Privacy Policy
Privacy Policy
Last updated: August 2026
CapitalSF Cyprus respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store and share personal information when you visit www.capitalsf.eu, submit an enquiry, communicate with us or use our services.
It also explains your rights under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable data-protection law in the Republic of Cyprus.
1. Who we are
This website is operated by:
3ST Limited, trading as CapitalSF Cyprus
13 Christou Keli Street
Mesa Chorio
8290, Cyprus
Telephone: +357 99 738851
Email: [insert privacy email address]
Website: www.capitalsf.eu
For the purposes of applicable data-protection law, 3ST Limited is the data controller responsible for deciding why and how your personal information is processed.
References in this policy to “CapitalSF Cyprus”, “we”, “us” or “our” refer to 3ST Limited trading as CapitalSF Cyprus.
2. Scope of this policy
This policy applies to personal information collected through:
- The CapitalSF Cyprus website;
- Website enquiry and contact forms;
- Email, telephone, WhatsApp or other direct communications;
- Private consultations;
- Client onboarding and service delivery;
- Professional introductions;
- Events, meetings and business-development activities; and
- Our relationships with prospective clients, clients, professional advisers and service providers.
This policy does not govern the independent processing activities of lawyers, accountants, tax advisers, corporate service providers, property developers, financial advisers, banks or other third parties.
When you appoint or communicate directly with an independent professional, that professional will generally act as a separate data controller and should provide you with its own privacy information.
3. Personal information we may collect
The information we collect depends on how you interact with us and the nature of the guidance or coordination you request.
3.1 Identity and contact information
This may include:
- Full name;
- Title;
- Postal or residential address;
- Email address;
- Telephone and mobile numbers;
- Country of residence;
- Nationality;
- Preferred method of communication; and
- Names and contact details of family members or representatives involved in your enquiry.
3.2 Enquiry and consultation information
This may include:
- The area in which you require guidance;
- Your reasons for considering Cyprus;
- Intended relocation dates;
- Family composition;
- Employment or business circumstances;
- Property preferences;
- Residency objectives;
- General tax-residency considerations;
- Wealth-planning objectives;
- Notes from consultations and meetings; and
- Correspondence between you and CapitalSF Cyprus.
3.3 Professional and business information
Where relevant to your enquiry, this may include:
- Occupation and employment status;
- Employer or business name;
- Directorships and company interests;
- Nature of business activities;
- Proposed Cyprus business activities;
- Professional background;
- Business plans;
- Company ownership information; and
- Details required to coordinate introductions to corporate, legal, banking or accounting professionals.
3.4 Financial and property information
Where relevant and voluntarily provided, this may include:
- General income and asset information;
- Source-of-funds or source-of-wealth information;
- Property budgets and preferences;
- Existing property interests;
- Banking or investment relationships;
- Pension and retirement information;
- General information about investments or business interests; and
- Information required by an independent professional or institution to assess whether it can assist you.
CapitalSF Cyprus does not request online-banking passwords, payment-card security codes or login credentials.
You should not provide detailed bank-account information, copies of identity documents, tax numbers or other sensitive documents through the website enquiry form.
3.5 Residency and immigration information
If you request guidance relating to Cyprus residence pathways, we may collect general information about:
- Nationality and current residence;
- Existing residence status;
- Family members or dependants;
- Employment or business activities;
- Intended duration of residence;
- Property ownership or rental arrangements; and
- Financial resources relevant to identifying matters requiring specialist advice.
CapitalSF Cyprus does not independently determine immigration eligibility or process immigration applications. Detailed immigration information should be provided directly to the independent legal professional appointed by you.
3.6 Website and technical information
When you use our website, certain technical information may be collected automatically by our website platform, hosting provider or analytics services.
This may include:
- Internet Protocol address;
- Browser type and version;
- Device type;
- Operating system;
- Approximate location derived from an IP address;
- Pages visited;
- Date and time of access;
- Referring website;
- Time spent on the website;
- Links selected;
- Error, security and diagnostic logs; and
- Cookie or similar technology identifiers.
Some of this information may not directly identify you but can still constitute personal data under the GDPR.
3.7 Information obtained from other sources
We generally collect personal information directly from you.
We may also receive information from:
- A spouse, family member or authorised representative;
- A professional adviser who refers you to us;
- A service provider or professional with whom you have asked us to coordinate;
- Publicly available professional or business sources;
- Company registers or official government sources; and
- Event organisers or business contacts where it is lawful and appropriate to do so.
