YOUR CONCERNS. A CLEAR RESPONSE.
Tell us if you believe your personal information has been handled incorrectly. We will consider your concern fairly and explain what happens next.
Effective and last reviewed: 11 September 2026
CyprusMove Limited is the Data Controller for CyprusMoveProperty.ai. We are registered in England and Wales under company number 16541237, with our registered office at 3rd Floor, 45 Albemarle Street, London W1S 4JL, United Kingdom.
This process covers concerns about our collection, use, storage, sharing, accuracy, security or deletion of personal information, including how we respond to privacy rights requests. It applies to website visitors, enquirers, clients and other people whose information we handle.
The process is designed to implement section 164A of the Data Protection Act 2018, inserted by the Data (Use and Access) Act 2025, alongside the UK GDPR. Where applicable, we also apply the EU GDPR and Cyprus data protection legislation, including Law 125(I)/2018. Our internal process does not limit your statutory rights.
If your concern also involves a service dispute, we will identify and address its data protection aspects. If it concerns an independent partner’s own processing, we will explain our role and help identify the appropriate contact; we remain responsible for investigating our own handling of your information.
You may raise a concern through our other normal contact channels. Our team will pass it to the person handling data protection complaints. You do not have to use a particular channel, quote legislation or call your concern a “formal complaint”.
It helps if you provide your name and preferred contact method, what happened and when, which information or interaction is involved, and the outcome you would like. Include relevant correspondence if available. Do not send passwords, full bank details or identity documents unless we explain why they are necessary and how to send them securely.
You may ask an authorised representative to complain for you. We may need proportionate evidence of their authority before sharing personal information. Let us know if you need help raising your concern, an accessible format or another reasonable communication arrangement. We will consider anonymous reports where possible, although this may limit what we can investigate or communicate.
We record the date received, the issues raised and available contact details. We identify any urgent risk, related rights request or potential security incident and assign responsibility for the complaint. Where practicable, the person reviewing the complaint will not be the person whose actions are being challenged.
We confirm receipt and explain the next steps and point of contact. If necessary, we ask focused questions to understand the concern. Any identity checks will be proportionate to the information involved; we do not routinely require identity documents simply to receive a complaint.
We make appropriate enquiries, review relevant records and explanations, and consult staff, processors or advisers where needed. We consider your evidence and the applicable data protection duties. Information is shared only as necessary for the investigation, and we take steps to address ongoing harm promptly.
We tell you our findings, reasons and any corrective action. Depending on the findings, action may include correcting information, reviewing a disclosure, addressing a rights request, changing a procedure or improving staff guidance. We track agreed actions and use complaints to identify recurring problems.
We acknowledge receipt within 30 calendar days, with the period starting the day after we receive the complaint. This is an acknowledgement deadline, not a standard waiting period or a fixed deadline for completing every investigation.
We begin appropriate enquiries, keep you informed of progress and communicate the outcome without undue delay. The time needed depends on the issues and evidence, but unnecessary or unjustified delay is not acceptable. Where we cannot resolve the matter promptly, we explain the reason, what remains to be done and when you should expect the next update. We tell you if that expectation changes.
If further information is needed, we explain what and why, while progressing the aspects we can. Receiving a complaint through another CyprusMove contact channel does not restart the acknowledgement period when it reaches the DPO.
Our response will set out the matters considered, the findings and reasons, any action taken or proposed and relevant next steps. If we cannot take the action you requested, we explain why. We also explain your right to raise the matter with a supervisory authority.
If you remain dissatisfied, reply to the DPO or write to the registered office explaining which findings you disagree with and any further evidence. You may request a review by an appropriate person not previously responsible for the decision, where practicable. We consider the review without undue delay and keep you informed. There is no fee for this internal process, and requesting a review is not a condition of exercising your legal rights.
You have the right to complain to a relevant data protection supervisory authority. You do not need our permission. You may provide the authority with your original complaint, our response and relevant correspondence.
Our process does not require you to exhaust an internal review before exercising EU GDPR complaint rights. Your rights to judicial remedies and, where the legal conditions are met, compensation remain unaffected. A complaint does not automatically establish a right to compensation.
If your complaint includes an access, rectification, erasure or other privacy rights request, we identify and handle that request under its separate legal requirements. The 30-day complaint acknowledgement period does not replace the applicable rights-request deadline. Rights requests normally require a response within one month, subject to legally permitted extensions or other applicable provisions, which we will explain where relevant.
See our Privacy Policy and DSAR Policy for further information. You can make a rights request without making a complaint.
For a suspected data breach or immediate risk, contact the DPO promptly and identify the urgency. We assess and contain incidents separately from the complaint investigation. Where the legal reporting thresholds are met, relevant breach notification requirements apply, including notification to the competent authority within 72 hours of awareness where required, and informing affected individuals without undue delay where the applicable high-risk threshold is met.
We use complaint information to investigate, respond, meet legal obligations and demonstrate accountability. Access is limited to those who need it, such as relevant staff, our DPO and advisers. We may need to disclose relevant information to a processor or supervisory authority, while protecting unrelated personal information.
We keep a record of the concern, key dates, enquiries, decisions, communications and corrective actions. Records are retained for as long as necessary to resolve the matter and meet applicable accountability, legal-claim or regulatory requirements, with unnecessary information deleted or anonymised. Our Privacy Policy explains your rights and the retention criteria in more detail.
We review this process and complaint trends to improve our practices. CyprusMove Limited remains accountable for implementing the process, with advice and oversight from Data Privacy Services.
Data Protection Act 2018, section 164A · Data (Use and Access) Act 2025 · ICO guidance on handling data protection complaints.
Contact Data Privacy Services, our Data Protection Officer. Please include “CyprusMove data protection complaint” in the subject if possible.
Raise a data protection complaint ↗