility Guidelines (WCAG) 2.1 at Level AA, consistent with the EU Web Accessibility Directive (Directive 2016/2102/EU) and its principles of perceivability, operability, understandability, and robustness.

2. Current Conformance Status

This website is partially conformant with WCAG 2.1 level AA. We are actively working toward full conformance in line with our obligations under the European Accessibility Act (Directive 2019/882/EU), which came into full effect on 28 June 2025. A formal accessibility audit is in progress and this section will be updated with specific findings.

3. Known Accessibility Issues

We are aware that some interactive elements may not be fully accessible via screen reader, and some colour contrast ratios on legacy UI components may fall below the 4.5:1 minimum. These are being addressed in our ongoing development sprints.

4. Features to Aid Accessibility

We have implemented or aim to implement the following features:

• Semantic HTML and ARIA labels throughout the Platform
• Sufficient colour contrast ratios (minimum 4.5:1 for normal text)
• Keyboard navigability for all interactive elements
• Alt text for all non-decorative images
• Responsive design that works on mobile, tablet, and desktop
• Resizable text without loss of functionality up to 200%
• No content that flashes more than 3 times per second

5. Feedback and Contact

If you experience accessibility barriers on our Platform or need content in an alternative format, please contact us:

• Email: [email protected]
• Subject: "Accessibility Feedback"

We will acknowledge your feedback within 2 business days and aim to resolve issues or provide reasonable accommodations as promptly as possible.

6. Enforcement

If you are not satisfied with our response to an accessibility complaint, you may contact the relevant enforcement authority. In Cyprus, web accessibility for public sector bodies is overseen by the Deputy Ministry of Research, Innovation and Digital Policy.

The European Accessibility Act (Directive 2019/882/EU), which came into full legal effect on 28 June 2025, applies to digital services including platforms such as ours.

Micro-enterprise exemption: Under Article 4(3) of the EAA, microenterprises — defined as businesses with fewer than 10 employees AND an annual turnover or balance sheet total not exceeding EUR 2 million — may be exempt from the full accessibility requirements for services. MY ESTIACY is currently operating at a scale that may qualify for this exemption. We will formally document our status and any reliance on this exemption. As the Platform grows and if we exceed the micro-enterprise thresholds, we will ensure full EAA compliance.

Accessibility roadmap: We commit to the following steps:

1. Complete a formal WCAG 2.1 AA audit within 6 months of launch
2. Publish audit findings and a remediation plan on this page
3. Address critical accessibility barriers identified in the audit within 3 months of findings
4. Reassess micro-enterprise status and EAA obligations annually
5. Conduct an annual accessibility review thereafter

SECTION 14: FAQ / HELP CENTRE

Last updated: 17/06/2026

Can't find what you're looking for? Contact us at [email protected].

General

What is MY ESTIACY? A Cyprus-focused property and flatmate marketplace where you can rent, buy, sell, find a room, or find a flatmate. See About MY ESTIACY for full details.

Is MY ESTIACY a real estate agency? No. We are a marketplace platform. We connect users but we are not a party to any transaction. We do not hold a real estate agency licence and do not provide agency services.

Is MY ESTIACY free to use? Browsing, searching, creating an account, and posting a standard listing are free. Paid features (Featured Listings, Boosts, Pro/Agency subscriptions) are optional and are described in our Fees, Payments & Refund Policy.

What countries/areas does MY ESTIACY cover? Currently, the Republic of Cyprus only. We may expand in future.

Account & Registration

How do I create an account? Click "Sign up" on the homepage. Provide your name, email, and password. Verify your email address via the confirmation link we send you.

I forgot my password. What do I do? Click "Forgot password" on the sign-in page and follow the instructions sent to your registered email.

Can I sign in with Google or Apple? Yes, if enabled. When you sign in via a third-party provider, we receive your name and email from them. See our Privacy Policy for full details.

How do I close my account? Go to Account Settings > Privacy > Delete Account. Or email [email protected]. Account deletion is subject to our data retention policy (we keep certain records for legal/audit reasons — see the Privacy Policy).

Verification

Basic identity verification (free): Email and/or phone number confirmation only. This does not grant an 'Identity Verified' badge.

Identity Verified badge: Where this feature is enabled, the Identity Verified badge requires submitting a government-issued ID (passport, national ID card, or driver's licence) through our third-party provider IDAnalyzer and completing a liveness check. This tier may be required to message other users or post listings. It is free to complete.