Where another person provides information about you, we may ask that person to confirm that they are authorised to share it.
4. Special-category and sensitive information
We do not ordinarily need to collect special-category personal data through the website.
Special-category data may include information about health, racial or ethnic origin, religious beliefs, political opinions, trade-union membership, genetic or biometric data, or a person’s sex life or sexual orientation.
Please do not include special-category information, identity documents or other highly sensitive information in the website contact form.
If sensitive information becomes necessary in connection with a particular matter, we will only process it where there is an appropriate legal basis and suitable safeguards. Wherever practical, detailed sensitive information should be provided directly to the relevant independent professional.
5. How we use personal information
We may use personal information to:
- Receive, review and respond to enquiries;
- Arrange private consultations;
- Understand your circumstances, priorities and objectives;
- Determine whether our services may be appropriate;
- Provide strategic guidance and professional coordination;
- Develop an agreed roadmap for your Cyprus plans;
- Identify areas requiring specialist advice;
- Make professional introductions at your request;
- Coordinate communication with professionals appointed by you;
- Administer our relationship with you;
- Prepare proposals, engagement documents and invoices;
- Maintain business, accounting and compliance records;
- Respond to questions, complaints or legal claims;
- Protect the security of our website, systems and communications;
- Prevent fraud, misuse and unlawful activity;
- Maintain and improve our website and services;
- Comply with legal, regulatory, tax and accounting obligations; and
- Send insights, updates or other marketing communications where permitted.
We will not use personal information for a purpose that is incompatible with the purpose for which it was collected unless permitted or required by law.
6. Our lawful bases for processing
Under the GDPR, we must have a lawful basis for processing personal information.
Depending on the circumstances, we rely on one or more of the following bases.
6.1 Steps before entering into a contract
We may process information to respond to your enquiry, arrange a consultation, prepare a proposal or take other steps requested by you before entering into a service agreement.
6.2 Performance of a contract
Where you become a client, we process information where necessary to provide the agreed services, manage the relationship and fulfil our contractual obligations.
6.3 Legitimate interests
We may process information where this is necessary for our legitimate business interests and those interests are not overridden by your rights and freedoms.
These interests may include:
- Responding to business enquiries;
- Managing client and professional relationships;
- Coordinating requested professional introductions;
- Maintaining appropriate business records;
- Improving our services and website;
- Protecting our systems and communications;
- Establishing, exercising or defending legal claims; and
- Preventing fraud or misuse.
Where we rely on legitimate interests, we consider the nature of the information, the reasonable expectations of the individual and the possible effect of the processing.
6.4 Legal obligations
We may process and retain information where necessary to comply with legal, regulatory, accounting, tax, court-order or law-enforcement obligations.
6.5 Consent
We may rely on your consent where:
- You ask us to share your details with a professional or service provider;
- You subscribe to marketing communications;
- We use non-essential cookies or analytics requiring consent;
- You voluntarily provide particular sensitive information; or
- Consent is otherwise the most appropriate lawful basis.
You may withdraw consent at any time. Withdrawal will not affect processing that lawfully took place before consent was withdrawn.
7. Professional introductions and sharing information
CapitalSF Cyprus works with a network of independent professionals and service providers.
These may include:
- Lawyers and immigration professionals;
- Tax advisers and accountants;
- Corporate service providers;
- Regulated financial advisers;
- Banks and payment institutions;
- Insurance professionals;
- Property developers and property professionals;
- Valuers, surveyors and other property specialists; and
- Other professionals relevant to your circumstances.
We will not ordinarily provide your detailed personal information to an independent professional merely because we believe that professional may be able to assist you.
Before making an introduction, we will generally:
- Explain the type of professional or organisation concerned;
- Confirm that you want the introduction to be made; and
- Share only the information reasonably necessary for the introduction or specifically authorised by you.
Once your information has been received by an independent professional, that professional may process it as a separate data controller under its own privacy policy.
8. Other recipients of personal information
We may also disclose personal information to:
- Website hosting and website-platform providers;
- Email, cloud-storage and communication providers;
- Information-technology and cybersecurity providers;
- Customer-relationship or business-administration systems;
- Accountants, auditors and legal advisers acting for CapitalSF Cyprus;
- Insurers;
- Government departments, regulators, tax authorities, courts or law-enforcement agencies where required;
- A prospective buyer, investor or successor in connection with a genuine corporate transaction; and
- Other parties where you have authorised the disclosure or the law permits or requires it.
