Privacy policy

CyprusPermit is the controller of the personal data described here. Contact for anything about your data: info@cypruspermit.com. We have not appointed a data protection officer, because our processing does not require one under GDPR Art. 37; this address reaches the person responsible.

The controller is Cyprus Permit & Migration Solutions LTD, Tala, Paphos, Cyprus.

• Requests from our forms: your name, email, optional phone, your message and answers, the page and service you asked about, a calculator result if you chose to send it, and campaign tags from the link you came by (utm).
• Approximate location: country and city worked out from your IP address on your first request. We do not store the IP address itself.
• Your cabinet: your profile (email, name, phone, language), your requests and their status, the person handling your case, meetings, and the emails between you and us. Sign-in codes are stored only as a hash for ten minutes. We keep a sign-in journal (method, result, country and city) for security.
• Chat: your messages and, if you write as a guest, the name and contact you leave.
• The assistant: we do not store your questions or its answers. We record when a question was asked, by which account or guest, a keyed hash of your IP address and the size of the answer, to keep daily limits.

We use no advertising trackers and no analytics without your consent, and we do not sell personal data.

• To answer you, plan your move and carry out the work you agreed with us: steps you asked for and our contract with you (GDPR Art. 6(1)(b)).
• To keep the service secure and prevent abuse, for example sign-in limits and assistant limits: our legitimate interest (Art. 6(1)(f)).
• To keep records the law requires: legal obligation (Art. 6(1)(c)).

• Certified partners and contractors who carry out work on your matter for us (licensed advocates, accountants and other qualified professionals), when we hand your order or part of it to them, under a written contract and confidentiality obligations. They receive only the data that work needs.
• Public authorities, such as the Civil Registry and Migration Department or the Tax Department, when we file an application for you.
• Our hosting provider: servers in a data centre in Germany (EU).
• Our email provider, to send and receive the letters about your request.
• The external AI providers behind the assistant: when you choose the Assistant tab, your whole question and relevant excerpts from our reference material are sent to an external model. Models in the current settings: the model in the assistant's current settings (the list loads from it). We do not automatically add your profile, account identifiers or earlier messages, but personal details you type in the question are included. We do not anonymise free text. Do not enter names, contact details, passport or tax numbers, health information or other private details. Providers may process the text outside the EU, including in countries without an EU adequacy decision; the model list alone does not establish the legal safeguards for a transfer. Use the A person tab to contact our team without sending that message to an AI model.
• Google, only if you choose to sign in with Google.

Our staff see your data only as far as their role needs it.

• Requests, the cabinet, chat and emails: while your case is open, then up to six years after our last contact, for legal claims and records: the general limitation period under the Limitation of Actions Law 66(I)/2012. After that they are deleted automatically, together with everything else we hold about you. You can ask us to delete them earlier.
• Sign-in journal: 12 months. Sign-in codes: deleted a day after they expire.
• Copies of emails we sent: 30 days in our sending queue.
• Assistant records: after 12 months we remove who asked and keep only anonymous counts.

All connections use HTTPS. Personal fields such as names, contacts and messages are encrypted in our database, and access is limited by role.

You can ask for access to your data, a copy in a common format, correction, deletion or restriction, and object to processing based on our legitimate interest. You can withdraw consent at any time; this does not affect what was done before. In your cabinet you can edit your profile, sign out on all devices and close your account. Closing the account is a request to delete your data: until we have deleted it, you cannot sign in with the same email, and then everything about you is removed.

Write to info@cypruspermit.com; we reply within one month. You can also complain to the Commissioner for Personal Data Protection of Cyprus: dataprotection.gov.cy.

Only if you accept analytics in the cookie banner, Google Analytics, loaded through Google Tag Manager, records the pages you visit, your browser and device type and an approximate location, so we can see which pages help. Legal basis: your consent (GDPR Art. 6(1)(a)); you can withdraw it at any time with Cookie settings at the bottom of every page. The provider is Google Ireland Limited; data may be transferred to Google LLC in the USA under the EU–US Data Privacy Framework. We keep analytics data for 14 months. Form answers, names and contact details are never sent to analytics.

Our service is for adults. We do not knowingly collect data from children; parents handle a family's move.

We update this policy when our processing changes; the date at the top shows the current version.