CONTROLLER:
EARTHPLEXO SERVICES LTD
Company number: HE 346681
Registered office: 7 Amathountos, 3105, Limassol, Cyprus (“Earthplexo”, “the Company”, “we”, “us” or “our”)
Earthplexo acts as a data controller for personal data processed in connection with the website and its own business activities. When providing verification, screening and related services, Earthplexo and the relevant client company, whether an Affiliate or another company, act as independent data controllers for their respective processing activities.
DPO CONTACT: privacy@earthplexo.com
This Privacy Policy explains how we process personal data when you visit our website, submit an enquiry, or (if you become a client) use our services. We are committed to protecting your personal data and process it in accordance with applicable data protection laws, as described below.
1. APPLICABLE LAW AND JURISDICTIONAL FRAMEWORK
Earthplexo is established in Cyprus and processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Cypriot data protection legislation, including Law 125(I)/2018.
The GDPR applies to processing carried out in the context of our establishment in Cyprus, irrespective of your nationality or place of residence. Other data protection laws may also apply where their applicable requirements are met.
2. WHAT PERSONAL DATA WE COLLECT AND WHY
| Data category | Examples | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Enquiry form data | Name, company, email, phone, message | Respond to request, provide service information and pricing, begin onboarding | Article 6(1)(b) – steps at request of data subject before contract | 12 months after last contact (or longer if we enter into a service agreement) |
| Technical & analytics | IP address (anonymised in GA), browser, device, referring URL, pages visited, system logs | Security, website improvement, analyse usage patterns | Article 6(1)(f) – legitimate interest (after consent for non‑necessary cookies) | 2 years (aggregated) |
| Cookies (non‑essential) | Analytics cookies (Google Analytics) | As above | Consent (Article 6(1)(a) + ePrivacy Directive) | Up to 14 months |
| Client data (if onboarded) | Name, contact details, business information, service preferences, billing info, ID, proof of address, UBO, transaction data | KYC/AML, provide services, invoicing, communication | Legal obligation (Article 6(1)(c) – AML laws, tax) + performance of contract (Article 6(1)(b)) | No longer than five years from receipt, unless longer retention is required by applicable AML/CFT law. |
Special categories: We do not process biometric or health data except for liveness checks (which are not stored). Criminal offence data (sanctions, PEP) processed under Art. 6(1)(c) and Art. 10 GDPR.
3. DATA SHARING AND INTERNATIONAL TRANSFERS
We share data with:
(a) Service providers (processors):
- Google (analytics)
- Email and communication platforms (e.g., Gmail)
- Project management and CRM tools (e.g., Jira)
- Hosting and cloud infrastructure providers (e.g., AWS)
- Professional advisors (e.g., lawyers, accountants) where necessary
- Verification and screening providers
(b) Competent authorities: where required by law, including but not limited to Cypriot authorities (e.g., Tax Department, Police, Court), and authorities in jurisdictions where we operate or where you are located (e.g., court orders, regulatory requests).
(c) Affiliates (as defined in the Terms and Conditions): we may share data with our affiliates for internal administrative, operational, compliance purposes and for provision of services. All affiliates are bound by confidentiality obligations and are required to process data in accordance with this Privacy Policy and applicable law.
(d) Client companies: We provide verification and screening reports to the relevant client company that requested the services. These companies may be Affiliates or other client companies and act as independent controllers for their own use of the data and reports. All processors (where the transfer to third parties is not required by law) are bound by Data Processing Agreements that comply with the requirements of the GDPR or, where applicable, with other agreements required by applicable data protection laws. Each processor is contractually obligated to:
- process personal data only on documented instructions from the Company;
- implement appropriate technical and organisational security measures to protect the data;
- ensure confidentiality of all personnel authorised to process data;
- assist the Company in responding to data subject requests;
- notify the Company without undue delay of any personal data breach;
- engage sub-processors only with the Company's prior written consent;
- delete or return all personal data upon termination of the engagement, unless required by law to retain it.
International transfers:
From EEA/UK: we rely on SCCs and the UK International Data Transfer Agreement (where applicable), together with supplementary measures (encryption, pseudonymisation).
From other jurisdictions: we will ensure that any cross-border data transfer complies with the applicable local law requirements (e.g., adequacy decisions, standard clauses, or consent).
