This policy explains what personal data we collect when you visit arquscheck.gr, when you contact us and when you commission an inspection, why we use it, who we share it with and what rights you have under the General Data Protection Regulation (EU) 2016/679 ("GDPR"). We collect only what we need, we do not sell data, and the website does not use cookies. It applies from 28 September 2026.
1. Controller
The controller is ICONEXIS LTD, a private limited liability company registered in the Republic of Cyprus under number HE 489331, with its registered office at Ellados 12, 8020 Paphos, Cyprus, which operates the website and provides the inspection services under the ARQUS Check brand ("we", "us").
For anything relating to your personal data:
- Email: a4uusa@yahoo.com
- Phone: +30 698 750 4050
- Contact address: Navarchou Kountourioti 19, 2nd floor, 54625 Thessaloniki, Greece
We have not appointed a Data Protection Officer (DPO); your requests are handled directly by the company at the details above.
2. Who this policy covers
Website visitors, anyone who contacts us (through the form, by email, by phone or via WhatsApp), our clients, and third parties we come into contact with during an inspection, such as owners, sellers, estate agents and occupants of the property.
3. What data we process and why
3.1 Visiting the website
Like any website, our server receives technical details of your browser's request: IP address, browser and device type, the page requested, and the date and time. Our hosting provider (Vercel) processes these details to deliver the website to you and to protect it against abuse, and keeps them in server logs for a short period. Legal basis: our legitimate interest in operating the website securely (Article 6(1)(f) GDPR).
3.2 Visitor statistics
We use Vercel Web Analytics to see aggregated statistics, such as which pages are read, which website visitors came from (referrer), country or region, device type, operating system and browser. We also record anonymous, aggregated events, such as a phone, email or WhatsApp link being clicked, the language being switched or the form being sent (without its content). The tool does not use cookies and stores nothing on your device; to count unique visitors it computes a hash from the incoming request, which is automatically discarded after 24 hours. We only see aggregated figures and cannot identify you. Legal basis: our legitimate interest in understanding how the website is used and improving it (Article 6(1)(f)).
3.3 Contact form
When you send the form, we receive:
- your name, email address and message (required);
- your phone number, the property type and the property location (optional);
- the page language and the page from which you sent the form;
- your browser's identification string (user agent);
- a salted cryptographic hash of your IP address. The IP address itself is not stored.
We use your name, contact details and property information to reply to your enquiry and send you a quote (Article 6(1)(b), steps taken at your request before entering into a contract). The user agent and the IP hash are used only for protection against spam and to limit repeated submissions (Article 6(1)(f), our legitimate interest in the security of the website). If you do not give us your name, email address and message, we cannot reply to your enquiry through the form.
3.4 Email, phone and WhatsApp
If you contact us directly, we process your contact details and the content of your communication to reply to you and arrange the service (Article 6(1)(b)) or, for general questions, on the basis of our legitimate interest in replying to people who contact us (Article 6(1)(f)). If you use WhatsApp, that service is provided by Meta under its own terms and privacy policy.
3.5 Clients and inspections
When you commission an inspection, we process:
- your identity and contact details, and billing details where needed (for example address, tax identification number);
- details of the property (address, characteristics, documents provided by you or the seller);
- photographs, thermal images, drone images and video, and site notes and measurements;
- the report and correspondence relating to the service.
Inspection data is kept in the ARQUS inspection app, which is also hosted on Supabase in a data centre within the EU. Legal bases: performance of the contract (Article 6(1)(b)); compliance with tax and accounting obligations (Article 6(1)(c)); our legitimate interest in establishing or defending legal claims (Article 6(1)(f)). These details are necessary to conclude and perform the contract; without them we cannot provide the service.
3.6 Third parties during an inspection
To arrange access to the property we may process the name and contact details of the owner, seller, estate agent or occupant, usually provided to us by the client. We photograph the property and its installations for the purposes of the report. We try not to capture people; where people, personal belongings or neighbouring properties appear incidentally (for example in drone images), that material is used only for the inspection report. Legal basis: our and our client's legitimate interest in carrying out the inspection (Article 6(1)(f)).
4. Summary of purposes and legal bases
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Technical visit data | Operating and securing the website | Legitimate interests, Art. 6(1)(f) |
| Aggregated statistics | Improving the website | Legitimate interests, Art. 6(1)(f) |
| Form and correspondence details | Replying to your enquiry, quoting | Pre-contractual steps, Art. 6(1)(b) |
| User agent, IP hash | Spam protection, limiting submissions | Legitimate interests, Art. 6(1)(f) |
| Client and inspection data | Providing the service, the report | Contract, Art. 6(1)(b) |
| Billing details | Tax and accounting obligations | Legal obligation, Art. 6(1)(c) |
| Correspondence and service records | Establishing or defending claims | Legitimate interests, Art. 6(1)(f) |
| Third-party details (owners, occupants, agents) | Arranging access, carrying out the inspection | Legitimate interests, Art. 6(1)(f) |
We do not use your data for advertising or newsletters, we do not sell it, we do not profile you, and we do not take decisions based solely on automated processing.
