Privacy Notice.

Introduction

TAXZONE LTD (“we”, “us”, “our” or the “Company”) respects your privacy and is committed to protecting your personal data. This Privacy Notice explains how we collect, use, disclose and safeguard the personal data we obtain through this website, and the rights you have under the GDPR and Cyprus law.

This Notice applies to the website published at  taxzone.cy. It does not apply to any third-party websites that may be linked from this site.

1. Data controller

The controller of your personal data within the meaning of Article 4(7) GDPR is:

TAXZONE LTD has not, at this stage, appointed a Data Protection Officer, as the company does not currently meet the thresholds set out in Article 37 GDPR. For any privacy-related question or request, please write to the email address above.

2. Personal data we process

Through this website we may process the following categories of personal data:

2.1 Server log files

When you visit this website, our hosting provider automatically records technical information that your browser transmits, in particular:

• your IP address (anonymised where technically feasible);
• the date and time of the request;
• the URL requested and the referrer URL, if any;
• the browser type, version, operating system and language settings.

2.2 Email correspondence

If you contact us by email at the address shown on this website, we will process the email address, name and any further information you choose to share with us, together with the content of your message and our reply.

3. Purposes and legal bases

We process the categories of personal data described above for the following purposes and on the following legal bases under Article 6(1) GDPR:

• Operation, security and stability of the website (server log files): legitimate interests of the Company in ensuring that the website is accessible, secure and free from misuse — Article 6(1)(f) GDPR.
• Responding to enquiries (email correspondence): pre-contractual measures taken at your request — Article 6(1)(b) GDPR — or, where the enquiry does not lead to a contractual relationship, our legitimate interest in answering you — Article 6(1)(f) GDPR.
• Compliance with legal obligations imposed by Cyprus law or EU law (where applicable) — Article 6(1)(c) GDPR.

4. Recipients of personal data

We do not sell or rent your personal data. We may share personal data with the following categories of recipients, each acting as a processor under a written agreement that complies with Article 28 GDPR, or as a separate controller where required by law:

• our hosting provider, for the technical operation of the website;
• email and IT service providers, for the secure handling of correspondence;
• Google Ireland Limited, in connection with the loading of web fonts (see section 6 below);
• professional advisors (lawyers, accountants, auditors) bound by professional secrecy, where strictly necessary;
• public authorities, where disclosure is required by law.

5. Cookies and local storage

This website does not currently use cookies or similar technologies for analytics, profiling, advertising or tracking. We do not embed analytics scripts, social media plug-ins, advertising pixels or third-party tracking technologies of any kind.

Where strictly necessary technical storage is used (for example, to remember a user preference within the browser), it is limited to information stored locally on your device and is not transmitted to third parties. The legal basis is Article 6(1)(f) GDPR and Regulation 4(2) of the Cyprus Regulation of Electronic Communications and Postal Services Law concerning the storage of, or access to, information on terminal equipment.

6. Web fonts (Google Fonts)

This website loads typefaces (Fraunces, Manrope, IBM Plex Mono) through the Google Fonts service operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When a page is opened, your browser establishes a connection to Google's servers, which receives certain technical information including your IP address and the page from which the request is sent.

The legal basis for this processing is our legitimate interest in a consistent and accessible visual presentation of the website (Article 6(1)(f) GDPR). Any onward transfer of personal data to the United States by Google takes place on the basis of the EU – U.S. Data Privacy Framework adequacy decision adopted by the European Commission on 10 July 2023.

Further information is available in Google's privacy policy at  policies.google.com/privacy. If you wish to prevent the loading of external fonts, you can configure your browser accordingly or use an extension that blocks third-party requests.

7. International transfers

Save for the limited transfer to Google Ireland / Google LLC described in section 6 above, we do not transfer personal data outside the European Economic Area. Any future transfer to a third country will only take place on the basis of an adequacy decision of the European Commission or of appropriate safeguards as set out in Articles 46 to 49 GDPR.

8. Retention

We retain personal data only for as long as is necessary for the purposes set out in this Notice or as required by applicable law:

• server log files: typically up to 14 days, save where retention for a longer period is required for security investigations;
• email correspondence: for as long as is necessary to handle your enquiry, and thereafter as required to comply with applicable record-keeping obligations under Cyprus law.

9. Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, in accordance with Article 32 GDPR. Communication with this website is encrypted in transit using TLS.

10. Your rights

Subject to the conditions set out in the GDPR, you have the right:

• to obtain confirmation of, and access to, the personal data we process about you (Article 15);
• to obtain the rectification of inaccurate personal data (Article 16);
• to obtain the erasure of personal data (Article 17);
• to obtain restriction of processing (Article 18);
• to data portability (Article 20);
• to object to processing carried out on the basis of legitimate interests (Article 21);
• where processing is based on your consent, to withdraw that consent at any time, without prejudice to the lawfulness of processing carried out before such withdrawal (Article 7(3)).

To exercise any of these rights, please send a written request to  hello@taxzone.cy. We may ask for additional information to verify your identity before responding.

11. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement (Article 77 GDPR).

12. Changes to this Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or in applicable law. The version date shown at the top of this page indicates when the Notice was last revised. We encourage you to review this page periodically.