Where required by applicable law, we will obtain your explicit consent for cross‑border data transfers.
4. YOUR RIGHTS UNDER GDPR (FOR EEA AND UK USERS)
Where the GDPR applies to our processing of your personal data, you have the following rights, subject to the conditions and exceptions provided by law:
(a) Access (Art. 15): confirmation of processing, copy of data.
(b) Rectification (Art. 16): correct inaccurate data.
(c) Erasure (Art. 17): “right to be forgotten”, unless we have a legal obligation (e.g., tax) to retain.
(d) Restriction (Art. 18): right to restriction of processing.
(e) Data portability (Art. 20): receive a machine‑readable copy.
(f) Object (Art. 21): to processing based on legitimate interests (e.g., analytics).
(g) Withdraw consent (Art. 7(3)): at any time without detriment.
(h) Lodge a complaint (Art. 77): with your local supervisory authority (in Cyprus, the Office of the Commissioner for Personal Data Protection).
To exercise your rights, email privacy@earthplexo.com. We will respond within one month (extendable by two months for complex requests). No fee, unless manifestly unfounded or excessive.
5. YOUR RIGHTS UNDER OTHER DATA PROTECTION LAWS
For users in jurisdictions other than the EEA and UK, the rights available to you depend on your local law. We will honour those rights to the extent required by applicable law. These rights may include (depending on your jurisdiction):
(a) Access, rectification, erasure, restriction, portability, and objection;
(b) Withdrawal of consent (where processing is based on consent);
(c) Lodging a complaint with your local data protection authority.
To exercise your rights, or if you have any questions about which law applies to you, please contact us at privacy@earthplexo.com. We will respond within the timeframe required by your applicable local law (or within 30 days if no specific timeframe is prescribed).
6. COOKIES AND SIMILAR TECHNOLOGIES
We use cookies only with your prior consent (except strictly necessary ones). See our Cookie Policy for details and how to withdraw consent. The Policy is available at https://earthplexo.com/cookies.html.
7. DATA RETENTION AND DELETION
We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law. Our retention periods are:
- Enquiry data: deleted after 12 months if no further interaction (e.g., no service agreement signed, no ongoing communication).
- Client data is retained for as long as necessary for the relevant purposes and to meet applicable legal retention requirements. Different retention periods apply to verification and screening data, billing records and other business records, as set out above.
- Analytics data (Google Analytics): 14 months (then automatically deleted).
- Technical & analytics data (including IP addresses, browser/device info, referring URL, pages visited, and system logs): retained for 2 years (aggregated or anonymised where possible).
Destruction methods: secure electronic deletion (overwriting, degaussing), physical shredding of paper records.
Data that is no longer needed is anonymised where possible, or securely destroyed.
8. SECURITY MEASURES
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include:
- Access controls: only authorised personnel have access to personal data, and only on a need-to-know basis.
- Encryption: data in transit and at rest is encrypted using industry‑standard protocols.
- Secure hosting: servers are protected by firewalls, intrusion detection systems, and regular security patching.
- Employee training: all staff receive data protection and security awareness training.
- Incident response: we have procedures in place to detect, respond to, and report personal data breaches.
While we strive to protect your data, no method of transmission over the internet or electronic storage is absolutely secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.
9. AUTOMATED DECISION-MAKING AND PROFILING
We do not make solely automated decisions that have legal or significant effects on you based solely on website activity. For clients, we may use automated scoring for fraud prevention or risk assessment, but you will be informed in the relevant Service Agreement and have the right to human review.
10. CONTACT
Data Controller:
EARTHPLEXO SERVICES LTD
Company number HE 346681
7 Amathountos, 3105, Limassol, Cyprus
Data Protection Officer (DPO): privacy@earthplexo.com
For general privacy enquiries: privacy@earthplexo.com
Postal address for privacy correspondence:
EARTHPLEXO SERVICES LTD
Attn: Data Protection Officer
7 Amathountos, 3105, Limassol, Cyprus
11. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes in technology, legal requirements, or our practices. The “Effective Date” at the top of this policy will be updated accordingly. We will notify you of any material changes via a banner on the Website or by email (if you have provided one). We encourage you to review this policy periodically.