Get my offer

Privacy notice

Last updated 13 November 2026 · Version PN-2026-11-v10

This notice explains what personal data Etimo collects, why, who receives it, how long we keep it and what your rights are.

In short

  • We use your details to arrange and carry out your check, and to get paid.
  • No ad trackers. Analytics only if you accept it in the cookie banner.
  • We never sell your data.
  • Your report goes to a repair team only if you ask for a repair price.

1. Who is responsible

The controller is ONMIR LTD, trading as Etimo, company number HE 496247, registered office 27 Zeus, Olympus Village, Flat/Office 67A, Tsada, 8540 Paphos, Cyprus.

For any privacy question, write to [email protected] with the subject "Privacy", or call +357 9791 6892. We have not appointed a data protection officer, as the law does not require one for our work.

2. What we collect and why

  • Your booking request

    What
    The check, your home type and size, extras, district and town, your dates, when your handover or purchase is due, your name, phone number, how we should confirm, your email if you give it, where you heard about us, your early-start request, when you accepted the booking terms, and the total and price list you were shown.
    Why
    To answer your request, confirm a date, carry out the check, send the invoice and keep proper records.
    Legal basis
    Contract, and the steps you ask for before it (GDPR Art. 6(1)(b)).
    How long
    6 years after the check, the time limit for legal claims. If no booking follows, 6 months after your request.

  • How you found us

    What
    The code of the link or printed sheet you came from (for example a law office’s sheet), campaign tags in the link, the website you came from (its domain only), and the page version you saw.
    Why
    To see which channels and page versions bring bookings. A law office never learns from us that you booked. Offices only see total numbers.
    Legal basis
    Our legitimate interest in measuring our own marketing (Art. 6(1)(f)).
    How long
    With your booking request, for the same time.

  • Protection against spam and abuse

    What
    A coded fingerprint of your IP address (a keyed hash). We never store the IP address itself.
    Why
    To limit how many requests one network can send (5 an hour) and one phone number can send (3 a day), and to stop bots.
    Legal basis
    Our legitimate interest in keeping the service safe (Art. 6(1)(f)).
    How long
    48 hours.

  • Booking page measurement

    What
    Only while bookings are open, two events: you opened the booking page, and you saw a price for the first time, with the answers you chose and the total. No name, phone or email. Each event carries a coded random visit code and a coded IP address. Bots and link previews are not counted.
    Why
    To see how many visitors who see a price go on to book, and to find problems in the booking steps. An event can be matched to a booking request with exactly the same answers.
    Legal basis
    Our legitimate interest in improving the booking page (Art. 6(1)(f)).
    How long
    13 months. The coded IP address is deleted after 48 hours.

  • The visit and your report

    What
    Photos and notes from the visit, the findings, your report, the works list or snag list. Photos may show furniture or belongings in the home.
    Why
    To carry out the check and give you your report.
    Legal basis
    Contract (Art. 6(1)(b)).
    How long
    10 years after the check.

  • Invoices and payments

    What
    Your name and contact details, the check, the amount, the date and how you paid.
    Why
    To keep our accounts and meet tax law.
    Legal basis
    Legal obligation (Art. 6(1)(c)).
    How long
    10 years.

  • Messages and calls

    What
    What you write or tell us on WhatsApp, by email or by phone.
    Why
    To answer you and arrange your check.
    Legal basis
    Contract (Art. 6(1)(b)), or our legitimate interest in answering questions (Art. 6(1)(f)).
    How long
    With your booking, for the same time. If no booking follows, 6 months.

  • Your download and Property Brief news

    What
    Your email address, when you asked and when you opened the link, how you found us (the website you came from, its domain only, campaign tags in the link, and your answer to "How did you hear about us?" if you gave one), and a coded IP address.
    Why
    To send you one email with a link to what you asked for (the document checklist, or a sample report), and one email on the day free Property Briefs open. Opening the link confirms that the address is yours. We also count how many people ask and from which channels.
    Legal basis
    Your request and consent (Art. 6(1)(a)). You can withdraw it at any time: reply to any of our emails or write to us.
    How long
    If you do not open the link: 7 days. If you do: until we send the email that Briefs are open, or 6 months, whichever comes first. The coded IP address is deleted after 48 hours. Counts without your email: 13 months.

  • Property Brief requests

    What
    What you send us by email: your name and email address, the address or title deed details of the home, and anything else you write. When you tap the request button we also count the tap, with the link code and how you found us, but no personal details.
    Why
    To prepare your free Property Brief and send it to you.
    Legal basis
    Your request (Art. 6(1)(b)).
    How long
    6 months, unless a booking follows. Then with your booking, for the same time.

