Legal

Privacy Policy

Effective Date: June 24, 2026

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website, in full compliance with the General Data Protection Regulation (GDPR).

1. Data Controller

The entity responsible for processing your personal data is:

2. What Personal Data We Collect

We only collect personal data that you voluntarily provide to us through the forms on our website (e.g., contact forms, registration forms, applications). This may include:

  • First and last name
  • Email address
  • Phone number
  • Any other information you choose to provide in the message field

3. Purpose and Legal Basis of Processing

We process your data based on the following legal grounds under GDPR:

  • Contractual Necessity (Art. 6(1)(b) GDPR): To process your applications, provide our services, and respond to your direct requests.
  • Legitimate Interests (Art. 6(1)(f) GDPR): To improve our website performance, ensure IT security, and prevent fraud.
  • Consent (Art. 6(1)(a) GDPR): For non-essential cookies and marketing communications (where applicable and explicitly consented to).

4. Secure Data Architecture and Third Parties

We take data security seriously. We implement a strict Data Minimization policy:

  • Storage: All personal data collected via our forms is transmitted securely via HTTPS and stored directly in our secure internal database hosted on servers located strictly within the European Union (EU).
  • Internal Routing (Telegram/Email): For operational efficiency, our server sends instant notifications about new form submissions to our management team via internal channels. These alerts are strictly anonymized on our backend server before transmission. They contain only dry technical IDs and secure links to our internal admin panel. No raw personal data (names, phones, emails) is ever transmitted through or stored within third-party messaging services.
  • Third-Party Processors: We do not sell your data. We only share full personal data with verified cloud infrastructure providers (hosting/database) that operate within the EU and with whom we have signed a formal Data Processing Agreement (DPA).

5. Data Retention Period

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with legal, regulatory, or reporting requirements. When data is no longer required, it is permanently deleted from our databases.

6. Your Rights Under GDPR

As an EU resident, you have the following rights regarding your personal data:

  • Right of Access: You can request a copy of the personal data we hold about you.
  • Right to Rectification: You can request that we correct inaccurate or incomplete data.
  • Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal data from our systems.
  • Right to Restriction of Processing: You can ask us to restrict how we use your data.
  • Right to Data Portability: You can request a transfer of your data to another organization.
  • Right to Object: You can object to the processing of your data based on legitimate interests.
  • Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

7. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes GDPR, you have the right to lodge a complaint with a supervisory authority. If you are located in Cyprus, you can contact:

Office of the Commissioner for Personal Data Protection

Privacy Policy · WorkHub · WorkHub