Legal
Effective date: 24 July 2026
M House is operated by Onkel Properties Ltd, trading as M House.
For the purposes of applicable data-protection law, Onkel Properties Ltd is the controller responsible for the personal data described in this Privacy Policy.
Controller: Onkel Properties Ltd
Trading name: M House
VAT number: 60048736H
Address: Stadiou 18, 6020 Larnaka, Cyprus
Email: hello@mhouse.cy
Telephone: +357 97 444085
Website: mhouse.cy
This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when a person:
This policy applies whether the interaction takes place directly through our website, through an integrated booking or payment service, through an application programming interface, or through a third-party platform used to provide an M House service.
M House is an adults-only property and our website and services are intended only for persons aged 18 or over.
We do not knowingly request or intentionally collect personal data from anyone under 18 through our website.
A person making a booking confirms that they are at least 18 years old and that every person included in the booking meets the applicable minimum-age requirement for the service booked.
If we discover that personal data has been submitted by or concerning a person under 18 without a valid legal reason, we will delete or restrict that information as appropriate.
Concerns about information relating to a person under 18 should be sent to hello@mhouse.cy.
The information we collect depends on the service used and the way a person interacts with us.
This may include:
We do not collect identity-document information merely because it is technically possible. We collect it only where it is reasonably necessary for the service, security or an applicable legal obligation.
This may include:
This may include:
Online card payments are processed through Stripe or another payment provider identified during checkout.
We do not ordinarily receive or store the complete payment-card number or card security code. Those details are entered into and processed through the payment provider's secure payment environment.
Where a person uses parking operated, managed or arranged by M House, we may collect:
We do not collect a vehicle registration number from website visitors or customers who do not use our parking.
We may retain communications sent through:
This may include the content of the message, contact details, relevant account name, timestamps and our response.
Telephone calls are not recorded unless we inform the caller before recording begins.
This may include:
When a person uses mhouse.cy, we and our technology providers may collect:
Where M House provides guest or member Wi-Fi, we or the network provider may process:
We do not use guest Wi-Fi to inspect the content of private communications. Network information may nevertheless be processed where necessary to operate and secure the network, investigate misuse or comply with law.
CCTV may operate in designated entrances, access points, parking areas, common areas or other appropriate locations at M House.
CCTV is used for:
CCTV is not used in bedrooms, bathrooms, changing areas or other places where a person reasonably expects complete privacy.
Appropriate signs are displayed in monitored areas.
We may take or receive photographs or video relating to the property, facilities, events or promotional activities.
Where an identifiable individual is the intended subject of marketing photography or video, we will obtain an appropriate permission or release unless another lawful basis clearly applies.
People attending an event may appear incidentally in general crowd or atmosphere photography. Where practical, we will inform attendees that photography or filming is taking place.
A person may object at the time or contact us afterwards at hello@mhouse.cy.
We may display reviews or ratings obtained from third-party platforms, including booking, travel, map or review services.
Depending on the platform and the review, this may include:
We may also invite customers to provide feedback directly. Users cannot upload reviews, photographs or other public content directly onto mhouse.cy unless we introduce and expressly identify such a feature in the future.
Where a person applies for work, we may collect:
Additional privacy information may be provided to successful applicants and employees.
Some information voluntarily supplied to us may reveal health, disability, allergy, dietary or accessibility information.
We ask that customers provide only information genuinely necessary for us to deliver the requested service safely and appropriately.
Where this information constitutes special-category personal data, we process it only where:
We do not use health, disability, allergy or accessibility information for advertising.
We may collect information:
A person making a booking or enquiry for another adult must have authority to provide that person's information and should make this Privacy Policy available to them.
We use identity, contact, enquiry and service information to:
Legal basis: taking steps at the person's request before entering into a contract and, where relevant, our legitimate interest in responding to genuine business enquiries.
We use personal data to:
Legal basis: performance of a contract and steps requested before entering into a contract.
We use transaction, booking and contact information to:
Legal basis: performance of a contract, compliance with legal obligations and our legitimate interests in receiving payment and preventing fraud.
We may process personal data to:
Legal basis: compliance with a legal obligation.
We use CCTV, access, parking, Wi-Fi, booking, incident and communication information to:
Legal basis: our legitimate interests in maintaining a safe and secure property, protecting our rights and preventing unlawful activity. In an emergency, processing may also be necessary to protect vital interests.