Service providers processing personal information on our behalf are expected to use the information only for the agreed purposes and to apply appropriate security and confidentiality measures.
We do not sell personal information.
9. Website platform and enquiry forms
The CapitalSF Cyprus website is built and hosted using Webador.
When you visit the website or submit an enquiry form, Webador and its associated infrastructure may process technical and contact information on our behalf to host the website, maintain security and transmit your enquiry to us.
Information submitted through the form may also be delivered to and stored within our email system.
You should provide only the information required for us to understand and respond to your enquiry. Do not upload or send passport copies, financial statements, tax records or other sensitive documentation through a general website form.
10. International transfers
CapitalSF Cyprus is based in Cyprus, which forms part of the European Economic Area.
Some service providers, professional advisers or technical systems may be located outside Cyprus or outside the EEA. This may be particularly relevant where a client’s affairs involve the United Kingdom, South Africa or another international jurisdiction.
Where personal information is transferred outside the EEA, we will take reasonable steps to ensure that an appropriate transfer mechanism or safeguard is used where required.
This may include:
- A European Commission adequacy decision;
- European Commission-approved Standard Contractual Clauses;
- Contractual and organisational safeguards;
- Your explicit consent in appropriate limited circumstances; or
- Another transfer mechanism permitted under the GDPR.
Where you specifically ask us to introduce or coordinate with a professional outside the EEA, the nature of the transfer and the country concerned may be explained to you before relevant information is shared.
11. How long we retain personal information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to comply with legal, regulatory, tax, accounting and legitimate business requirements.
The following periods are general guidelines:
Unsuccessful or preliminary enquiries
Information relating to an enquiry that does not result in a client relationship may generally be retained for up to 24 months after the last meaningful communication.
This allows us to respond if you return to the enquiry, maintain appropriate records and address any question or complaint relating to the communication.
Client and service records
Where you become a client, relevant records may generally be retained for the duration of the relationship and for up to six years after the relationship ends.
Information may be retained for a longer or shorter period where required by law, professional advice, contractual obligations, a dispute, a legal claim or the nature of the record.
Professional introductions
Records of requested introductions and related communications may generally be retained for up to six years where they form part of a client engagement, or up to 24 months where no client relationship develops.
Marketing information
Where marketing is based on consent, contact details may be retained until you unsubscribe or withdraw your consent.
We may retain a minimal suppression record after an unsubscribe request to ensure that further marketing is not sent inadvertently.
Website and technical records
Technical and security logs are retained according to the settings and retention practices of our website, hosting, analytics and security providers and only for as long as reasonably necessary.
At the end of the applicable period, information will be securely deleted, anonymised or retained only where there is a lawful reason to continue holding it.
12. Cookies and similar technologies
Our website may use cookies and similar technologies.
Cookies are small files stored on your device that help websites function, maintain security, remember settings or understand how visitors use the site.
Necessary cookies
Necessary cookies support functions such as:
- Website security;
- Page navigation;
- Form operation;
- Session management; and
- Confirmation that the website is operating correctly.
These cookies are necessary for the website to function and generally cannot be disabled through the website.
Analytics and optional cookies
If analytics, embedded media, maps, social-media content or other third-party services are enabled, additional cookies may be used to measure website activity or provide external functionality.
Where required by law, non-essential cookies will not be placed before you have made a consent choice.
You may manage cookies through the website consent tool, where available, or through your browser settings. Disabling cookies may affect the operation of certain website features.
Further information about specific cookies should be provided in the website’s cookie notice or cookie settings.
13. Marketing communications
We may send you CapitalSF Cyprus insights, invitations or service updates where:
- You have specifically consented;
- You are an existing client and the communication concerns similar services, where permitted by law; or
- Another lawful basis permits the communication.
You can stop receiving marketing communications at any time by:
- Selecting the unsubscribe option in the communication;
- Contacting us at [insert privacy email address]; or
- Asking us directly to remove you from the marketing list.
Withdrawing from marketing will not prevent us from sending essential communications relating to an existing enquiry, engagement, transaction or legal obligation.
14. Security of personal information
We take reasonable technical and organisational measures to protect personal information against:
- Unauthorised access;
- Unlawful use or disclosure;
- Accidental loss;
- Alteration;
- Destruction; and
- Damage.