  • Grant checklist email

    What
    Your email address, when you asked and when you opened the link, how you found us (the website you came from, its domain only, and campaign tags in the link), and a coded IP address. If you tick "Include my estimate in the email": the works you picked, their sizes, the grant type and the estimate from the grant checker, so the email can show them. Your postcode, residence and priority group are never sent with it.
    Why
    To send you one email with a link to the grant checklist (with your estimate, if you ticked the box), and at most one more email: if the 2026 Save and Upgrade Homes budget runs out early or a new round opens. Opening the link confirms that the address is yours. We also count how many people ask and from which channels.
    Legal basis
    Your request and consent (Art. 6(1)(a)). You can withdraw it at any time: reply to any of our emails or write to us.
    How long
    If you do not open the link: 7 days. If you do: until we send that one later email, or 6 months, whichever comes first. Your estimate, if included, is deleted with your email address. The coded IP address is deleted after 48 hours. Counts without your email: 13 months.

  • Free grant check requests

    What
    What you send us on WhatsApp or by email. When you tap a free grant check button we also count the tap, with the link code, whether you chose WhatsApp or email, the page you came from, how you found us (the website you came from, its domain only, and campaign tags in the link) and a coded IP address, but no name. Your answers in the grant checker stay in your browser and are not sent to us. When you open WhatsApp from the result, your browser builds the message with your works and estimate; it goes from you to WhatsApp, not through our website. Once we switch it on, we also count how many people reach each step of the grant checker: a daily total per step and link code, with no IP address, no identifier and none of your answers.
    Why
    To answer your question about the home energy grant. We also count how many people ask, from which channels, and at which step of the checker people stop.
    Legal basis
    Your request (Art. 6(1)(b)).
    How long
    Your messages: 6 months, unless a booking follows. Then with your booking, for the same time. The coded IP address is deleted after 48 hours. Counts without your details: 13 months. Daily step totals: 25 months.

  • District waiting list

    What
    Your phone number, the district and the link code.
    Why
    To send you one WhatsApp message when we start checking homes in your district.
    Legal basis
    Your consent (Art. 6(1)(a)). You can withdraw it at any time.
    How long
    Until we send that message, or 6 months, whichever comes first.

  • Home tips

    What
    Your email address or phone number, if you ticked a box for tips.
    Why
    To send home tips about once a month.
    Legal basis
    Your consent (Art. 6(1)(a)). Unsubscribe or tell us to stop at any time.
    How long
    Until you unsubscribe. Your consent is kept with your request while it lasts. After you unsubscribe, a request that never became a booking is deleted 6 months after it was made.

  • Visits to this website

    What
    Your IP address, browser type, the page address including any link codes, and the time. Collected by our host.
    Why
    To deliver the pages and keep the website secure.
    Legal basis
    Our legitimate interest in running a secure website (Art. 6(1)(f)).
    How long
    About 1 day in our host’s logs.

  • Your cookie choice

    What
    A random code stored in your browser (cookie et_consent), your choice, the date, the banner version, the page language and the page address without link codes. No IP address.
    Why
    To remember your choice and to prove what you chose.
    Legal basis
    Legal obligation to prove consent (Art. 6(1)(c) with Art. 7(1)).
    How long
    In your browser: 12 months after an Accept, 6 months after a Reject. Our record: as long as we rely on your choice, plus 12 months.

  • Analytics, only with your consent

    What
    Pages you visit (without access codes or anything you typed in the address), clicks, the referring website and campaign tags, browser and device type, an approximate location from your IP address (PostHog and Google Analytics do not store the IP address), and, in PostHog only, recordings of your session with all text and every typed field hidden. Random codes in cookies recognise your browser on later visits. No name, email or phone number. Tools: PostHog and Google Analytics.
    Why
    To count visits and see where our pages and the booking form are hard to use.
    Legal basis
    Your consent (Art. 6(1)(a)). Withdraw it any time with "Cookie settings" at the bottom of every page.
    How long
    PostHog: events 12 months, session recordings 1 month. Google Analytics: user-level data 2 months; totals in reports longer. The cookies in your browser: up to 12 months.