Why should I verify my identity? Where identity verification is enabled, verified users can build trust. Other users may be more likely to respond to and engage with verified profiles. Verification also helps reduce scam risk for everyone on the Platform.

Is identity verification mandatory? Where identity verification is enabled, full identity verification may be required for certain features, such as messaging or posting listings. We may make verification mandatory for additional features in future.

Listings

How do I post a listing? Sign in, click "Post a listing", select the listing type (rent, sale, room, flatmate), fill in the details, upload photos, and publish.

Does my listing need an EPC (Energy Performance Certificate)? Yes — under Cyprus law (Energy Performance of Buildings Law 142(I)/2006), all properties offered for rent or sale must have a valid EPC. You must include the EPC rating in your listing. This is a legal requirement, not just our rule. See Listing Rules Section 4 for details.

How long does a listing stay active? Standard listings are active for 30 days and can be renewed for free. Boosted and Featured listings follow the duration of the purchased promotion (7, 14, or 30 days). Expired listings can be reactivated from your dashboard.

Can I list a property I don't own? Only if you are authorised — e.g., a licensed agent, property manager, or authorised representative. You must have written authority and must register as an Agent/Business user. Misrepresenting yourself as a private owner is a breach of our Terms.

Can I list a room in a property I'm renting? Only if your tenancy agreement allows subletting or taking in flatmates. Check with your landlord first. Subletting without permission may be illegal and is a breach of our Listing Rules.

Safety & Scams

I think a listing is fake. What should I do? Use the "Report" button on the listing, or email [email protected]. Include as much detail as possible. See our Safety & Scam Prevention Policy for guidance.

I've been scammed. What should I do?

1. Report to us: [email protected].
2. Report to Cyprus Police: dial 1460 (financial crime) or 112 (emergency).
3. If you made a payment by bank transfer: contact your bank immediately to attempt a recall.
4. Keep all evidence (messages, receipts, screenshots).

Is it safe to pay a deposit before viewing? No. Never pay any amount before you have physically viewed the property, confirmed the advertiser's identity and authority, and have a written agreement. Paying before viewing is the single most common way people lose money to property scams.

Fees & Payments

How do I pay for a Featured Listing or Boost? From your listing or dashboard, select the feature you want and follow the payment steps. Payments are processed securely by Stripe.

Can I get a refund? See our Fees, Payments & Refund Policy for full details. In summary: Boosts and Featured Listings are non-refundable once activated. Subscriptions can be cancelled to stop renewal but are not partially refunded. Exceptions apply for billing errors and mandatory consumer rights.

Do you charge VAT? Not at present. MY ESTIACY is not currently VAT-registered in Cyprus and operates below the €15,600 rolling 12-month statutory threshold. Prices shown are payable as displayed. Once we reach the threshold (or register voluntarily), prices to consumers will become VAT-inclusive at the then-applicable rate (currently 19%) and valid VAT receipts will be issued.

Privacy & Data

How is my personal data used? See our Privacy Policy for full details. In summary: we use your data to provide the Platform, verify your identity, enable messaging, process payments, and improve the service. We do not sell your data.

How do I request my data or ask for it to be deleted? Email [email protected] with your request. We will respond within one month. See the Privacy Policy (Section 14 — Your Rights) for full details of your GDPR rights.

Note on erasure requests: Some data cannot be deleted immediately due to legal retention obligations (e.g., payment records, verification metadata). See Privacy Policy Section 14 for the full list of erasure exceptions.

Who is the Cyprus data protection authority? Office of the Commissioner for Personal Data Protection, 1 Iasonos Street, 1082 Nicosia. Tel: +357 22818456. www.dataprotection.gov.cy.

Disputes

I have a dispute with another user. Can MY ESTIACY help? We can take action against users who breach our Terms (e.g., remove listings, suspend accounts). We cannot resolve contractual disputes between users or recover money. For contractual disputes, seek legal advice or contact the Cyprus Consumer Protection Service (www.mcit.gov.cy).

How do I make a formal complaint about MY ESTIACY? See our Reporting, Takedown & Complaints Procedure (Section 9). Start by emailing [email protected]. Unresolved complaints may be escalated to the Cyprus Consumer Protection Service: https://meci.gov.cy/en/services/consumer-protection-service. The previous EU ODR platform was discontinued on 20 July 2025.

