Privacy Policy · GDPR + Cyprus

Last updated: 2026-06-01

1. Who we are (Data Controller)

NXDPRO Solutions (hereinafter "we", "us") operates the websites nxdpro.com and nxdpro.gr. Address: Pontidos 17, Agios Athanasios, 4103 Limassol, Cyprus. Email: info@nxdpro.com. Phone: +357 99 816363.

We act as "Data Controller" under the EU General Data Protection Regulation (GDPR, EU 2016/679) and Cyprus Law 125(I)/2018.

2. What data we collect

Contact / quote form: name, email, phone (optional), company (optional), subject, message.
Newsletter: email and (optionally) name.
Clients (contractual): billing details, VAT number, address, payment info.
Technical log data: IP address, user-agent, timestamp — kept in server logs for security and spam prevention.
Cookies: see our Cookies Policy.

We never knowingly collect "special categories" of data (health, religion, political views, etc.) or data of minors.

3. Why we process it (Purposes & Legal Basis)

Purpose	Legal basis
Respond to your enquiry / quote request	Art. 6(1)(b) — pre-contractual measures
Provide agreed services (hosting, web design, SEO)	Art. 6(1)(b) — contract performance
Invoicing & accounting records	Art. 6(1)(c) — legal obligation (Cyprus tax law)
Newsletter	Art. 6(1)(a) — explicit consent (double opt-in)
Site security, anti-spam, server logs	Art. 6(1)(f) — legitimate interest

4. Who we share data with (Recipients)

We do not sell, rent or trade personal data. We share only with:

Infrastructure providers: our EU-based server (Cyprus / hosting provider).
Email (SMTP): local Exim server on the same infrastructure.
OVH (mailbox provider): for incoming mail to info@nxdpro.com.
OpenAI, L.L.C. (USA): ONLY when we trigger an AI-assist (email draft, summary). No client data is sent without explicit user action. Transfer covered by Standard Contractual Clauses (SCCs).
Accountant / authorities: only where required by law (VAT, tax audit).
Meta / WhatsApp: when you or we initiate a WhatsApp conversation (wa.me link).

5. International transfers

Where data is transferred outside the EEA (e.g. OpenAI in the US), we use Standard Contractual Clauses and other appropriate safeguards under Article 46 GDPR.

6. How long we keep data (Retention)

Contact form / leads: up to 24 months after last contact.
Clients – accounting records: 6 years (Cyprus Assessment & Collection of Taxes Law).
Newsletter: until you unsubscribe.
Server logs: up to 90 days.

After expiry, data is securely deleted or pseudonymised.

7. Your rights

Under Articles 15-22 GDPR you have the right to:

Access (copy of your data)
Rectification (if inaccurate or incomplete)
Erasure ("right to be forgotten")
Restriction of processing
Portability (structured copy)
Object to processing based on legitimate interest
Withdraw consent at any time (without affecting prior processing)

8. Data Deletion

To have all your data deleted, email info@nxdpro.com with the subject "Data Deletion Request" and the email/phone you used. We respond within 30 calendar days. Records subject to mandatory tax retention (6 years) cannot be deleted before that period expires.

9. Complaint to the Authority

You may lodge a complaint with the Cyprus Commissioner for Personal Data Protection (15 Kypranoros, 1061 Nicosia · commissioner@dataprotection.gov.cy · +357 22 818456).

10. Security

We use HTTPS (TLS), password hashing (bcrypt), CSP headers, rate limiting, CSRF tokens, automated backups and per-site isolation. No method is 100% secure but we apply industry standards.

11. Automated decision-making

We do not make decisions based solely on automated processing with legal / significant effects on you.

12. Children

Our services target businesses. We do not knowingly collect data of children under 16.

13. Changes to this Policy

We may update this policy. The date at the top reflects the latest revision. Material changes are announced on the website and (where you have an active relationship with us) by email.

14. Contact

For any data-protection matter: info@nxdpro.com · NXDPRO Solutions, Limassol, Cyprus.