Privacy Policy

1. Platform Operator & Data Processor

CyPRO One Incorporations ("we", "us", "our") is a trading name of ModulOn Solution Ltd (ΗΕ 489056), which operates this platform exclusively as a SaaS technology platform. ModulOn Solution Ltd acts as the platform operator and data processor for personal data collected through this website. ModulOn Solution Ltd is not a law firm, accounting firm, or licensed estate agency and does not itself provide legal advice, accountancy services, real estate agency services, or any other regulated professional service.

Professional services (legal, accounting, real estate referral) are delivered by independent third-party providers as listed in Section 6 (Sub-processors) below. Each of those providers acts as an independent data controller for the personal data they receive in connection with their own regulated services.

2. What Data We Collect

We collect the following personal data when you submit a quote request or use the platform:

• Contact information: full name, email address, phone number
• Company preferences: preferred company names, business activity description
• Corporate structure: director and secretary preferences, registered office address, shareholder information
• Identity documents: passport copy and utility bill (uploaded at your discretion for KYC purposes)
• Technical data: browser session information, and — only if you consent — the online identifiers set by our analytics and advertising cookies (see Section 9 and our Cookie Policy)

3. Lawful Basis for Processing

We process your personal data on the following lawful bases:

• Legitimate interest (Article 6(1)(f) GDPR): responding to your incorporation enquiry, preparing a quotation, and communicating with you about the services you have requested.
• Contract performance (Article 6(1)(b) GDPR): processing necessary to carry out services you have engaged through the platform.
• Consent (Article 6(1)(a) GDPR): when you upload identity documents (passport, utility bill), we process those on the basis of your explicit consent given at the time of upload. Consent is also the basis on which we set analytics and advertising cookies and share the resulting data with Google, as described in Section 9.
• Legal obligation (Article 6(1)(c) GDPR): where we are required to retain records under Cyprus law (e.g. anti-money laundering regulations).

4. Purpose of Processing

Your data is used for the following purposes:

• Preparing and sending a customised quotation for company incorporation
• Coordinating the delivery of services by licensed independent providers
• Conducting KYC and AML verification as required by Cyprus law
• Ongoing compliance communication (annual returns, statutory filings) if you become a client
• Responding to support enquiries via the platform messaging system

5. Data Retention

• Unconverted leads: If you do not proceed with incorporation, your personal data will be deleted after 2 years from the date of submission.
• Client data: If you become a client, your corporate records and personal data will be retained for the statutory minimum under Cyprus law — 7 years from the end of the relevant financial year — as required for corporate records and tax purposes.
• Identity documents: Retained in line with anti-money laundering obligations (minimum 5 years under Cyprus AML law).

6. Sub-processors and Third Parties

We may share your personal data with the following categories of organisations. Where a party is listed as an independent data controller, they process data under their own privacy obligations and regulatory frameworks.

Intra-EU transfers: The Cyprus firms listed above are registered and operating within Cyprus, an EU member state. Transfers of personal data to these firms therefore remain within the European Economic Area and do not require an adequacy decision or transfer mechanism under GDPR Chapter V. These transfers are nonetheless disclosed here in the interest of full transparency.

Transfers outside the EEA: Fly.io and Tigris Data are incorporated in the United States, and we have instructed both to keep the application, its database and the document bucket within the European Union. Because each is a US-incorporated processor, its parent may in principle be subject to US access requests; those transfers are governed by the Standard Contractual Clauses adopted by the European Commission, incorporated into our data processing agreement with each provider. Where, and only where, you have consented to analytics or advertising cookies, the data those cookies generate may additionally be processed in the United States by Google LLC on the basis described in Section 9. Apart from those two cases, no category of personal data leaves the EEA.

7. Your Rights

Under the GDPR, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate personal data.
• Right to erasure: Request deletion of your personal data (subject to legal retention obligations).
• Right to restriction: Request that we restrict processing of your data in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent (document uploads, and analytics and advertising cookies), you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. For cookies, the withdrawal mechanism is the Cookie settings control described in Section 9.

To exercise any of these rights, contact us in writing at the registered address listed in Section 1.

8. Right to Lodge a Complaint

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the supervisory authority. In Cyprus, this is the:

Office of the Commissioner for Personal Data Protection
1 Iasonos Street, 1082 Nicosia, Cyprus

9. Cookies

We use strictly necessary cookies — the session and portal login cookies without which the site cannot operate. These require no consent and are set on every visit.

We also use advertising cookies (Google Ads) and, once that property is enabled, analytics cookies (Google Analytics 4). Neither is set on the basis of a legitimate interest and neither operates in the background: the corresponding script is not loaded at all, and no cookie in either category is written, until you have given consent for that category on the cookie banner shown on your first visit. Rejecting, or simply closing the site without choosing, leaves only the strictly necessary cookies in place. Consent is our lawful basis under Article 6(1)(a) GDPR, read together with the consent requirement of the ePrivacy Directive as implemented in Cyprus.

Recipient. Where you consent, the recipient of the data those cookies generate is Google — Google Ireland Limited for visitors in the European Economic Area, with Google LLC in the United States processing on its behalf. Google acts as our processor for the measurement we commission and as an independent controller for its own purposes under its terms. It receives online identifiers, your IP address, device and browser characteristics and the pages you view; it does not receive your name, email address, telephone number or any document you upload. Google is also listed in Section 6.

Transfers outside the EEA. Data collected through the analytics and advertising cookies may be transferred to and processed in the United States by Google LLC. Those transfers rely on Google LLC's certification under the EU–US Data Privacy Framework, an adequacy decision adopted by the European Commission, and in addition on the European Commission's Standard Contractual Clauses, which Google incorporates into its data processing terms as a supplementary safeguard. No transfer of this kind takes place unless you have consented to the category concerned.

Withdrawing consent. You may withdraw your consent at any time, with effect for the future, using the Cookie settings button on our Cookie Policy page. It clears your stored choice and reopens the banner so you can choose again. That page also lists the individual cookies, their purposes and how long each is kept.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify existing clients of material changes. The "Last updated" date at the top of this page reflects the most recent revision.