5. Who we share data with
We share data only as far as necessary, with:
- Supabase: database for form enquiries and for the inspection app; data is stored in a data centre in Frankfurt, Germany (region eu-central-1).
- Vercel: website hosting, running the contact-form function, and visitor statistics.
- Resend: delivery of form enquiries by email to our mailbox, when enabled.
- Our email provider (currently Yahoo), where we receive and store our correspondence.
- Our associates in delivering the service, such as the TEE-member civil engineer who co-signs the report, who are bound by confidentiality.
- Accountants, lawyers and other professional advisers, where needed.
- Public authorities, courts or tax authorities, where the law requires us to.
The technology providers (Supabase, Vercel, Resend, email provider) act as processors or as independent service providers under their data processing terms, and use the data only to provide their services to us. We share your report with third parties only as described in our Terms & Conditions.
6. Transfers outside the European Economic Area
Vercel and Resend are companies based in the United States, and Supabase also has a US parent company; some data may therefore be transferred to, or be accessible from, outside the EEA, for example for technical support. These transfers rely on the EU–US Data Privacy Framework for providers certified under it and/or on Standard Contractual Clauses approved by the European Commission. The same applies to our email provider. You can ask us for more information about these safeguards using the details in section 1.
7. How long we keep data
- Enquiries that do not lead to an engagement: 24 months from our last communication about the enquiry, after which they are deleted. The IP hash and user agent are deleted together with the enquiry.
- Clients and inspections: for as long as needed to provide the service and then for as long as tax and accounting legislation requires, and for as long as claims relating to the service may be brought.
- Visitor statistics: in aggregated form only; the hash used to count visitors is discarded after 24 hours.
- Server logs: for a short period, in line with the hosting provider's settings.
8. Security
We take appropriate technical and organisational measures to protect your data: all communication with the website is encrypted (HTTPS), access to the databases is restricted to authorised persons, database access keys are used only on the server and never in the browser, and the IP address of people sending the form is not stored in readable form. No system is completely secure; if a breach affecting you occurs, we will act as the GDPR requires.
9. Your rights
Under the GDPR you have the right:
- of access to your data and to receive a copy of it;
- to rectification of inaccurate or incomplete data;
- to erasure ("right to be forgotten"), when the data is no longer needed or there is no lawful basis for keeping it;
- to restriction of processing in certain cases;
- to data portability, that is to receive the data you gave us in a structured, commonly used format or to have it transmitted to someone else, where processing is based on contract or consent and carried out by automated means;
- to object to processing based on our legitimate interests, on grounds relating to your particular situation;
- to withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
To exercise any right, email us at a4uusa@yahoo.com or write to our contact address. We reply without undue delay and within one month at the latest; this may be extended by two further months for complex or numerous requests, in which case we will let you know. Exercising your rights is free of charge. We may ask for information to confirm your identity. Some data may have to be kept despite an erasure request where the law requires it (for example tax records).
10. Right to lodge a complaint
If you believe that the processing of your data infringes the law, you have the right to lodge a complaint with a supervisory authority. The lead supervisory authority for ICONEXIS LTD is the Cyprus Commissioner for Personal Data Protection. You may also contact the authority of the Member State where you live or work or where the infringement took place, for example in Greece the Hellenic Data Protection Authority. We would, however, appreciate the chance to resolve the matter with you first.
11. Cookies and similar technologies
The website does not use cookies and does not store or read information on your device (such as localStorage or sessionStorage). That is why we do not show a cookie consent banner.
- Visitor statistics (Vercel Web Analytics) work without cookies, as described in section 3.2.
- Fonts and all website files are loaded from our own server; no requests are made to Google Fonts or other third-party networks.
- We do not embed advertising tools, social media pixels, or third-party videos or maps. The links to a map (OpenStreetMap) and to WhatsApp are plain links; only if you follow them does the website concerned process your data under its own policy.
- Your browser may cache website files, such as images and fonts, so that pages load faster; these files contain no personal data.
If we ever use cookies or similar technologies that require consent, we will update this policy and ask for your consent first.
12. Children
Our services are intended for adults. We do not knowingly collect data from minors through the website. If we learn that a minor has sent us personal data, we will delete it.
13. Changes to this policy
We may update this policy, for example when our providers or the law change. The current version is always published on this page with its effective date. If the changes are significant and we have your contact details, we will let you know.
14. Language and contact
This policy is published in Greek and English; in case of any discrepancy the Greek text prevails. For any question: a4uusa@yahoo.com, +30 698 750 4050, Navarchou Kountourioti 19, 2nd floor, 54625 Thessaloniki, Greece.