Measures may include:
- Access controls;
- Password protection;
- Multi-factor authentication where available;
- Secure cloud and email services;
- Restricted access on a need-to-know basis;
- Staff and contractor confidentiality obligations;
- Software and security updates;
- Backups;
- Secure deletion procedures; and
- Review of relevant service providers.
No method of transmitting or storing information is completely secure. We cannot guarantee absolute security, particularly where information is transmitted through ordinary email, messaging platforms or the public internet.
If a personal-data breach occurs, we will assess it and notify the relevant supervisory authority and affected individuals where required by law.
15. Your data-protection rights
Subject to the conditions and exceptions in applicable law, you may have the following rights.
Right to be informed
You have the right to receive clear information about how your personal data is collected and used.
Right of access
You may request confirmation of whether we process your personal information and obtain a copy of relevant information.
Right to rectification
You may ask us to correct information that is inaccurate or complete information that is incomplete.
Right to erasure
You may ask us to delete your personal information where there is no continuing lawful reason to retain it.
This right is not absolute. We may need to retain certain information to comply with legal obligations or establish, exercise or defend legal claims.
Right to restriction
You may ask us to restrict the processing of your information in certain circumstances, including while its accuracy or the lawfulness of processing is being reviewed.
Right to data portability
Where processing is based on consent or contract and carried out by automated means, you may have the right to receive information you provided in a structured, commonly used and machine-readable format or request its transfer to another controller.
Right to object
You may object to processing based on our legitimate interests where your particular circumstances justify the objection.
You have an absolute right to object to direct marketing.
Right to withdraw consent
Where processing is based on consent, you may withdraw that consent at any time.
Rights concerning automated decisions
You have rights concerning decisions based solely on automated processing where those decisions produce legal or similarly significant effects.
CapitalSF Cyprus does not ordinarily use solely automated decision-making or profiling to make significant decisions about prospective clients or clients.
16. How to exercise your rights
To exercise a data-protection right, contact us using:
Email: [insert privacy email address]
Telephone: +357 99 738851
Postal address: 3ST Limited trading as CapitalSF Cyprus, 13 Christou Keli Street, Mesa Chorio, 8290, Cyprus
Please describe the right you wish to exercise and provide sufficient information for us to identify the relevant records.
We may request reasonable proof of identity before releasing, amending or deleting information. This protects personal information from unauthorised access.
We will ordinarily respond within one month after receiving a valid request. The period may be extended where permitted by the GDPR if a request is particularly complex or numerous. We will inform you if an extension is required.
Data-subject requests are generally processed without charge. A reasonable fee may be charged, or a request refused, where it is manifestly unfounded or excessive, as permitted by law.
17. Complaints
If you have concerns about how we process your personal information, please contact us first so that we can try to resolve the matter.
You also have the right to lodge a complaint with the:
Office of the Commissioner for Personal Data Protection
Kypranoros 15
1061 Nicosia
Cyprus
Postal address: P.O. Box 23378, 1682 Nicosia, Cyprus
Telephone: +357 22 818456
Email: commissioner@dataprotection.gov.cy
Website: www.dataprotection.gov.cy
You may also have the right to complain to another data-protection authority where you ordinarily live or work or where an alleged infringement occurred.
18. Links to third-party websites
Our website may contain links to government authorities, professional firms, service providers, developers, financial institutions, social-media platforms or other third-party websites.
We do not control the privacy practices of those websites. When you follow an external link, the third party’s privacy policy and cookie practices will apply.
You should review the relevant privacy information before providing personal information to an external website or organisation.
19. Information concerning children
Our website and services are not directed at children.
We do not knowingly collect personal information directly from children through the website.
Information concerning dependent children may sometimes be relevant to a family’s residency or relocation planning. Such information should be provided by a parent, legal guardian or authorised representative and limited to what is reasonably necessary.
If you believe that a child has provided personal information directly to us without appropriate authority, please contact us.
20. Changes to this policy
We may update this Privacy Policy to reflect changes in:
- Our services;
- Website functionality;
- Service providers;
- Data-processing activities;
- Legal or regulatory requirements; or
- Our internal practices.
The revised policy will be published on this page with an updated revision date.
Material changes may also be communicated directly where appropriate.
21. Contact us
Questions about this Privacy Policy or our handling of personal information should be directed to:
CapitalSF Cyprus
3ST Limited trading as CapitalSF Cyprus
13 Christou Keli Street
Mesa Chorio
8290, Cyprus
Telephone: +357 99 738851
Email: [insert privacy email address]
Website: www.capitalsf.eu