SECTION 15: BLOG / INFO & ADVICE — EDITORIAL POLICY

Last updated: 17/06/2026

1. Purpose

The MY ESTIACY Blog and Info & Advice section provides general guidance, tips, market updates, and helpful information related to renting, buying, selling, and flatsharing in Cyprus. It is produced by the MY ESTIACY team and selected contributors.

2. Editorial Disclaimer — Important

Important Notice: All content published in the MY ESTIACY Blog and Info & Advice section is for general information and educational purposes only. It does not constitute legal advice, financial advice, investment advice, surveying advice, or any other form of professional advice. Property transactions involve significant financial and legal complexity. Before entering any rental agreement, purchase contract, or other property transaction, you should obtain independent legal and/or financial advice from a qualified professional.

While we make reasonable efforts to ensure accuracy, MY ESTIACY does not guarantee that blog content is complete, accurate, current, or applicable to your specific circumstances. Laws and market conditions change. Always verify information from authoritative sources.

MY ESTIACY accepts no responsibility or liability for any reliance placed on information published in the Blog or Info & Advice section.

3. Copyright in Blog Content

All blog articles, guides, and editorial content published by MY ESTIACY are protected by copyright and belong to the operator of MY ESTIACY (currently Miltos Ioannidis as sole trader; copyright will transfer to ESTIACY LTD upon incorporation). You may share links to blog content and quote brief excerpts (no more than 50 words) with attribution, but may not reproduce articles in full without our written permission.

4. Third-Party Links

Blog articles may contain links to third-party websites for reference purposes. MY ESTIACY does not endorse third-party websites, their content, products, or services. We are not responsible for the content or availability of third-party sites. Clicking external links is at your own risk.

5. User Comments Policy

If user comments are enabled on blog posts:

• Comments must be relevant, respectful, and not in breach of our Terms & Conditions
• We reserve the right to moderate, edit, or remove comments at our discretion
• Comments that are defamatory, abusive, discriminatory, spam, or illegal will be removed
• Commenters retain copyright in their comments but grant MY ESTIACY a licence to display them on the Platform
• Comments may be personal data subject to our Privacy Policy

6. Corrections and Updates

We aim to correct factual errors promptly. If you believe an article contains a factual error, please contact us at [email protected] with the subject "Blog Correction Request" and details of the error.

SECTION 16: JOBS

Last updated: 17/06/2026

1. Working at MY ESTIACY

MY ESTIACY is building a property marketplace for Cyprus. As we grow, we are building a small, focused team. We value people who are practical, curious, and genuinely interested in making the property experience better for everyone.

There are no open positions at this time. Check back soon or send a speculative application to [email protected].

2. Equal Opportunities

MY ESTIACY is an equal opportunities employer. We do not discriminate in any employment decision on the basis of race, ethnicity, national origin, sex, gender, sexual orientation, age, disability, religion, marital status, or any other protected characteristic. All applications are considered on merit.

3. How to Apply

Unless otherwise stated in a specific job posting, please send your application to:

Email: [email protected] Subject: "[Role Title] Application — [Your Name]"

Include: CV/resume, a brief covering note explaining why you are interested and why you are a good fit.

4. Candidate Privacy Notice (GDPR Article 13)

Data Controller: Miltos Ioannidis, trading as MY ESTIACY (sole trader; controller will transfer to ESTIACY LTD upon incorporation), Ioulianou 30, Ekali, 3111, Limassol, Cyprus. Privacy contact: [email protected].

What data we collect: Name, email address, phone number; CV / resume and covering letter; employment history and qualifications; information you voluntarily provide in interviews or correspondence.

Why we collect it and legal basis: We process application data to: assess your suitability for the role (legitimate interests / pre-contractual steps — GDPR Art. 6(1)(b) and (f)); keep records of the recruitment process (legitimate interests — GDPR Art. 6(1)(f)); and comply with employment law obligations (legal obligation — GDPR Art. 6(1)(c)).

Who we share data with: Application data is reviewed only by relevant hiring team members. We do not share it with third parties except: recruitment platform providers who host our job postings (as processors); and as required by law.

Retention: If your application is unsuccessful: we retain your data for 12 months after the end of the recruitment process, to allow us to consider you for future roles and to handle any complaint. After 12 months, your data is securely deleted. If your application leads to employment: your data is transferred to your personnel file, governed by our employee privacy notice.

