Privacy Policy — OLIAS Mobile App

Effective Date: 1 August 2026 Last Updated: 1 August 2026

This English version is the authoritative version of this Privacy Policy. Translations into other languages are provided for convenience only; in case of any discrepancy, the English version prevails.

This Privacy Policy explains how Olias Homes Ltd ("Olias Homes", "we", "us", or "our") collects, uses, shares and protects personal data when you download, install or use the OLIAS mobile application (the "App"), including when you create an account, save residences, submit an enquiry, or access the investor area.

This policy is specific to the App. For our website at oliashomes.com, please see our website Privacy Policy.

We are a property developer based in Paphos, Cyprus, designing, building and selling residential properties (villas and apartments) on the Paphos coast. We are committed to protecting your personal data and processing it lawfully, fairly and transparently in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Cyprus Law on the Protection of Natural Persons with regard to the Processing of Personal Data and the Free Movement of Such Data (Law 125(I)/2018).

If you do not agree with this Privacy Policy, please do not use the App.

1. Who We Are (Data Controller)

The data controller responsible for your personal data is:

Olias Homes Ltd Eleftheriou Venizelou 56 8021 Paphos Republic of Cyprus

Email (general): info@oliashomes.com Email (privacy and data subject requests): info@oliashomes.com Telephone: +357 26 222 288 Website: https://oliashomes.com

For any question about this Policy or your personal data, please write to us at the email or postal address above.

2. What Personal Data the App Collects

The App collects personal data in the following ways:

2.1 Information You Provide When Creating an Account

When you register for an account in the App, we collect:

• Identification data: first name, last name
• Account credentials: email address and a password (your password is stored in encrypted/hashed form by our authentication provider and is never visible to us)
• Contact data: telephone number (including country dialing code)
• Consent records: your acceptance of our terms and any marketing consent
• Language preference

Creating an account lets you save residences, request property details and, where granted, access the investor area.

2.2 Profile Photo (Optional)

If you choose to add a profile picture, the App will — only after you grant permission — access your device's photo library so you can select an image. The selected image is uploaded to and stored in our secure file storage (a private storage bucket) and is used solely to display your profile picture within the App. You can change or remove it at any time. We do not access your photo library for any other purpose, and we do not access your camera roll in the background.

2.3 Enquiry Data

When you submit a property enquiry or request a brochure through the App, we collect your name and contact details (email, telephone), the property you are interested in, your country, your language, and any message you include. This information is sent to our sales team (info@bb-capital.com and sales@oliashomes.com) so we can respond to your enquiry, and is stored with your account where you are signed in.

2.4 Investor Area Data (Where Applicable)

If you are granted access to the investor area, we process information relating to your holdings and documents that we make available to you (for example reservation agreements and related transaction documents). This data is shown only to your authenticated account and is provided by us on a read-only basis.

2.5 Information Stored Locally on Your Device

Some information never leaves your device and is not sent to our servers, including your saved/favourite residences, your language and theme preference, and your onboarding status. This is stored in your device's secure local storage.

2.6 Information Collected Automatically

When you use the App, we process only limited technical information necessary to operate it securely, such as authentication session tokens stored securely on your device to keep you signed in. The App does not contain any advertising, tracking, or third-party analytics or crash-reporting SDKs, and we do not build marketing profiles from your use of the App. (This differs from our website, which uses cookies and analytics as described in the website Cookie Policy.)

2.7 Information Required to Complete a Property Purchase

If you decide to reserve or purchase a property, we are legally required to collect additional information to comply with Cyprus and EU anti-money-laundering ("AML"), know-your-customer ("KYC") and tax obligations, as described in our website Privacy Policy (passport/ID, proof of address, source-of-funds, tax identification, etc.). This information is processed strictly for legal compliance and for performing our contract with you.

We do not knowingly seek "special categories" of personal data (such as health, religion, ethnic origin, political opinions or biometric data). Please do not send us such data unless we specifically ask for it.

