Privacy Policy

Soulakis Bros Constructions LTD ("we", "us", "our") operates soulakisbros.com (the "Website"). This Privacy Policy explains what personal data we collect when you visit the Website, contact us or place an order, why we collect it, how we use it, and the rights you have under Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and Law 125(I)/2018 of the Republic of Cyprus.

This policy applies to our online activity on the Website only. It does not cover information we collect offline, such as at our premises or over the telephone, nor the practices of other websites we link to.

Last updated: 16 October 2026.

Who we are

Soulakis Bros Constructions LTD is the data controller for your personal data. This means we decide why and how your personal data is processed.

  • Registered address: Chlorakas Ave, Chlorakas, Pafos 8220, Cyprus
  • Email: info@soulakisbros.com
  • Telephone: +357 99131475, +357 95098448
  • Website: https://www.soulakisbros.com

Information we collect

We collect only the personal data we need in order to answer you, fulfil your orders, understand how the Website is used and run our business. Most of it comes directly from you.

Information you give us

  • When you use the enquiry form on the Website we collect your name, email address, telephone number (if you provide it), the type of project you are interested in, and the content of your message.
  • If you contact us by email or telephone we collect whatever information you choose to give us in that conversation.

When you place an order

  • We collect your name, email address, delivery address, telephone number and the contents of your order, so that we can process and deliver it.
  • Payment is made by card through Stripe. You enter your card details directly into Stripe’s payment form; your full card number and security code are never sent to or stored on our systems.

How the Website is used (analytics)

  • We count page views with PostHog, anonymously and without needing your consent: no cookies are set and nothing is written to your browser, and the count runs whether or not you answer the cookie banner. We record only which page you viewed and when, the page that referred you to us, your language, and general technical details such as browser, operating system and screen size.
  • We do not identify visitors. For visits counted this way, PostHog derives an anonymous visitor id on its European Union servers from technical request data (mainly your IP address and browser information) using a salt that changes daily; the input data is deleted after processing, so visits cannot be linked across days and cannot be linked back to you. If you accept analytics, PostHog may additionally use local storage and cookies to recognise repeat visits and measure usage more accurately. Declining keeps the counting above, with nothing stored on your device. We do not record clicks, sessions, mouse movement or heatmaps, and we never include your contact details or order data in analytics.

Information collected automatically

  • Our hosting provider records technical data in server logs when you visit the Website: your IP address, browser type and version, the pages you viewed, the date and time of your visit, and the page that referred you to us. We use these logs to keep the Website secure and working properly.

Information stored on your device

  • If you use the shop, your basket is saved in your browser’s local storage on your own device. It is never sent to us.
  • If you consent to analytics, PostHog stores a small amount of information in your browser’s local storage and cookies so that repeat visits can be recognised and usage can be measured.

How we use your information and why

For each purpose below we rely on one of the legal bases set out in Article 6 of the GDPR.

  • Responding to your enquiries and providing a quotation — the steps taken at your request before entering into a contract, and our legitimate interest in running our business (Article 6(1)(b) and 6(1)(f)).
  • Processing your order, taking payment, delivering your purchase and handling returns — the performance of our contract with you (Article 6(1)(b)).
  • Understanding how the Website is used so that we can improve it — our legitimate interest in counting an anonymous audience (Article 6(1)(f)); if you opt in to analytics, additionally your consent (Article 6(1)(a)) for the extra measurement described above.
  • Operating, securing and maintaining the Website — our legitimate interest in providing a safe and functional website (Article 6(1)(f)).
  • Keeping records of our correspondence and transactions with you — our legitimate interest in maintaining business records (Article 6(1)(f)).
  • Complying with legal and tax obligations in Cyprus — our legal obligation (Article 6(1)(c)).
  • Preventing fraud and protecting the Website — our legitimate interest and that of our payment provider (Article 6(1)(f)).

When you tick the consent box on the enquiry form you confirm that you have read this Privacy Policy. You may withdraw your consent at any time, whether for analytics or for that confirmation, by contacting us or through the cookie settings link in the footer; withdrawal does not affect the lawfulness of processing carried out before it.

How long we keep your information

We keep personal data only for as long as we need it for the purposes set out above.

