Last updated: 21/07/2026
Effective date: 21/07/2026
1. Who We Are
Maya Estate is operated by MAYA ESTATE SA ("Maya Estate", "we", "us", "our"). We run an online real estate portal that allows users to list, advertise and search for residential and commercial properties and plots of land in a range of countries. This Privacy Policy explains what personal data we collect, how and why we use it, who we share it with, how long we keep it, and the rights you have over it.
For the purposes of the EU General Data Protection Regulation (GDPR) and applicable Greek data protection law, MAYA ESTATE S.A. is the data controller of the personal data described in this policy. We are based in Thessaloniki, Greece, where our operational infrastructure is located.
- Registered office: Karatasou 1, 546 26, Thessaloniki, Greece
- Privacy contact: info@maya.estate
We take your privacy seriously. We only collect personal data that we actually need, we do not sell your data, and we process it only in the ways described in this policy or as required by law.
2. Scope of This Policy
This policy applies to personal data we process through our website, portal, mobile applications (where applicable) and related services. It does not apply to third-party websites, services or advertisers that may be linked from our platform — those are governed by their own privacy policies.
3. The Personal Data We Collect
3.1 Information you provide to us
- Account data: name, email address, telephone number, username and password when you register an account.
- Listing data: the property details, descriptions, photographs, location, price and the contact details.
- Enquiry and communication data: the content of contact forms, enquiries and messages you send to advertisers, to other users, or to our support team.
- Marketing preferences: your consent choices for receiving marketing communications.
3.2 Information we collect automatically
- Technical data: IP address and general location inferred from IP (for statistical and security purposes), only if the consent was given.
- Usage data: pages viewed, searches performed, saved searches and favourites, listings viewed, referring URLs, and interaction patterns on the platform.
- Cookies and similar technologies: as described in Section 5.
4. How and Why We Use Your Data (Purposes and Legal Bases)
We only process your personal data where we have a valid legal basis to do so. The table below sets out the main purposes and the corresponding legal basis under the GDPR.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account | Account data | Performance of a contract |
| Publish your listings and display them to other users | Listing data | Performance of a contract |
| Enable enquiries and communication between users | Contact and message data | Performance of a contract / Legitimate interests |
| Operate, secure, maintain and improve the platform | Technical and usage data | Legitimate interests |
| Personalise search results and recommendations | Usage and search data | Legitimate interests |
| Send service and transactional messages (e.g. account, listing or enquiry notifications) | Contact data | Performance of a contract / Legitimate interests |
| Send marketing communications about our products, services and promotions | Contact data, marketing preferences | Consent |
| Show you relevant advertising, including through third-party partners | Usage data, cookies | Consent |
| Meet legal, accounting and tax obligations | Identity and transaction data | Legal obligation |
| Prevent fraud and abuse and enforce our terms | Technical and account data | Legitimate interests |
Where we rely on consent (for example, marketing and advertising cookies), you can withdraw it at any time without affecting the lawfulness of processing before withdrawal. Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights, and you can object as described in Section 8.
5. Cookies and Similar Technologies
We use cookies and similar technologies to operate the platform, remember your preferences, understand how the platform is used, and — with your consent — for analytics and advertising. Essential cookies are necessary for the site to function; non-essential cookies (including analytics and advertising cookies) are only set where you have given consent, which you can withdraw at any time.
We use Google Analytics to understand how our platform is used, and Google advertising products (including Google Ads and remarketing) to show relevant advertising. For full details of the cookies we use and how to manage them, please see our Cookie Policy.
6. Sharing and Disclosing Your Personal Data
We do not sell your personal data. We share it only as described below:
- Other users of the platform: the listing information you choose to publish, and the content of enquiries you send, so that users can transact and communicate.
- Service providers (processors) acting on our behalf, such as hosting, email/SMS delivery, analytics, advertising, customer support and CRM (customer relationship management). These providers process your data only on our documented instructions and under contractual confidentiality and security obligations.
- Advertising partners, including Google, in connection with the advertising cookies described in our Cookie Policy.
- Professional advisers and auditors where necessary.
- Authorities, regulators or law enforcement where we are legally required to disclose, or to protect our rights, users or the public.
- In connection with a business transaction such as a merger, acquisition or asset sale, in which case we will ensure your data remains protected.
7. How Long We Keep Your Data
We keep personal data only for as long as necessary for the purposes it was collected for, and in line with our retention policies:
- Account data: we retain your account information for as long as it is needed to provide our services, and we delete it upon your request.
- Financial and tax records: a minimum of 10 years, as required under Greek tax law.
- Marketing data: until you withdraw consent or object.
When data is no longer needed, we securely delete or anonymise it.
8. Your Rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and receive information about how we process it (including the purposes, the categories of data, the recipients, the retention period, and — where we did not collect it from you — the source).
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten") in certain circumstances.
- Restrict processing in certain circumstances.
- Data portability — receive the data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
- Object to processing based on legitimate interests, and to object to direct marketing at any time.
- Withdraw consent at any time where processing is based on consent.
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
To exercise any of these rights, contact us at info@maya.estate. We may ask you to verify your identity before we act, to keep your data secure. We will respond within one month, as required by the GDPR.
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Hellenic Data Protection Authority (our lead supervisory authority in Greece). If you are located in another EEA country, you may also complain to your local data protection authority.
9. Automated Decision-Making and Profiling
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Where we use profiling — for example, to show relevant advertising, as described in Section 5 and our Cookie Policy — you can object at any time.
10. How We Keep Your Data Secure
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, loss or destruction. These include, where appropriate:
- Encryption of data in transit (TLS) and, where appropriate, at rest
- Access controls and role-based restrictions
- Authentication and secure credential storage
- Network protections such as firewalls, and anti-malware measures
- Logging, monitoring and regular review of our security measures
- Staff confidentiality obligations and a procedure for handling any personal data breach
No method of transmission or storage is completely secure, but we work continuously to protect your data and to detect and respond to risks.
11. Children's Data
Our platform is not directed at children and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.
12. Changes to This Policy
We may update this policy from time to time to reflect changes in our services, technology or legal requirements. We will post the updated version with a revised "last updated" date and, where changes are material, we will notify you by a notice on the platform and, where appropriate, by email.
13. How to Contact Us
If you have any questions about this policy or wish to exercise your rights, please contact us at info@maya.estate, or write to us at Karatasou 1, 546 26, Thessaloniki, Greece.