3. Why We Use Your Personal Data and Our Legal Bases

Under GDPR, we only process your personal data where we have a lawful basis. For the App, our purposes and legal bases include:

• Creating and managing your account — using identification, contact and credential data — on the basis of Article 6(1)(b) (performance of a contract / steps at your request) and Article 6(1)(f) (legitimate interest in providing a secure account).
• Displaying your profile picture — using the image you choose to upload — on the basis of Article 6(1)(a) (your consent, which you give by selecting and uploading an image).
• Responding to your enquiries and brochure requests — using identification, contact and enquiry data — on the basis of Article 6(1)(b) (pre-contractual steps) or Article 6(1)(f) (legitimate interest in answering enquiries).
• Sending you account-related emails (email confirmation, password reset) — using your email address — on the basis of Article 6(1)(b) (performance of a contract).
• Providing the investor area — using your account and portfolio data — on the basis of Article 6(1)(b) (performance of a contract) and/or Article 6(1)(f).
• Complying with AML, KYC, tax and other legal obligations — where you proceed toward a purchase — on the basis of Article 6(1)(c) (legal obligation).
• Operating, securing and improving the App — using technical data — on the basis of Article 6(1)(f) (legitimate interest in a secure, functional App).

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4. How Long We Keep Your Personal Data

We retain your personal data only for as long as necessary for the purposes for which it was collected, and in line with our retention obligations under Cyprus law:

• Account data: for as long as your account remains active. If you delete your account (see section 8), we delete or anonymise your account data, subject to the legal retention obligations below.
• Enquiries that do not lead to a purchase: up to 24 months from your last interaction.
• Reservation and sale-and-purchase records, and related investor documents: for the duration of the contract and at least 7 years thereafter, in line with Cyprus tax law. These records are retained even if you delete your App account, because we are legally required to keep them.
• AML/KYC records: 5 years from the end of the business relationship, as required by law.

When we no longer need your data and no legal retention obligation applies, we delete it or anonymise it.

5. Who We Share Your Personal Data With — App Service Providers

We do not sell your personal data. In addition to the recipients listed in our website Privacy Policy (professional advisers, banks, Cyprus authorities, etc., where you proceed toward a purchase), the App relies on the following processors, who act on our behalf under written agreements:

• Supabase — provides the App's database, user authentication and file storage (including your account data and profile picture). This data is hosted in the United Kingdom (London region, on AWS infrastructure). The United Kingdom is covered by a European Commission adequacy decision, so transfers of personal data from the EEA to the UK are permitted and GDPR-compliant.
• Resend — sends transactional emails from the App (account confirmation, password reset, enquiry notifications).
• Mapbox — provides the interactive maps that show property locations and points of interest. When the map loads, Mapbox may process technical request data (such as IP address) to serve map tiles.
• Apple App Store / Google Play — distribute the App and process data in accordance with their own privacy policies.

All third parties that process personal data on our behalf do so under written contracts that meet the requirements of Article 28 GDPR.

6. International Transfers

Some of our service providers may process data outside the European Economic Area ("EEA"), including in the United Kingdom. Where this occurs, we ensure that an appropriate safeguard under Chapter V GDPR is in place — for the United Kingdom, the European Commission's adequacy decision; for other providers, EU Standard Contractual Clauses or another lawful transfer mechanism. You can request a copy of the relevant safeguards by contacting us at info@oliashomes.com.

7. How We Protect Your Personal Data

We implement appropriate technical and organisational measures to protect your personal data, including:

• HTTPS/TLS encryption for data transmitted by the App
• Passwords stored only in hashed/encrypted form by our authentication provider
• Authentication tokens stored in the device's secure storage
• Private storage buckets for profile pictures and investor documents
• Access controls limiting personal data to staff who need it
• Vendor due diligence for our service providers

No method of transmission or storage is completely secure. If you believe your interaction with us is no longer secure, please contact us immediately at info@oliashomes.com.

8. Your Rights

If you are located in the EEA, the UK or Switzerland, you have the rights of access, rectification, erasure, restriction, objection, data portability, and to withdraw consent, as described in full in our website Privacy Policy.

Account deletion: You can delete your account and associated personal data directly in the App at any time (in your profile settings), or by contacting us at info@oliashomes.com. Please note that certain records relating to a property reservation or purchase (including investor and AML/KYC documents) must be retained for the statutory periods described in section 4, even after your account is deleted, because we are legally required to keep them.

To exercise any of these rights, please contact us at info@oliashomes.com. We will respond within one month. You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (https://www.dataprotection.gov.cy) or your local supervisory authority.

9. Children

The App is not intended for children under the age of 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at info@oliashomes.com and we will take steps to delete it.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. The updated version will be indicated by a new "Last Updated" date. Material changes will be brought to your attention within the App or by email where appropriate.

11. Contact Us

If you have any questions, comments or complaints about this Privacy Policy or how we handle your personal data, please contact us:

Olias Homes Ltd Eleftheriou Venizelou 56, 8021 Paphos, Cyprus Email: info@oliashomes.com