Your rights: You have the right to access, rectify, erase, and object to processing of your application data. Contact [email protected]. You also have the right to lodge a complaint with the Cyprus Commissioner for Personal Data Protection (www.dataprotection.gov.cy).

SECTION 17: CONTACT US

Last updated: 17/06/2026

1. Contact Details

Note on Data Protection Officer: Based on our assessment under GDPR Article 37 and Cyprus Law 125(I)/2018, we are not currently required to appoint a Data Protection Officer. However, all data protection queries should be directed to: [email protected]. We will reassess this requirement as the platform scales and appoint a DPO if the threshold criteria are met.

2. Response Times

• General support enquiries: within 2 business days
• Formal complaints: we acknowledge within 2 business days; full response within 5 business days
• Data subject rights requests (GDPR): within one calendar month
• Copyright / IP takedown requests: acknowledged within 2 business days; actioned promptly
• DSA illegal content reports: acknowledged within 2 business days; assessed and acted upon without undue delay
• Urgent/safety matters: we aim to respond the same business day

3. Contact Form — Privacy Notice

When you submit an enquiry via our contact form or by email, we process the following personal data: your name, email address, and the contents of your message.

Legal basis: Legitimate interests (GDPR Art. 6(1)(f)) — responding to your enquiry and maintaining records. For data subject rights requests, processing is required to comply with our legal obligations (GDPR Art. 6(1)(c)).

Retention: Contact/support enquiry records are kept for 3 years from the date of resolution. Data subject rights request records are kept for 3 years. You may request deletion at any time by emailing [email protected].

Your rights: You have the right to access, rectify, and erase your data, and to object to processing. Contact [email protected].

4. Regulatory and Authority Contacts

SECTION 18: THIRD-PARTY TOOLS & DATA PROCESSORS

Last updated: 17/10/2026

MY ESTIACY uses third-party tools and services to operate, improve, and support the Platform. This page provides transparency about which tools we use, what they do, and how your data is handled in connection with each. All processors are bound by GDPR-compliant Data Processing Agreements (DPAs).

For the full legal treatment of data sharing with processors, see Section 3, Privacy Policy, heading 8: Third-Party Data Processors.

Note on processor list consistency: This list of third-party tools and data processors is kept in sync with the Privacy Policy (Section 3, Section 8: Third-Party Data Processors). Where there is any discrepancy between the list in this Section 18 and the processor list in the Privacy Policy, the more recently updated version shall prevail. Both lists are reviewed and reconciled at each document update.

Note: Google Analytics, Google Ads, and the Meta Pixel are active on the website, and run only with your consent. See heading 12 below.

1. Identity Verification

Tool: IDAnalyzer Purpose: Verifying user identity via government-issued ID document and liveness check Data involved: ID document image (processed by provider), liveness data, verification result Location: EU/EEA We receive only: verification status (pass/fail), timestamp, and reference ID. We do not store ID images where provider is configured in no-storage mode.

2. Payment Processing

Tool: Stripe (https://stripe.com/en-cy) Purpose: Securely processing card payments for paid features Data involved: Card details (handled by Stripe, not stored by us), transaction reference, amount, status Location: EU/EEA or Standard Contractual Clauses (SCCs)

3. Platform Hosting & Infrastructure

Tool: CLOUDLAYER8 LIMITED Purpose: Hosting the Platform, databases, file storage, and CDN Data involved: All Platform data including user accounts, listings, messages, photos Location: EU/EEA (preferred region)

4. Map Display & Location Services

Tool: Mapbox (mapbox.com) Purpose: Map display and location services for property listings Data involved: Location coordinates, map interaction data, IP address Location: US — Standard Contractual Clauses (SCCs) in place

5. Email Delivery

Tool: Internal email service (custom API) Purpose: Sending transactional emails (account verification, notifications, receipts) and marketing emails (where consented) Data involved: Email address, name, email content Location: EU/EEA

6. Customer Support

Tool: Internal support system Purpose: Managing customer support tickets and communication Data involved: Name, email, support conversation content Location: EU/EEA

7. Translation Services

Tool: Google Translate API / MyMemory API Purpose: Translation service for multilingual content on the Platform Data involved: Text content submitted for translation Location: US — Standard Contractual Clauses (SCCs) in place (Google Translate API) / EU (MyMemory API)

8. Push Notifications (Mobile App)

Tool: To be confirmed upon mobile app launch Purpose: Delivering push notifications to mobile app users Data involved: Device token, notification content Location: EU/EEA or Standard Contractual Clauses (SCCs)

Push notifications require your consent via device notification permissions. You may disable them in your device settings at any time.

