This policy explains what personal data Upnuvo Ltd collects through this website, why we collect it, how long we keep it and what rights you have over it. We have tried to write it in plain language rather than legal boilerplate.
Who we are
Upnuvo Ltd is a private limited company registered in the Republic of Cyprus under company number HE 437081, with its registered office at 19 Karaiskaki Street, Roussos Building, Office 1C, 3032 Limassol, Cyprus. For the purposes of the EU General Data Protection Regulation (GDPR) and Cyprus Law 125(I)/2018, Upnuvo Ltd is the data controller for the personal data described in this policy.
For any question about this policy or your data, contact us at [email protected].
What we collect and why
Enquiries you send us
When you complete the contact form we collect your name, email address, and any company name and message you choose to give us. We use this solely to respond to your enquiry and, if we go on to work together, to manage that relationship. The legal basis is our legitimate interest in answering people who contact us about our services, and the performance of a contract once one exists.
Technical information
Our hosting provider records standard server logs, which may include your IP address, browser type and the pages you requested. These logs exist to keep the site secure and available, and to diagnose faults. The legal basis is our legitimate interest in operating a secure service. We also store a short-lived record of recent form submissions in order to limit automated spam.
Cookies and analytics
The website itself sets only the cookies WordPress needs to function. Any analytics or marketing cookies are described in our cookie policy and are set only where consent is required and given.
Who we share data with
We do not sell personal data and we do not share it for advertising. We do rely on a small number of service providers who process data on our behalf as processors under written terms — typically our website host, our email provider and, where relevant, our project management and accounting tools. Each is instructed to process data only as needed to deliver their service to us.
We may also disclose data where we are legally required to do so, or where it is necessary to establish or defend legal claims.
International transfers
Some of our providers operate outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on an adequacy decision by the European Commission or on the Commission’s standard contractual clauses, together with any additional safeguards the transfer requires.
How long we keep it
- Enquiries that do not lead to work: up to 24 months from our last exchange, then deleted.
- Client records: for the duration of the engagement and afterwards for as long as accounting and tax law requires.
- Server logs: typically a matter of weeks, as set by our hosting provider.
Your rights
Under the GDPR you have the right to ask us for a copy of the personal data we hold about you, to have inaccurate data corrected, to have data erased, to restrict or object to how we use it, and to receive it in a portable format. You can also object at any time to processing based on legitimate interests.
To exercise any of these rights, email [email protected]. We will respond within one month. If you are not satisfied with our response, you may complain to the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, or to the supervisory authority in your own country of residence.
Security
The site is served over HTTPS, administrative access is limited to named accounts with multi-factor authentication, and software is kept up to date. No system is perfectly secure, but we take the measures appropriate to the limited amount of personal data this website handles.
Changes to this policy
If we change how we handle personal data we will update this page and revise the date at the top. Where a change materially affects you, we will make that clear rather than relying on you to notice.