privacy policy
BBF GLOBAL LTD
1.
who we are and what this policy covers
BBF GLOBAL LTD ("bbf:", "we", "us") is the controller of the personal data described in this Policy. Our contact details are set out in Section 10.
This Policy explains how we handle personal data when you use the bbf.com website, including its language versions and project pages, and our mobile applications, which present the same information about our company, developments and services. It also covers enquiries you send us by web form, email, telephone or messaging services.
The website and the applications are informational. They do not require an account and do not process payments.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 and Cyprus data protection law.
2.
what we collect
Data you provide. Your name, email address, telephone number, preferred contact method, the content of your enquiry and any preferences you tell us about (such as project, location or property type). If you apply for a vacancy, we also receive the information contained in your CV and application.
Data collected automatically. IP address, device and browser or application type, and information about the pages and screens you view and the actions you take, collected through cookies and similar technologies and through standard server and application logs.
Data from third parties. Contact and enquiry details may reach us through agents, partners, recruitment platforms and our group companies.
We do not ask for special categories of personal data through the website or the applications, and we ask that you do not include such information in free-text fields.
3.
why we use your personal data and on what basis
We use your personal data only where we have a lawful basis to do so. Depending on the circumstances, we process your personal data for the following purposes:
Responding to enquiries and providing information
We use your personal data to respond to your enquiries, provide requested information and materials, and arrange viewings or consultations. We process this information in order to take steps at your request before entering into a contract or, where applicable, on the basis of your consent. Contact details marked as required are necessary for us to respond to your request.
Preparing and performing agreements
Where you purchase, lease or receive services relating to a property, we process your personal data as necessary to prepare and perform the relevant agreement. The legal basis for this processing is the performance of a contract. Any additional documentation required for this purpose is collected outside the website and applications.
Meeting legal and regulatory requirements
We process personal data where necessary to comply with our legal, regulatory, tax and accounting obligations. The legal basis for this processing is compliance with a legal obligation.
Operating and improving our website and applications
We use personal data to operate, maintain and improve our website and applications, including measuring how they are used. We rely on our legitimate interests for this processing and, where non-essential cookies or similar technologies are involved, on your consent.
Providing information about our projects, services and events
We may use your contact details to send you information about our projects, services and events. We do this on the basis of your consent or, in the case of existing clients where applicable, our legitimate interests. You may opt out of receiving these communications at any time.
Recruitment
If you apply for a vacancy, we process your personal data in order to consider your application and take steps prior to entering into a contract. If we would like to retain your information in our talent pool for future opportunities, we do so with your consent.
Handling complaints and legal claims
We may process personal data where necessary to handle complaints or to establish, exercise or defend legal claims. We rely on our legitimate interests for this processing.
Withdrawing your consent
Where we rely on your consent to process personal data, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before your consent was withdrawn.
Where we rely on consent, you may withdraw it at any time; this does not affect processing carried out beforehand.
4.
mobile applications
The applications may ask for device permissions — such as notifications, location, camera or file access — where a feature requires them. Permissions are optional and can be changed at any time in your device settings; the main content of the applications remains available without them.
The applications may use device identifiers and analytics or diagnostic tools to measure use and identify faults. Where such tools are not necessary for the applications to function, they are used with your consent, and on iOS in accordance with the App Tracking Transparency framework.
The applications are distributed through the Apple App Store and Google Play, which process data relating to your download and use of the applications under their own privacy policies.
5.
cookies and similar technologies
We use cookies and similar technologies that are necessary for the website to function, together with cookies for preferences, analytics and marketing. Cookies that are not necessary are used with your consent, which you can give or change through the cookie settings on the website. You can also delete or block cookies through your browser.
Pages containing embedded third-party content, such as video, maps or social media components, may set cookies of those providers.
6.
sharing
We disclose personal data only where there is a need to do so, and typically to:
• companies within the bbf: group;
• service providers who act on our instructions, such as hosting, content delivery, CRM, email and messaging, analytics and IT support providers;
• professional advisers and business partners involved in a transaction or service, such as lawyers, auditors, banks, agents and contractors;
• public authorities, where disclosure is required by law or necessary to establish or defend legal claims;
• a purchaser or investor in connection with a corporate transaction.
We do not sell personal data.
7.
international transfers
Some of our service providers operate outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on an adequacy decision of the European Commission or on standard contractual clauses approved by the European Commission, or on another transfer mechanism permitted under the GDPR.
8.
retention and security
We keep personal data for as long as it is needed for the purposes described above and, after that, for the period required by applicable law or by the limitation periods relevant to potential claims. Enquiry and marketing data is kept while the contact remains relevant or until you ask us to stop. Data that is no longer needed is deleted or anonymised.
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse, taking into account the nature of the data and the risks involved. No method of transmission or storage can be guaranteed to be completely secure.
9.
your rights
Subject to the conditions set out in the GDPR, you have the right to:
• request access to your personal data and a copy of it;
• request correction of inaccurate or incomplete data;
• request erasure or restriction of processing;
• request portability of data you provided to us;
• object to processing based on our legitimate interests;
• object to direct marketing at any time;
• withdraw consent at any time.
We do not take decisions producing legal or similarly significant effects based solely on automated processing.
To exercise your rights, write to [email protected] or to our postal address. We may ask for information to confirm your identity, and we will respond within the period provided by law.
If you believe your data has not been handled correctly, we would like the opportunity to address this first. You may also lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy) or with the supervisory authority in your country of residence.
10.
children, third-party links and changes
The website and the applications are not directed at persons under 18, and we do not knowingly collect their personal data.
The website and the applications contain links to third-party sites and social media platforms. We are not responsible for their content or their handling of personal data.
We may update this Policy from time to time. The current version is published at bbf.com/privacy and within the applications, with the effective date shown above.
11.
contact
28 Ambelakion Street, Germasogeia, 4046 Limassol, Cyprus
Email: [email protected]
Telephone: +357 (25) 315 300
Effective date: August 1, 2026