  • Withdrawals

    What
    Your booking reference, name, the email or phone for the acknowledgement, your statement, the date and time, and a coded IP address.
    Why
    To record your withdrawal, send the acknowledgement and refund anything you paid.
    Legal basis
    Legal obligation under consumer law (Art. 6(1)(c)).
    How long
    With your booking, for the same time. If the reference matches no booking, 6 months. The coded IP address is deleted after 48 hours.

  • If you ask for a repair price or a civil engineer

    What
    Your report and contact details.
    Why
    Only after you tick a box to ask for a quote: we send them to the repair team you choose, or to the civil engineer you agree to. They then use your data under their own responsibility.
    Legal basis
    Your request and consent (Art. 6(1)(a)).
    How long
    Our copy as for the booking. The repair team or engineer keeps theirs under their own rules.

If someone books for you, for example your partner or your lawyer, they give us your details. We use them only for your check. Please make sure they show you this notice.

3. How page tests work

Sometimes we test two versions of a page, for example with or without a table of typical totals. Prices are the same in every version.

  • Our server picks the version from a random code it adds to the page address. If you came from an ad, it uses the ad’s click code instead, so you see the same version each time. We never store the ad click code.
  • We store the version you saw with your booking request, and a coded form of the random code with the page events.
  • Nothing is stored on your device. No profile is built and no decision about you is made.

4. Who receives your data

These companies work for us under data processing agreements and use your data only on our instructions:

  • Your inspector

    What they do
    Carries out the visit and writes the inspector’s part of your report for us, under a data processing agreement. The inspector uses your details only for your order and, only if you ask for a repair price, to coordinate it with the repair teams Etimo works with. The inspector is paid for that work only if you hire them.
    Where
    Cyprus

  • Vercel Inc.

    What they do
    Hosts this website. Our server code runs in Frankfurt, Germany. Pages travel through Vercel’s worldwide network. Vercel keeps technical request logs for about one day.
    Where
    EU and USA
    Safeguard
    EU–US Data Privacy Framework, and standard contractual clauses in Vercel’s data processing agreement

  • Supabase (Supabase Pte. Ltd.)

    What they do
    Runs our database. Booking requests, withdrawals, Property Brief email sign-ups and page events are stored in Frankfurt, Germany.
    Where
    Stored in the EU. Support staff outside the EU may access it to fix problems.
    Safeguard
    Standard contractual clauses in Supabase’s data processing agreement

  • Google Cloud EMEA Limited (Google Workspace)

    What they do
    Hosts the [email protected] mailbox, where we receive and send email about your booking and your Property Brief.
    Where
    Ireland (EU), with transfers to Google LLC in the USA
    Safeguard
    EU–US Data Privacy Framework, and standard contractual clauses in Google’s data processing terms

  • Resend (Plus Five Five, Inc.)

    What they do
    Sends our automatic emails from mail.etimo.cy: booking and withdrawal emails, the email with your Property Brief download link, and the one email on the day Property Briefs open. It does not track opens or clicks.
    Where
    USA
    Safeguard
    EU–US Data Privacy Framework, and standard contractual clauses in Resend’s data processing agreement

  • PostHog Inc.

    What they do
    Measures how this website is used, only if you accept analytics in the cookie banner: page visits, clicks and recordings of sessions with all text hidden. No name, email or phone number is sent to PostHog; our proxy forwards no cookies, and PostHog is set not to store IP addresses.
    Where
    Servers in Frankfurt, Germany (EU). PostHog is a US company and may access data from the USA
    Safeguard
    EU–US Data Privacy Framework, and standard contractual clauses in PostHog’s data processing agreement

  • Google Ireland Limited (Google Analytics)

    What they do
    Counts visits to this website and where they come from, only if you accept analytics in the cookie banner. Page addresses are sent without access codes or anything you typed. Advertising features, Google signals and ad personalisation are off. No name, email or phone number is sent. Google uses the IP address for an approximate location (country or city) and, for visitors from the EU, does not store it.
    Where
    Collected through servers in the EU; stored on Google servers worldwide, including Google LLC in the USA
    Safeguard
    EU–US Data Privacy Framework, and standard contractual clauses in Google’s data processing terms

These receive data only in the cases described:

  • The Professional named in your Order Form

    What they do
    A civil engineer or architect registered with ETEK who does and signs their own services. For your order only, we share your contact details, the property address, your documents and photos. The Professional is a separate controller with their own privacy notice, available on request (General Terms 6).
    Where
    Cyprus

