Who we are
NEWSNET LIMITED, trading as Creta Hills, is responsible for the personal data collected through cretahills.com. Under the GDPR, that makes us the "controller".
- Address: Galinis 3A, Kato Lakatamia 2324, Nicosia, Cyprus
- Company number: HE 334860
- Email: info@cretahills.com
- Phone: +30 698 588 7177
For any question about this policy or your data, email info@cretahills.com. We have not appointed a data protection officer.
What we collect and why
We collect what you send us through the contact form, and a small amount of technical data about visits. We do not sell personal data. We use visit data for advertising only if you accept advertising cookies. In that case, when you send an enquiry, your email address and phone number are also shared with Meta in hashed form (see "Advertising with Meta").
| Purpose | Data | Legal basis (GDPR) | How long |
|---|---|---|---|
Replying to your enquiry | Name, email address, phone number (optional), your message, and the language of the page you wrote from | Steps you ask us to take before a possible purchase, Art. 6(1)(b) | 24 months after our last contact, or longer if you go on to buy |
Translating your enquiry and drafting our reply | Your name, your message and the page language, sent to an AI model. Not your email address or phone number | Our legitimate interest in answering quickly, in your language, Art. 6(1)(f) | Not kept by Vercel. Kept by OpenAI for up to 30 days for abuse monitoring |
Protecting the contact form from spam | Your IP address | Our legitimate interest in keeping the form usable, Art. 6(1)(f) | 15 minutes |
Running the website securely | IP address, browser and the pages requested, in the host's server logs | Our legitimate interest in a working, secure site, Art. 6(1)(f) | 1 day |
Counting visits without cookies (Vercel Web Analytics) | Pages viewed, the site you came from, approximate location, browser and device type. A visitor is recognised by a hash of the request, not a cookie | Our legitimate interest in knowing which pages are read, Art. 6(1)(f) | The hash is discarded after 24 hours |
Measuring how the site is used (Google Analytics) | Pages viewed, time on the site, approximate location, browser and device, and a random ID stored in a cookie. Google Analytics does not log or store IP addresses | Your consent in the cookie banner, Art. 6(1)(a) | Cookies: 13 months. Visitor-level data at Google: 2 months |
Measuring and targeting our ads on Facebook and Instagram (Meta Pixel) | The pages you view, your IP address, browser and device, and a random ID stored in a cookie. When you send an enquiry: that you sent one, and your email address and phone number in hashed form, never your name or message. If you use Facebook or Instagram in the same browser, Meta can link your visit to your account | Your consent in the cookie banner, Art. 6(1)(a) | Cookies: 90 days. Visit data at Meta: up to 2 years |
Showing the site's typeface (Adobe Fonts) | Your IP address, used to deliver the font and not stored, and the site's address | Our legitimate interest in a consistent design, Art. 6(1)(f) | Adobe does not store the IP address |
Remembering your cookie choices | Which cookies you accepted or rejected, and when, kept in your browser | Needed to respect and prove your consent, Art. 6(1)(c) and Art. 7(1) | 6 months |
If you email or phone us directly, we handle what you tell us in the same way as a form enquiry.
Cookies and browser storage
The site sets cookies only for what you accept in the cookie banner: analytics, advertising, or both. Until you choose, it sets none at all.
| Name | Set by | What it does | How long | Needs your consent |
|---|---|---|---|---|
| Creta Hills | Remembers which cookies you accepted or rejected, and when | 6 months, then we ask again | No: it is how we respect your choice |
| Google Analytics | Recognises a returning browser by a random ID | 13 months from your first visit | Yes |
| Google Analytics | Keeps track of the current visit | 13 months from your first visit | Yes |
| Meta (Meta Pixel) | Recognises a returning browser by a random ID, to measure our ads | 90 days | Yes |
| Meta (Meta Pixel) | Set only when you arrive by clicking one of our ads, to record that click | 90 days | Yes |
Meta's own cookies, such as | Meta | If you use Facebook or Instagram in this browser, Meta can read them to link your visit to your account | Set by Meta, see Meta's cookie policy | Yes: Meta is only contacted if you accept advertising cookies |
Vercel Web Analytics and Adobe Fonts set no cookies.
Changing your mind. Use "Cookie settings" at the bottom of any page to reopen the banner and turn analytics or advertising on or off. If you withdraw consent, the tool concerned stops at once and its cookies on this site are deleted from your browser. Cookies Meta keeps on facebook.com are managed in your Facebook or Instagram settings, or in your browser.