  • Enquiries and correspondence: up to 24 months after our last contact with you.
  • Orders, invoices and related records: six years from the end of the financial year to which they relate, as required by Cypriot company, tax and VAT law.
  • Analytics data in PostHog: up to 12 months.
  • Server logs: up to 12 months.

When the retention period ends we delete or anonymise your data.

Who we share your information with

We do not sell, rent or trade your personal data.

We share your data only with service providers who process it on our behalf, under contract, or who process it as independent controllers:

  • Stripe, which processes card payments. Stripe’s privacy policy.
  • PostHog, our analytics provider. PostHog Cloud is hosted in the European Union and processes the data on our behalf. See PostHog’s privacy information.
  • Resend, which delivers the email sent through our enquiry form. The content of your message and your contact details are transmitted to Resend so that the email reaches us.
  • Our website host (Vercel), which stores server logs and serves the Website.
  • Where we use a courier to deliver an order, we share only the delivery details they need.

We may also disclose your data where we are required to do so by law, or to protect our rights, our property or the safety of others.

Payments

Card payments on the shop are handled by Stripe. When you pay, you submit your card details directly to Stripe through its secure payment form. We do not see, receive or store your full card number or security code.

We receive from Stripe only what we need to complete your order, such as the payment status, the card type and the last four digits of the card.

Stripe processes your personal data as an independent data controller in order to process the payment, prevent fraud and meet its own legal obligations. See Stripe’s privacy policy.

International transfers

Our analytics provider, PostHog, hosts data in the European Union, so that data does not leave the EEA.

Some of our other service providers, including Stripe and our hosting provider, process data outside the European Economic Area. Where this happens we rely on an adequacy decision of the European Commission, or on the standard contractual clauses approved by it, so that your data remains protected.

Cookies and similar storage

We use cookies and similar storage only where the law allows it and, for anything that is not strictly necessary, only where you have agreed to it.

  • Strictly necessary: your shopping basket is kept in your browser’s local storage so that it works. It never leaves your device and cannot be used to identify you.
  • Analytics: only if you consent, PostHog stores a small amount of information in local storage and cookies so that we can recognise repeat visits and measure how the Website is used. This is not strictly necessary, which is why we ask for your permission first.
  • Payment: Stripe may set its own cookies on its payment pages in order to prevent fraud. These are governed by Stripe’s own policies.

You can withdraw or change your consent at any time through the cookie settings link in the footer of every page, or by clearing cookies and local storage in your browser. We do not use advertising cookies and we do not track you across other websites.

Your rights

Under the GDPR you have the right to:

  1. Request access to the personal data we hold about you.
  2. Analytics: counting page views is always anonymous and cookieless — it sets no cookies and writes nothing to your browser, so no permission is needed for it. The only PostHog entry on your device is the record of the cookie choice you made, which is required to honour it. Detailed analytics, which uses local storage and cookies to recognise repeat visits, runs only if you accept.
  3. Ask us to delete your data.
  4. Ask us to restrict how we use your data.
  5. Object to our processing where we rely on legitimate interests.
  6. Receive your data in a structured, commonly used and machine-readable format (data portability).
  7. Withdraw your consent at any time, where processing is based on consent.

To exercise any of these rights, contact us using the details above. We will respond within one month of receiving your request.

These rights are not absolute. In some cases we may be entitled to refuse or limit a request, for example where we are legally required to keep records.

Your right to complain

If you believe that our processing of your data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority.

In Cyprus the competent authority is:

  • Office of the Commissioner for Personal Data Protection
  • Kypranoros 15, 1061 Nicosia, P.O. Box 23378, 1682 Nicosia, Cyprus
  • Telephone: +357 22818456
  • Email: commissioner@dataprotection.gov.cy
  • Website: https://www.dataprotection.gov.cy

You may also complain to the supervisory authority of the EU country where you live or work.

Children

The Website is directed at adults and is not intended for children. Under Law 125(I)/2018 of Cyprus, a child under 14 cannot give valid consent to the processing of their personal data for information society services without the authorisation of a parent or guardian.

We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be published on this page. We encourage you to review it periodically.

Contact us

If you have questions about this Privacy Policy or about how we handle your personal data, contact us:

  • Email: info@soulakisbros.com
  • Telephone: +357 99131475, +357 95098448
  • Address: Chlorakas Ave, Chlorakas, Pafos 8220, Cyprus