Privacy Policy

Who is responsible for your data

The controller of personal data collected on this site is the operator of cypruscompanyhub.com. Questions, requests and complaints about your data go to one address: [email protected]. There is no separate data protection officer and no phone line; every message to that inbox is read by the people who handle your request.

What the request form collects

The form has two groups of fields. The first describes your case: “Your citizenship”, “Target country (Cyprus by default)”, “Service or programme”, “Budget”, “When do you want to start?”. The second tells us how to reach you: “Full name”, “Email”, “Phone (optional)”, “Anything we should know?”.

Only “Full name” and “Email” are required, plus the consent box. Everything else is optional, and a budget or timeline left blank does not stop us from replying. Our server trims over-long entries and discards anything the form does not ask for.

Together with the fields, our server records:

• the date and time the request arrived and a random request number;
• the address of the page you sent it from and the page that brought you there, if your browser passed it on;
• your browser’s User-Agent string (browser and operating system);
• a salted and shortened SHA-256 hash of your IP address. The address itself is not written anywhere.

The hash lets us see that a burst of spam came from one source without knowing who or where that source is. For the same reason your IP address is held in server memory for a few minutes to cap repeated submissions; it is never saved to disk.

Why we use it and on what legal basis

We use the form data for one purpose: to reply to your request with a price, a timeline and a list of documents, and, if you go ahead, to carry out the work. The legal basis is your consent under Article 6(1)(a) GDPR, given with the unticked box next to the “I agree to the processing of my personal data to respond to my request, as described in the Privacy Policy.” statement. The form cannot be sent without it.

Once you instruct us, the same data is processed because we need it to perform the agreed service (Article 6(1)(b) GDPR). The hashed IP address and User-Agent are kept on the basis of our legitimate interest in keeping the form free of automated spam (Article 6(1)(f) GDPR).

We do not use request details for newsletters, advertising or profiling, and we make no automated decisions about you.

Where it goes after you press send

Each request is saved first, to a file on the server that runs cypruscompanyhub.com; the site replies “received” only after the write is complete. There is no external CRM, mailing-list service or shared database behind the form.

Right after saving, a private messaging notification with the request fields, the page address and the request number goes to the operator, so that the request is seen without delay. If saving fails, that notification carries the whole request so it is not lost; if both fail, the form shows an error and asks you to try again or email us.

Email you send to [email protected] and our replies are kept in that mailbox. We do not sell request details or pass them to anyone for their own use. If a government register or authority in Cyprus needs your details for an application you asked us to file, we send them there as part of that application and tell you beforehand what goes where.

How long we keep it: up to 24 months

Requests are stored in one file per calendar month and kept for up to 24 months, counted from the month the request arrived. After that the whole month's file is deleted, which also removes the hashes and technical details recorded with each request.

Asking us to delete your request earlier ends the period for you straight away. Where you became a client, documents that tax or company law requires us to keep are retained for the period that law sets, and only those documents.

Your rights under the GDPR

Write to [email protected] from the address you used in the form, or tell us the request date, and we answer within one month, as Article 12 GDPR requires. Using these rights costs nothing. You can ask us to:

• show you everything we hold about you and send you a copy (access);
• correct a wrong name, email, phone number or case detail (rectification);
• delete your request and our correspondence with you (erasure);
• keep your data but stop using it, for example while a correction is checked (restriction);
• stop processing that rests on our legitimate interest, such as the spam checks (objection);
• give you your request in a machine-readable file, JSON as we store it, to take elsewhere (portability).

You can withdraw your consent at any time with one line to the same address; this stops further use but does not make earlier processing unlawful. If you think we have handled your data wrongly, you may complain to the data protection supervisory authority of the EU country where you live, where you work or where the problem arose. In Cyprus that is the Commissioner for Personal Data Protection.

Cookies and visit statistics

The site sets first-party cookies only: pref_fi remembers your banner choice for 365 days, while cid_68 and from_1p count visits. There is no Google Analytics, no tag manager and no advertising pixel. Names, lifetimes and what “Necessary only” switches off are listed in our Cookie Policy.

Visit statistics are never joined with form data: the visitor identifier is not stored with your request, and we do not try to find out which visitor sent which request.

What this policy does not cover

• Government portals, registers and banks we link to or file with have their own privacy terms; we do not control what they collect when you visit them.
• Documents you give us for a service after you instruct us (passports, bank statements, company papers) are handled under the terms of that engagement, which we send you before work starts.
• The site is meant for adults arranging company, tax or residence matters. We do not knowingly collect data about children through the form.

Changes to this policy

We update this page before any change to the form fields, the storage period or the notification route goes live. The field names and cookie names above come from the same code the site runs, so a new field or cookie cannot appear without this text changing too. If a change widens what we do with requests already received, we email the people concerned from [email protected] before applying it.