Who processes data for us
These providers handle data on our behalf, under contracts that bind them to protect it. Several are in the US; the last column says what protects your data when it leaves the EU.
| Provider | What it does for us | Data leaves the EU? | Safeguard |
|---|---|---|---|
Vercel Inc. (US) | Hosts the website, counts visits without cookies, and passes enquiries to the AI model | Yes, US | EU-US Data Privacy Framework, and Standard Contractual Clauses in Vercel's data processing agreement |
OpenAI, through Vercel's AI Gateway | Translates enquiries and drafts replies for our team to edit | Yes, US | Standard Contractual Clauses in Vercel's data processing agreement, with OpenAI as Vercel's sub-processor |
Supabase Pte. Ltd (Singapore) | Stores contact form enquiries | No: stored in Ireland (EU) | Standard Contractual Clauses |
Upstash, Inc. (US) | Holds the contact form's 15-minute spam counters | Possibly, US | EU-US Data Privacy Framework, and Standard Contractual Clauses as a fallback |
Google Cloud EMEA Limited (Ireland), Google Workspace | Our email: enquiry notifications and our replies | Possibly, US | Standard Contractual Clauses; Google LLC is certified under the EU-US Data Privacy Framework |
Google Ireland Limited, Google Analytics | Visit statistics, only if you accept analytics cookies | Yes, US | EU-US Data Privacy Framework, and Standard Contractual Clauses as a fallback |
Adobe Systems Software Ireland Limited, Adobe Fonts | Serves the site's typeface | Yes, US | EU-US Data Privacy Framework and Standard Contractual Clauses |
Apart from Meta, and only if you accept advertising cookies (see the next section), we share personal data with no one else, unless the law requires it.
Advertising with Meta
If you accept advertising cookies, the Meta Pixel sends information about your visit (listed under "What we collect and why") to Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We use it to measure how our ads on Facebook and Instagram perform and to show our ads to people who have visited the site. Meta also uses it for its own purposes, such as improving how it delivers ads.
Joint responsibility. For collecting this data on our site and sending it to Meta, we and Meta are joint controllers under Art. 26 GDPR. In the Controller Addendum we have agreed with Meta how that responsibility is shared: you can exercise your rights with us or directly with Meta. What Meta does with the data once it has received it is Meta's own responsibility, described in Meta's Privacy Policy, which also explains how to contact Meta's data protection officer.
Transfers. Meta may transfer the data to Meta Platforms, Inc. in the US, which is certified under the EU-US Data Privacy Framework. Meta also relies on Standard Contractual Clauses.
What we share from the contact form. When you send an enquiry, the Meta Pixel passes Meta your email address and your phone number (if you gave one), hashed with SHA-256 in your browser before they leave it. A hash cannot be read as an address, but Meta compares it with the details of its own users: that is how it can link your enquiry to your Facebook or Instagram account and tell us whether you came from one of our ads. We never send your name or your message, and we do not upload customer lists to Meta.
Your rights
You can ask us, free of charge, to:
- give you a copy of the personal data we hold about you;
- correct it if it is wrong;
- delete it, unless the law requires us to keep it;
- restrict how we use it, for example while a complaint is looked into;
- send it to you, or to another company, in a common file format;
- stop using it where we rely on our legitimate interests.
Where we rely on your consent (analytics and advertising cookies), you can withdraw it at any time through "Cookie settings". Withdrawing does not affect what happened before.
Email info@cretahills.com to use any of these rights. We reply within one month and may first ask you to confirm who you are.
Complaints. If you think we have mishandled your data, please tell us first so we can put it right. You can also complain to the Cyprus data protection authority, or to the authority in the EU country where you live or work: Commissioner for Personal Data Protection, Kypranoros 15, 1061 Nicosia, Cyprus, +357 22 818456, commissioner@dataprotection.gov.cy, gov.cy/dataprotection.
Security, children and changes
Security. The site is served only over HTTPS. Enquiries are stored in a database that only our team can reach, and the contact form is rate-limited against automated abuse.
No decisions by machine. An AI model helps us translate enquiries and draft replies, but a person reads every enquiry and writes or approves every reply. We make no decisions about you by automated means alone.
Children. The site is meant for adults considering a property purchase. We do not knowingly collect data from anyone under 18.
Other websites. Links to other sites, such as Google Maps or RG Village Crete, are covered by those sites' own privacy policies. Nothing is sent to them unless you click the link.
Changes. We will update this page when what we collect, or the services we use, change, and show the date of the latest version at the top. If a change affects the cookies we ask you about, the cookie banner will ask for your choice again.