Privacy Policy

1. Data Controller

2. Data We Collect

When you visit our website or contact us, we may collect the following categories of personal data:

• Contact data: Name, email address, and message content when you submit our contact form or email us directly.
• Usage data: IP address, browser type, pages visited, and time of visit — collected automatically via server logs and analytics tools.
• Communication data: Records of correspondence when you contact us by email.

3. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Art. 6:

• Art. 6(1)(b) GDPR — Processing is necessary for the performance of a contract or pre-contractual measures.
• Art. 6(1)(f) GDPR — Processing is necessary for our legitimate interests (e.g., website security, analytics).
• Art. 6(1)(a) GDPR — Where you have given explicit consent (e.g., newsletter subscription).

4. How We Use Your Data

• To respond to your inquiries and provide our services
• To improve our website and user experience
• To comply with legal obligations
• To protect against fraud and ensure website security

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Contact form submissions are retained for a maximum of 3 years unless a longer retention period is required by law or contractual obligation.

6. Data Sharing & Third Parties

We do not sell, trade, or otherwise transfer your personal data to third parties without your consent, except where required by law or necessary to provide our services. We may share data with:

• IT service providers and hosting partners (under data processing agreements)
• Legal authorities when required by applicable law

7. Cookies & Analytics

Our website may use cookies and similar tracking technologies to enhance your experience and analyse website traffic. You can control cookie settings through your browser. We use privacy-compliant analytics tools that anonymise IP addresses and do not share data with third parties for advertising purposes.

8. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access (Art. 15 GDPR) — Request a copy of your personal data.
• Right to rectification (Art. 16 GDPR) — Request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR) — Request deletion of your personal data.
• Right to restriction (Art. 18 GDPR) — Request restriction of processing.
• Right to data portability (Art. 20 GDPR) — Receive your data in a structured format.
• Right to object (Art. 21 GDPR) — Object to processing based on legitimate interests.
• Right to withdraw consent — At any time, without affecting prior processing.

To exercise any of these rights, please contact us via our contact form.

9. Supervisory Authority

You have the right to lodge a complaint with the competent supervisory authority. In Cyprus, this is the Commissioner for Personal Data Protection: www.dataprotection.gov.cy.