We may use booking, complaint, feedback and operational information to:
Legal basis: our legitimate interests in operating and improving M House and fulfilling our contractual obligations.
We seek to use aggregated or anonymised information where individual identification is unnecessary.
Where permitted, we may send information about:
Marketing may be sent by email, WhatsApp, text message, social-media channel or another method selected by the customer.
Legal basis: consent where consent is required.
Where permitted by applicable law, we may also contact an existing customer about M House services similar to those previously purchased or requested, subject to a clear opportunity to object.
Marketing consent is optional and is not a condition of receiving a service.
Consent can be withdrawn at any time by:
Withdrawal does not affect processing that was lawful before consent was withdrawn.
We may retain minimal suppression information after an unsubscribe request to ensure that the person is not inadvertently added back to the same marketing list.
Where a person has provided any consent required for advertising technologies, we may use analytics and advertising services to:
Providers may include Google, Meta or equivalent services selected by us from time to time.
Where customer contact data is used for an advertising audience, we will use available safeguards, such as hashing, restricted audience settings and contractual controls, and will do so only where a lawful basis exists.
Where accounts or member logins are available, we process account, identity, booking and security information to:
Legal basis: performance of a contract and our legitimate interest in operating secure digital services.
We process employment-application information to assess suitability, conduct interviews, communicate with applicants and make recruitment decisions.
Legal basis: taking steps before entering into an employment contract, compliance with legal obligations and our legitimate interest in recruiting suitable staff.
Certain information is necessary to:
Where required information is not provided, we may be unable to complete the booking, provide the requested service or respond fully to the request.
Fields that are optional should be identified as optional where practical.
mhouse.cy may use cookies, pixels, tags, local-storage objects and similar technologies.
These technologies may be used for:
Technologies that are not strictly necessary will be used only where any consent required by law has been obtained.
A visitor can use the website's cookie or privacy controls, where displayed, to accept, reject or adjust non-essential technologies. Browser controls may also be used, although blocking essential technologies may prevent parts of the website or booking process from working correctly.
The providers and technologies used may change as we update the website. The consent interface made available on the website should identify the current categories and providers in use.
We disclose personal data only where necessary for the relevant purpose.
Recipients may include:
We use Smoobu for certain booking or property-management functions at the date of this policy. We may replace or supplement Smoobu with another compliant provider.
These providers may process guest, booking, communication, availability, payment-status and operational information on our behalf.
Stripe or another payment provider selected at checkout processes payment and fraud-prevention information.
A payment provider may process certain information as our processor and certain information as an independent controller under its own legal obligations and privacy terms.
We may use providers for:
Although individual providers may change, we require providers handling personal data on our behalf to be bound by appropriate data-protection and confidentiality obligations.
Information may be shared where necessary with:
Operational suppliers receive only the information reasonably necessary for their role.
We may disclose information to:
If all or part of M House or Onkel Properties Ltd is sold, reorganised, financed or transferred, relevant personal data may be disclosed to professional advisers, potential counterparties and the resulting operator, subject to confidentiality and applicable law.
We do not sell personal data as a commercial product.
M House services are generally offered through mhouse.cy, but parts of the booking, payment, map, review, communication or account process may be provided through:
Where a visitor is redirected, the destination provider may collect personal data directly under its own privacy policy and may act as a separate controller.
We select providers with regard to security and data-protection requirements, but a third party remains responsible for its own independent processing.
Visitors should check that they are using the intended website and review the privacy information shown by the relevant provider.
We seek to use providers established in the European Union or European Economic Area, or providers that offer services compliant with EU data-protection requirements.
Some technology, payment, analytics, advertising, communication or cloud providers may nevertheless process or make information accessible from countries outside the European Economic Area.
Where personal data is transferred outside the European Economic Area, we use an applicable legal mechanism, which may include:
A copy or description of the relevant safeguards may be requested at hello@mhouse.cy, subject to necessary redactions for security, confidentiality and commercial information.
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, tax, accounting, safety, fraud-prevention and dispute-resolution requirements.
The following periods are our normal starting points. A record may be kept longer where a complaint, investigation, chargeback, debt, accident, legal claim or regulatory requirement is ongoing.
General enquiries are normally retained for up to 24 months after the last meaningful communication.
Detailed event, office or commercial proposals may be retained for up to 36 months where future follow-up remains reasonably likely.
