Privacy Policy · GDPR + Cyprus

Last updated: 2026-10-09

1. Who we are (Data Controller)

NXDPRO Solutions (hereinafter "we", "us") operates the website nxdpro.com. Address: Pontidos 17, Agios Athanasios, 4103 Limassol, Cyprus. Email: info@nxdpro.com. Phone: +357 99 816363.

"NXDPRO Solutions" is the trading name of Nicolas Demetriou (self-employed), who is the Data Controller.

We act as "Data Controller" under the EU General Data Protection Regulation (GDPR, EU 2016/679) and Cyprus Law 125(I)/2018.

2. What data we collect

Contact / quote form: name, email, phone (optional), company (optional), subject, message.
Newsletter: email and (optionally) name.
Clients (contractual): billing details, VAT number, address, payment info.
Technical log data: IP address, user-agent, timestamp — kept in server logs for security and spam prevention.
Cookies: see our Cookies Policy.

We never knowingly collect "special categories" of data (health, religion, political views, etc.) or data of minors.

3. Why we process it (Purposes & Legal Basis)

Purpose	Legal basis
Respond to your enquiry / quote request	Art. 6(1)(b) — pre-contractual measures
Provide agreed services (hosting, web design, SEO)	Art. 6(1)(b) — contract performance
Invoicing & accounting records	Art. 6(1)(c) — legal obligation (Cyprus tax law)
Newsletter	Art. 6(1)(a) — explicit consent (double opt-in)
Site security, anti-spam, server logs	Art. 6(1)(f) — legitimate interest

4. Who we share data with (Recipients)

We do not sell, rent or trade personal data. We share only with:

Infrastructure providers: our EU-based server (Cyprus / hosting provider).
Email (SMTP): local Exim server on the same infrastructure.
OVH (mailbox provider): for incoming mail to info@nxdpro.com.
OpenAI, L.L.C. (USA): ONLY when we trigger an AI-assist (email draft, summary). No client data is sent without explicit user action. Transfer covered by Standard Contractual Clauses (SCCs).
Accountant / authorities: only where required by law (VAT, tax audit).
Meta / WhatsApp: when you or we initiate a WhatsApp conversation (wa.me link).
Cloudflare, Inc. (USA): the Cloudflare Turnstile check on our forms (contact, free preview, free website check), which tells real visitors apart from bots, and security and content delivery network (CDN) services where we use them. To work, Cloudflare may process your IP address and technical details of your browser and device (e.g. user-agent). See section 5 for transfers outside the EEA.

5. International transfers

Where data is transferred outside the EEA (e.g. OpenAI and Cloudflare in the US), we use Standard Contractual Clauses and other appropriate safeguards under Article 46 GDPR.

Cloudflare: transfers to the US rely on the EU-U.S. Data Privacy Framework, under which Cloudflare is certified (adequacy decision, Article 45 GDPR), and on the European Commission's Standard Contractual Clauses (SCCs) included in Cloudflare's data processing addendum (Article 46 GDPR).

6. How long we keep data (Retention)

Requests that do not lead to working together (contact form, free preview, free website check): deleted 24 months after our last contact. If you become a client, the client periods apply.
Clients – accounting records: 6 years (Cyprus Assessment & Collection of Taxes Law).
Newsletter: until you unsubscribe.
Server logs: up to 90 days.

After expiry, data is securely deleted or pseudonymised.

7. Free preview & free website check requests

When you request a free homepage preview or a free proposal after checking your website, we collect:

business name, full name, phone and email; optionally your business category, city, current website or social media page and your message;
for the free check: the address of the website you checked and the check score;
how you found us (a campaign's utm parameters or the website you came from), the date and the IP address of the request.

Purpose: to prepare the preview or proposal you asked for and to contact you about it, by phone or email. Legal basis: your own request — steps taken before entering into a contract (Article 6(1)(b) GDPR) — and the consent you give on the form (Article 6(1)(a)).

Retention: as for every request (section 6) — if you do not become a client, we delete the request details 24 months after our last contact. If you become a client, the client retention periods apply.

News & offers: we only send them if you tick the optional box "I'd like to receive news and offers from NXDPRO". We keep the date and the exact wording of your consent. You can withdraw it at any time by emailing info@nxdpro.com — with no effect on your request.

We do not make cold calls, we do not send messages you did not ask for and we never share your details with third parties for advertising.

Source cookie (nx_src): only if you accept cookies, we keep for 90 days where you came from (e.g. utm_source or the referring website), so we know which campaigns work. See the Cookie Policy.

8. Your rights

Under Articles 15-22 GDPR you have the right to:

Access (copy of your data)
Rectification (if inaccurate or incomplete)
Erasure ("right to be forgotten")
Restriction of processing
Portability (structured copy)
Object to processing based on legitimate interest
Withdraw consent at any time (without affecting prior processing)

9. Data Deletion

To have all your data deleted, email info@nxdpro.com with the subject "Data Deletion Request" and the email/phone you used. We respond within 30 calendar days. Records subject to mandatory tax retention (6 years) cannot be deleted before that period expires.

10. Complaint to the Authority

You may lodge a complaint with the Cyprus Commissioner for Personal Data Protection (15 Kypranoros, 1061 Nicosia · commissioner@dataprotection.gov.cy · +357 22 818456).

11. Security

We use HTTPS (TLS), password hashing (bcrypt), CSP headers, rate limiting, CSRF tokens, automated backups and per-site isolation. No method is 100% secure but we apply industry standards.

12. Automated decision-making

We do not make decisions based solely on automated processing with legal / significant effects on you.

13. Children

Our services target businesses. We do not knowingly collect data of children under 16.

14. Changes to this Policy

We may update this policy. The date at the top reflects the latest revision. Material changes are announced on the website and (where you have an active relationship with us) by email.

15. Contact

For any data-protection matter: info@nxdpro.com · NXDPRO Solutions, Limassol, Cyprus.