Privacy Policy
AssetHaven.co
Effective date: 9 November 2026
Registered business name: ASSETHAVEN
Jurisdiction: Republic of Cyprus, European Union
1. Who we are
AssetHaven is the name used for the property-management services and website available at https://assethaven.co (the “Website”). The legal entity operating AssetHaven will be identified above once its registered business name is confirmed.
Contact for privacy matters: info@assethaven.co
Telephone: +357 97 549 890
Correspondence address: Klisovas 1, Office 204, 1055 Nicosia, Cyprus (to be confirmed before publication).
When we decide why and how personal information is used for our own Website, enquiries, client relationships, billing and accounts, we act as a data controller under the EU General Data Protection Regulation (“GDPR”). For certain information about tenants, occupants or other persons provided by a property owner, our role may instead be that of a processor acting on the owner's documented instructions, depending on the arrangements and the purposes involved. Where required, these responsibilities will be documented in an appropriate agreement.
2. Who and what this policy covers
This policy explains our use of personal information relating to Website visitors, prospective clients, owners, their authorised representatives, tenants and occupants whose details are involved in property management, and contractors or other service providers. It also covers the private Owner Portal, its reports, documents and on-site messages.
3. Information we collect
Depending on your relationship with us, we may collect:
- Contact and identity information: name, email address, telephone number, correspondence address, organisation or authorised representative details.
- Owner enquiries: number and location of property units, owner's country or place of residence, preferred service package, requested services, and information entered in the Choose Plan or Contact forms.
- Property-management information: property addresses and identifiers, inspection notes and photographs, maintenance issues, occupancy and tenancy contact details, authorised access arrangements, records of service requests, and documents the owner provides for an agreed purpose.
- Owner Portal information: account identifiers, password hashes, sign-in and security records, account access permissions, on-site messages, inspection reports, photographs and financial records or receipts uploaded to the portal.
- Billing information: agreed plan, billing contact, invoices, payment status, transaction identifiers and subscription status if online payments are enabled. Payment-card details entered in Stripe Checkout are handled by Stripe rather than stored in the Owner Portal by AssetHaven.
- Technical information: device and browser details, IP address, security logs, session information, necessary cookies and, if activated and permitted, optional analytics or marketing preferences.
Please avoid submitting unnecessary sensitive personal information, access credentials, identification documents or financial details in open message fields.
4. Why we use data and our legal bases
We process personal data only when a valid legal basis applies:
| Purpose | Usual legal basis under GDPR |
|---|---|
| Answer enquiries, arrange consultations and prepare requested offers | Steps requested before entering a contract (Article 6(1)(b)), where applicable; otherwise legitimate interests (Article 6(1)(f)) in responding to enquiries |
| Provide agreed property-management services and Owner Portal access | Contract performance (Article 6(1)(b)) for individual clients; legitimate interests (Article 6(1)(f)) where processing business contacts or necessary third-party information |
| Keep inspection records, coordinate approved service providers and communicate about property issues | Contract performance or legitimate interests as appropriate; when acting solely on an owner's instructions, the owner's documented processing arrangements |
| Administer invoices, subscriptions, accounting and tax obligations | Contract performance and compliance with legal obligations (Article 6(1)(c)) |
| Protect accounts, investigate abuse, prevent fraud and maintain system security | Legitimate interests in secure operations (Article 6(1)(f)) and applicable legal obligations |
| Send optional promotional messages or use non-essential tracking | Consent where required (Article 6(1)(a)) or another basis only where law permits |
Where we rely on legitimate interests, we consider the relevant privacy interests and rights. We do not use an enquiry form submission as consent to unrelated marketing.
5. Property, tenant and third-party information
Owners should provide only information they are authorised to share and should inform tenants, occupants or others as required by law. We may share relevant information with authorised staff and vetted contractors strictly as needed to deliver requested services (for example, to arrange a repair or inspection). An owner's use of AssetHaven does not remove the owner's own data-protection duties. Where necessary, a separate data-processing agreement will set out our roles and instructions.
6. Who receives personal data
Information may be disclosed on a need-to-know basis to:
- Authorised AssetHaven personnel and service providers involved in property management;
- Hosting, email, security, database and other IT providers operating the Website and Owner Portal;
- Independent contractors, professional advisers, accountants and insurers where necessary for the agreed services;
- Stripe or other approved payment providers if online subscriptions are activated, for checkout, billing and fraud prevention; and
- Regulators, courts, competent authorities or other recipients where the law requires disclosure.
We do not sell personal data. Some service providers may act as independent controllers for their own legal or operational obligations, rather than solely as our processors.
7. International transfers
Some technology providers may process information outside Cyprus or the European Economic Area. Where applicable, we will use legally recognised transfer mechanisms, such as an EU adequacy decision or appropriate contractual safeguards, and provide further details on request. The actual provider list and transfer arrangements should be verified before publication.
8. How long information is kept
We retain data only for as long as necessary for the relevant purpose. Enquiries that do not result in a client relationship are periodically reviewed for deletion; client and property records are retained for the duration of the engagement and any justified subsequent period for accounting, legal claims or record-keeping duties. Payment and tax records are retained for legally required periods. Technical records are retained according to security needs and applicable obligations. We may securely delete or anonymise records when no longer needed. Our operational retention schedule must match this description.
9. Security and access controls
We use proportionate administrative and technical measures to help protect information, including access restrictions, private user accounts and security controls. Only authorised users should have access to their own property records and messages. No online service can promise absolute security. Please keep your credentials confidential and contact us immediately if you suspect unauthorised access.
10. Cookies and similar technology
The Website and Owner Portal may use cookies required for authentication, session security, language preferences or basic site operation. These strictly necessary technologies generally do not require cookie consent. If non-essential analytics, advertising or similar tracking is added, we will provide appropriate information and obtain consent where required before using it, with a way to withdraw that consent. The exact cookie inventory and consent controls must be checked against the live Website.
11. Your data-protection rights
Subject to the GDPR and applicable exceptions, you may request access, rectification, erasure, restriction, portability or objection to processing, and withdraw consent at any time where consent is the basis. You also have rights relating to certain solely automated decisions. We do not intend to make decisions producing legal or similarly significant effects solely by automated processing.
Contact info@assethaven.co to exercise your rights. We may ask for reasonable identity verification and will respond within the time limits required by law, normally within one month.
You may also complain to the Office of the Commissioner for Personal Data Protection, Republic of Cyprus, at https://www.dataprotection.gov.cy. We encourage you to contact us first so we can address your concern, but this does not limit your right to complain.
12. Children
The Website and services are intended for adults and authorised business representatives, not children. If you believe a child has supplied personal information inappropriately, please contact us.
13. Updates
We may update this Privacy Policy when practices, providers or legal requirements change. A revised version will be posted with a new effective date; where law requires, we will provide additional notice.
14. Contact
AssetHaven
Registered business name: ______________________________
Email: info@assethaven.co
Phone: +357 97 549 890
Jurisdiction: Republic of Cyprus, European Union