Operational booking and service records are normally retained for up to six years after completion or cancellation of the relevant service.
Information that is no longer necessary for operations may be reduced, archived or restricted while financial and legal records are retained.
Transaction, invoice and accounting records are retained for at least six years after the relevant entry or transaction, or longer where required by tax, accounting, audit or legal rules.
Complete card details are retained by the payment provider in accordance with its own retention and legal obligations, rather than by M House.
Active marketing information is retained until consent is withdrawn, the person objects, the address becomes permanently invalid or the marketing programme ends.
Evidence of consent and suppression records may be retained for up to six years after the final marketing communication or withdrawal, where necessary to demonstrate compliance and respect an unsubscribe request.
CCTV footage is normally retained for no longer than 30 days.
Relevant footage may be isolated and retained longer where it is needed to investigate an incident, support an insurance matter, respond to an authority or establish, exercise or defend a legal claim.
Routine guest Wi-Fi, access and technical security logs are normally retained for up to 12 months, unless a shorter period is sufficient or a longer period is required to investigate misuse, fraud, cyber-security events or legal claims.
Routine parking records are normally retained for up to 12 months after the parking entitlement ends.
Information connected with unpaid charges, unauthorised parking, damage, an incident or a dispute may be retained for up to six years after resolution, or longer where legal proceedings require it.
Complaint and service-recovery records are normally retained for up to six years after closure.
Accident, security, insurance and significant incident records may be retained for a longer period where the applicable limitation period, the age or circumstances of an affected person, an insurer or a legal obligation requires it.
Unsuccessful applications are normally retained for six months after the recruitment process ends.
With the applicant's express permission, details may be retained for up to 24 months for future vacancies.
Records relating to successful applicants become part of the relevant employment records.
Identifiable or pseudonymous analytics data is retained according to the settings configured with the current analytics provider and should normally not be retained for longer than 26 months, unless a shorter period is selected or a longer period is justified and lawfully configured.
We use proportionate technical and organisational measures designed to protect personal data against:
Measures may include:
No internet service or storage system can be guaranteed to be completely secure. Users should protect their account credentials and contact us promptly if they suspect unauthorised activity.
M House does not ordinarily make decisions producing legal or similarly significant effects solely through automated processing.
Payment, security or booking systems may automatically flag transactions, access attempts or bookings for fraud, availability or security reasons. Where an automated flag materially affects a person, the matter may be reviewed by M House or the relevant provider where required by law.
Subject to the conditions and exceptions in applicable law, a person may have the right to:
These rights are not absolute. For example, we may need to retain information to comply with a legal obligation, complete a contract, protect another person's rights or establish, exercise or defend a legal claim.
Requests should be sent to:
Email: hello@mhouse.cy
Address: Onkel Properties Ltd, Stadiou 18, 6020 Larnaka, Cyprus
Telephone: +357 97 444085
Please describe the request clearly.
We may request reasonable information to verify identity before releasing or changing personal data. This is intended to prevent information being disclosed to an unauthorised person.
We will respond within the period required by applicable law. Where a request is complex or numerous, the response period may be extended as permitted by law, and we will explain the extension.
Requests are normally handled without charge. A reasonable fee may be charged, or a request may be refused, where permitted by law because it is manifestly unfounded or excessive.
We ask that privacy concerns first be sent to hello@mhouse.cy so that we can investigate and respond.
A person also has the right to complain to the Cyprus supervisory authority:
Office of the Commissioner for Personal Data Protection
Republic of Cyprus
Current contact information and complaint procedures are available through the Commissioner's official website.
A person may also be entitled to contact the supervisory authority in the EU or EEA country where they live, work or believe an infringement occurred.
mhouse.cy may contain links to maps, social-media pages, review platforms, payment pages, booking services or other external websites.
This Privacy Policy does not govern a third party's independent website or processing. M House is not responsible for a third party's privacy practices merely because its service is linked or integrated.
Users should review the privacy information provided by the relevant third party.
We may update this Privacy Policy where:
The current version will be published on mhouse.cy with its effective date.
Where a change materially affects how existing personal data is used, we will provide additional notice or seek new consent where required by law.
Questions about this Privacy Policy or the way M House handles personal data should be sent to:
Onkel Properties Ltd, trading as M House
Stadiou 18
6020 Larnaka
Cyprus
Email: hello@mhouse.cy
Telephone: +357 97 444085