Privacy Policy

1. Data Controller

CyprusSpot (Company formation in progress). Contact via the platform contact form.

2. Data Categories

• Account data (name, email, phone).
• Listing and content data.
• Business verification data (legal name, registration number, business contact details).
• Technical security data (IP, user-agent, logs).

3. Purposes & Legal Basis

• Marketplace service delivery (contract necessity).
• Security, abuse prevention, and trust/safety (legitimate interests).
• Compliance with legal obligations where required.

4. Retention

Data is retained only as long as needed for operations, security, and compliance. Business verification logs are retained for up to 24 months after account closure, unless a longer period is required by law.

5. User Rights

You may request access, correction, deletion, restriction, or portability via the contact form.

6. International Transfers

Where technical providers outside the EU are used, appropriate safeguards are applied under applicable law.

7. Data Processors

Data Processors: We use the following third-party processors to operate the platform: Supabase (supabase.com) - database and authentication; Vercel (vercel.com) - hosting and performance analytics; Google (google.com) - reCAPTCHA fraud prevention on contact and enquiry forms; SMTP email provider - transactional email notifications. Each processor is bound by a data processing agreement and processes data only as instructed.

8. Retention Details

Data Retention: We retain account data for as long as your account is active. Contact and enquiry messages are retained for up to 2 years. Security and rate-limiting logs are retained for 90 days. Business verification records are retained for up to 24 months after account closure.

9. Your Rights

Your Rights: You have the right to access, correct, delete, restrict, or export your personal data at any time. To exercise these rights, use the contact form or the account settings in your dashboard. We will respond within 30 days.