1. Who is responsible for your data
Topify Consulting Ltd, registration no. HE 409159, Alkyonis 1, 3087 Limassol, Cyprus ("we") is the controller for the personal data described in this policy. You can contact us about privacy at privacy@cyprusconnect.net or by post at our registered address. We have not appointed a Data Protection Officer because we are not required to; privacy questions are handled by our management.
This policy covers visitors to our websites, people who contact us, and the people who use Cyprus Connect accounts. It does not cover the data our customers store or process in the Services (for example Vault files, the people they screen or the documents they check). For that data the customer is the controller and we act as its processor under the Data Processing Agreement. If your data is held by one of our customers, please contact that firm.
2. The data we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account details: name, work email, role, firm name, address, phone, VAT number, website | Creating and approving accounts, providing the Services, contacting you about your account | Contract (Art. 6(1)(b)); legitimate interest in verifying that customers are genuine firms (Art. 6(1)(f)) |
| Security data: password hash, encrypted authenticator secret, one-time code records, session records, IP address, browser information, sign-in and activity logs | Signing you in securely, preventing fraud and attacks, keeping the activity log your firm relies on | Contract; legitimate interest in security (Art. 6(1)(f)); legal obligation to keep personal data secure (Art. 32) |
| Billing data: plan, credit top-ups, charges, invoices | Billing, accounting and tax | Contract; legal obligation under Cyprus tax and accounting law (Art. 6(1)(c)) |
| Messages you send us, including through the contact form | Answering your enquiry and keeping a record of it | Legitimate interest in responding (Art. 6(1)(f)); steps before a contract (Art. 6(1)(b)) |
| Cookie consent records | Proving the choice you made about optional cookies | Legal obligation (Art. 7(1) GDPR) |
| Analytics data, only if you accept analytics cookies | Understanding how the website is used | Consent (Art. 6(1)(a) GDPR and section 99(5) of Law 112(I)/2004) |
You must give us your account details to use the Services; without them we cannot provide them. We do not use your data for automated decisions that have legal or similarly significant effects on you.
3. Where the data comes from
Most data comes from you. If your firm's account owner invites you as a staff member or client, we receive your name and email address from them. We do not buy personal data.
4. Who we share it with
We share personal data only with providers that help us run the Services, under contracts that require them to protect it, and with authorities where the law requires it. We do not sell personal data.
| Recipient | Service | Location |
|---|---|---|
| OVHcloud (OVH SAS) | Server hosting for the Platform | European Union |
| Our email provider | Sending account emails, one-time codes and reminders | European Union |
| Cookiebot (Usercentrics A/S) | Cookie consent banner and consent records | European Union |
| Cloudflare, Inc. | Domain name (DNS) service | Global network; EU-US Data Privacy Framework / SCCs |
| Didit | AML, sanctions and identity checks requested by customers (processor data under the DPA) | See the DPA |
| Anthropic | AI case research, only for masked text that a lawyer has approved (processor data under the DPA) | United States, under Standard Contractual Clauses |
| Professional advisers, auditors, courts and authorities | Where required by law or to establish, exercise or defend legal claims | Cyprus / EU |
5. International transfers
When personal data is transferred outside the European Economic Area, we make sure it is protected by an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified US companies) or by the Standard Contractual Clauses adopted by the Commission (Decision (EU) 2021/914), with additional measures where needed. You can ask us for a copy of the relevant safeguards.
6. How long we keep it
- Account and security data: while the account is open, then up to 90 days to close it down safely.
- Activity and audit logs: for the life of the customer's account, because firms rely on them for their own compliance; then deleted with the account.
- Billing records: 7 years, as required by Cyprus tax and accounting law.
- Contact messages: up to 2 years after the last exchange.
- Expired sessions and one-time codes: deleted automatically, normally within one day.
- Consent records: for as long as the consent is valid plus 2 years.
7. How we protect it
We use encryption in transit (HTTPS), end-to-end encryption for Vault files, two-step sign-in for every user, rate limiting and automatic blocking of repeated failed sign-ins, least-privilege access and security logging. See Compliance and Security.
8. Your rights
Under the GDPR you have the right to access your data, to have it corrected, erased or restricted, to data portability, and to object to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time, as easily as you gave it; for cookies, use the "Cookie settings" link in the footer. Withdrawing consent does not affect processing before the withdrawal.
To exercise a right, email privacy@cyprusconnect.net. We will reply within one month. This can be extended by two further months for complex requests, in which case we will tell you why. Requests are free unless they are manifestly unfounded or excessive. We may ask you to confirm your identity.
9. Complaints to the supervisory authority
You have the right to lodge a complaint with a supervisory authority. In Cyprus this is the Commissioner for Personal Data Protection, P.O. Box 23378, 1682 Nicosia, email commissioner@dataprotection.gov.cy, website www.dataprotection.gov.cy. If you live or work in another EU country, you can also complain to the authority there. We would appreciate the chance to deal with your concern first.
10. Children
The Services are for professionals and are not directed at children. We do not knowingly collect data from children.
11. Cookies
See our Cookie Policy.
12. Changes
We will update this policy when our processing changes and show the date of the latest version at the top. We will tell account holders about significant changes by email.
Topify Consulting Ltd, registration no. HE 409159, VAT no. 10409159B, Alkyonis 1, 3087 Limassol, Cyprus. Contact: info@cyprusconnect.net. If a translation of this document differs from the English version, the English version applies.