  • WhatsApp Ireland Limited

    What they do
    Only if you choose WhatsApp. We use a WhatsApp Business account named “Etimo bookings”, on our bookings number, to confirm dates and send your report and invoice. Messages are end-to-end encrypted. WhatsApp processes contact details and message data.
    Where
    EU, with transfers to WhatsApp LLC and Meta Platforms, Inc. in the USA
    Safeguard
    EU–US Data Privacy Framework, with standard contractual clauses as the fallback

  • Stripe Payments Europe, Limited

    What they do
    Only if you pay online. Stripe runs our checkout page and processes card, wallet and bank payments. We never see your full card number. Stripe also uses payment data for its own legal duties, such as fraud checks, as a separate controller.
    Where
    Ireland (EU), with transfers to Stripe, LLC in the USA
    Safeguard
    EU–US Data Privacy Framework, with standard contractual clauses as the fallback

  • PayPal (Europe) S.à r.l. et Cie, S.C.A.

    What they do
    Only if you choose PayPal. PayPal runs its own payment pages and processes your PayPal, card or bank payment. We receive your name, email and the payment status, never your card or bank details. PayPal uses payment data under its own privacy statement (paypal.com/privacy), as a separate controller, also for fraud checks and its legal duties.
    Where
    Luxembourg (EU), with transfers within the PayPal group, including PayPal, Inc. in the USA
    Safeguard
    PayPal Binding Corporate Rules approved by EU data protection authorities

  • The repair team you choose to ask for a quote

    What they do
    Only after you tick a box to ask for a repair price. The repair team receives your report and contact details and then uses them under its own responsibility.
    Where
    Cyprus

  • Our bank

    What they do
    Only if you pay by bank transfer. It receives the transfer and your name as the payer.
    Where
    EU

  • Our phone network operator

    What they do
    Carries calls and messages to and from our bookings number.
    Where
    Cyprus

  • Our accountants and auditors

    What they do
    Keep our books and check our accounts. They see invoices and payments.
    Where
    Cyprus

  • Tax authorities, courts and police

    What they do
    Only when the law requires us to share data.
    Where
    Cyprus

We do not share your data with advertisers or social networks, and we do not sell it.

5. Transfers outside the EU

Some providers are based in the USA or can access data from outside the EU: Vercel, Supabase support staff, Resend, Google (for our mailbox), Stripe (Stripe, LLC), PayPal (within the PayPal group, under its Binding Corporate Rules), PostHog and Google Analytics (only with your analytics consent), and WhatsApp with Meta. These transfers are protected by the EU–US Data Privacy Framework (an EU adequacy decision) or by the EU standard contractual clauses (Commission Decision 2021/914). Ask us for a copy of these safeguards.

6. Your rights

You have the right to:

  • see the data we hold about you and get a copy;
  • have wrong data corrected;
  • have your data deleted, unless we must keep it, for example invoices;
  • have the use of your data restricted;
  • get the data you gave us in a common digital format;
  • withdraw your consent at any time. This does not affect what we did before.

Write to [email protected]. It is free. We answer within one month.

Your right to object

You can object at any time, for reasons that concern your situation, to any use of your data that is based on our legitimate interest (GDPR Art. 21). We then stop, unless we have compelling legitimate grounds or need the data for legal claims. You can always stop marketing messages, with no reason needed.

You can also complain to the Commissioner for Personal Data Protection: 1 Iasonos Street, 1082 Nicosia, Cyprus (postal: P.O. Box 23378, 1682 Nicosia). Phone +357 22 818 456, [email protected], dataprotection.gov.cy. If you live in another EU country, you can also complain to the authority there.

7. What you must give us

To book, we need your name, phone number, district, dates and how to confirm. Without them we cannot arrange your check. Your email is optional. Tips and the waiting list are optional. For the checklist or sample report we need your email address; "How did you hear about us?" is optional.

8. No automated decisions

We do not make decisions about you by automated means. The booking form applies fixed rules that are the same for everyone, for example which dates are offered, whether your district is open and whether a date needs the early-start box. A person handles every booking.

9. Cookies

This website stores your cookie choice, and with your consent an analytics cookie. No analytics tool runs and nothing is stored on your device before you choose. Our server still counts page requests without storing anything on your device, as described above. Details: Cookie policy.

10. How we protect your data

Data travels encrypted. Your browser never writes to our database: only our server does, through checked functions. Access is limited to the people who need it for your check. Our services are for adults, and we do not knowingly collect data about children.

11. Changes to this notice

If we change how we use your data, we update this notice and its date and version. If a change matters to you, for example a new use of your data, we tell you before it applies.