9. SMS Notifications

Tool: Internal SMS API Purpose: Sending SMS notifications for messages, bookings, and alerts Data involved: Phone number, notification content Location: EU/EEA

SMS notifications are sent based on your notification preferences. You may opt out of SMS notifications at any time via your account settings or by following the unsubscribe instructions in any SMS message.

10. Cookie Consent Management

Tool: MY ESTIACY cookie consent banner Purpose: Managing cookie consent, technically blocking non-essential cookies until user consents, storing consent records Data involved: Consent choices, timestamps, session identifiers Location: EU/EEA

The CMP will be configured per the technical requirements set out in Cookie Policy Section 3 (Section 4 of this document) before any non-essential cookies are activated. Consent records are stored in the EU/EEA.

11. Estia AI Assistant

Tool: OpenRouter, used by the MY ESTIACY backend to route Estia requests to OpenAI models Purpose: Routing Estia requests to OpenAI via OpenRouter and generating AI-assisted replies to user questions about the Platform, property search, areas, and general Cyprus property information Data involved: User prompts, limited chat history, generated replies, Estia conversation transcripts, lead or enquiry metadata, and relevant property-search context where needed to answer the request or pass a relevant enquiry to an advertiser, landlord, seller, agent, agency, developer, or authorised representative Location: OpenRouter, Inc. and OpenAI are US-based providers. Estia prompts and replies may be processed by OpenRouter and OpenAI, which may involve processing outside the EU/EEA or UK unless EU in-region routing, data residency, or equivalent provider restrictions are enabled. Where personal data is transferred outside the EU/EEA or UK, appropriate safeguards such as Standard Contractual Clauses and a Transfer Impact Assessment are required.

Estia conversations are processed to produce replies and are not used to train AI models without explicit user consent. MY ESTIACY uses OpenRouter to route Estia requests to OpenAI models and aims to keep unnecessary logging or prompt use disabled where supported. OpenRouter states that prompt and response content is not stored by OpenRouter unless input/output logging or OpenRouter use of inputs/outputs is enabled. OpenAI's business terms state that customer content is not used to develop or improve OpenAI services unless the customer explicitly agrees.

12. Analytics and Advertising

Tools: Google Tag Manager, Google Analytics 4, and Google Ads (Google Ireland Limited); Meta Pixel (Meta Platforms Ireland Limited) Purpose: Understanding how the website is used, and measuring which ads and channels bring visitors, enquiries, sign-ups, and subscriptions Consent: Google Analytics runs only if you accept analytics cookies. Google Ads and the Meta Pixel run only if you accept marketing cookies. Google Consent Mode v2 defaults every setting to "denied". Data involved: Pages viewed, device and browser type, approximate location derived from IP address, and events such as searches, listings viewed or saved, enquiries sent, sign-ups, and subscriptions started. Names, email addresses, phone numbers, and message content are not sent. Location: Google and Meta process data in the EU/EEA and the US. Transfers to the US are made under the EU-US Data Privacy Framework and Standard Contractual Clauses. Retention: Google Analytics event data is kept for 14 months.

13. Updates to This Page

As our technology stack evolves, this page will be updated to reflect new or changed processors. Material changes will be communicated via our Privacy Policy update process. Last review: 17/10/2026.

APPENDIX A: DATA RETENTION SCHEDULE

This schedule sets out how long MY ESTIACY retains personal data for each data category. After the stated period, data is securely deleted or anonymised. Retention may be extended where required by law (e.g., ongoing legal proceedings).

Legal basis for retention after account closure: Legal obligation (GDPR Art. 6(1)(c)) and legitimate interests in fraud prevention and legal defence (Art. 6(1)(f)).

GDPR Article 5(1)(e) (storage limitation principle) requires that each retention period be justified by reference to the purposes for which the data was collected and any applicable legal obligations. The Justification column below documents the basis for each period in compliance with this requirement. This schedule is reviewed annually and updated whenever new data categories are added or processing purposes change.

This schedule was last reviewed: 17/06/2026.

Miltos Ioannidis, trading as MY ESTIACY (sole trader, business name reg. EE62897a) — Ioulianou 30, Ekali, 3111, Limassol, Cyprus