MONO SUPPLIES
AS Mono Supplies Ltd | Legal
Last updated October 2026Effective October 2026Version 1.1
AS Mono Supplies Ltd ("Mono Supplies", "we", "us", or "our") is a B2B hospitality equipment supplier incorporated and headquartered in Nicosia, Cyprus. We supply premium hotel room equipment, FF&E, and OS&E products to hotels, resorts, and hospitality operators across Europe, the Middle East, Australia, and internationally.
This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when you:
Data Controller
As a company headquartered in Cyprus, an EU Member State, AS Mono Supplies Ltd is subject to the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Cyprus Law on the Protection of Natural Persons with regard to the Processing of Personal Data (Law 125(I)/2018).
We also comply with applicable local law in the jurisdictions where we operate:
In all cases, we apply the GDPR as our baseline, the highest standard, across all our operations globally.
Where a local law gives you stronger protection than the GDPR, or does not recognise a legal basis listed in Section 4 (for example, some Gulf laws rely primarily on consent), we follow the local requirement for your data.
You are not legally obliged to give us personal data. However, we need your contact details to answer an enquiry, open a portal account, or process an order, and cannot do so without them. Fields we need are marked as required on our forms.
In the course of our B2B lead generation and business development, we may obtain business contact information from publicly available sources, third-party data enrichment services, and industry databases.
Under the GDPR, our legal bases for processing are:
Personal data is accessible only to employees and authorised personnel who require it to perform their functions, subject to internal access controls and confidentiality obligations.
We engage third-party service providers for IT infrastructure, email delivery, CRM, accounting, payment processing, website analytics, and data enrichment. We execute Data Processing Agreements with all processors.
The main providers that process personal data submitted through our website are:
For website analytics we use Google Analytics 4. It is loaded on every page, but sets no analytics cookies unless and until you accept them. See Section 9.2 for what is sent before you decide.
We may disclose data to competent authorities where required by law, court order, or regulatory requirement.
Our Commitment
We do not sell personal data to third parties. We do not share personal data with third parties for their own independent marketing purposes without your explicit consent.
Personal data may be transferred to countries outside the EEA, including the UAE, Saudi Arabia, Qatar, Bahrain, Australia, and China. Where we transfer personal data outside the EEA, we rely on adequacy decisions, Standard Contractual Clauses, or other GDPR-approved mechanisms.
The website providers listed in Section 6.2 (Vercel, Supabase, Resend, Slack, and Google) are, or belong to groups, based in the United States, so data you submit through our website may be processed there. These transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on Standard Contractual Clauses.
If you are located in the UAE, Saudi Arabia, Qatar, or Bahrain, your personal data is transferred to Cyprus (EU) and to the providers above. We make these transfers only as permitted by your local law, for example where needed to perform a contract with you, with your consent, or with appropriate safeguards in place, and the GDPR protections in this Policy apply to your data wherever it is processed.
You may request further information by contacting us at anastasios@monosupplies.com.
We retain personal data for no longer than necessary for the purposes for which it was collected.
Our websites use cookies and similar technologies, including browser local storage, to operate, improve, and analyse our Services.
We do not use advertising, retargeting, or cross-site tracking cookies. Should that change, we will ask for your consent before setting them.
When you first visit, a banner asks whether you accept analytics cookies. Until you accept, Google Analytics runs in a restricted mode: it sets no cookies and cannot link your visits together. It still sends Google basic, cookieless signals, such as the page viewed. As with any request your browser makes, these also reveal your IP address and browser type to Google.
You can change your decision at any time using the Cookie settings link in the footer of every page. Withdrawing consent is as straightforward as giving it, takes effect immediately, and does not affect the lawfulness of processing carried out beforehand. You may also control cookies through your browser settings, though disabling strictly necessary cookies may affect the functionality of our websites and portal.
Depending on your location and applicable law, you have some or all of the following rights:
Right of Access
Obtain confirmation of whether we process your data and receive a copy of it.
Right to Rectification
Have inaccurate or incomplete data corrected without undue delay.
Right to Erasure
Request deletion of your personal data in certain circumstances.
Right to Restriction
Limit how we use your data in specific circumstances.
Right to Portability
Receive your data in a machine-readable format and transfer it to another controller.
Right to Object
Object to processing based on legitimate interests, including direct marketing, at any time.
Automated Decisions
Not to be subject to solely automated decisions that significantly affect you.
Withdraw Consent
Withdraw consent at any time where processing is consent-based.
To exercise any of these rights, contact us as set out in Section 15. We will respond within one calendar month.
Supervisory Authorities
Cyprus / EU: Commissioner for Personal Data Protection: dataprotection.gov.cy
Greece: Hellenic Data Protection Authority: dpa.gr
UAE: UAE Data Office: uaedataoffice.gov.ae
Saudi Arabia: Saudi Data & AI Authority (SDAIA): sdaia.gov.sa
Qatar: National Data Privacy Office, National Cyber Security Agency
Bahrain: Personal Data Protection Authority
Australia: Office of the Australian Information Commissioner: oaic.gov.au
If you are in the EU, you may also complain to the authority in the Member State where you live or work.
We implement appropriate technical and organisational measures to protect personal data, including:
In the event of a personal data breach, we will notify the competent supervisory authority within 72 hours as required under the GDPR (or sooner where another applicable law requires it), and will inform you without undue delay where a breach is likely to put your rights at high risk.
Our websites may contain links to third-party websites. This Privacy Policy does not apply to those third-party sites. We encourage you to review their own privacy policies before submitting any personal data.
Our Services are directed exclusively at businesses and business professionals. We do not knowingly collect or process personal data from individuals under the age of 16. If you believe we may hold data relating to a child, please contact us immediately.
We reserve the right to update or modify this Privacy Policy at any time. Where changes are material, we will provide prominent notice on our website and, where appropriate, notify you directly by email.
Your continued use of our Services after any changes constitutes acknowledgement of the updated Policy.
For any questions about this Privacy Policy, to exercise your data protection rights, or to report a potential privacy issue:
Get in Touch
We aim to acknowledge all data-related requests within 5 business days and resolve them within 30 calendar days.
This Privacy Policy was prepared for AS Mono Supplies Ltd and is intended to comply with the GDPR, Cyprus data protection law, and applicable international data protection legislation.
© 2026 AS Mono Supplies Ltd. All rights reserved.