Octobiz Privacy Policy | Data & Cookies Notice

1. Controller

The controller for the processing of personal data on this website is Octobiz Ltd, company number HE 471900, Kyriakou Matsi 8, Antoniella Court, Office 202, 8021 Paphos, Cyprus. Phone: +357 999 613 00. Email: info@octo.biz. For all questions about data protection, write to info@octo.biz with the subject line “Data protection”.

2. Legal framework

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data of 2018 (Law 125(I)/2018). Where we use cookies or similar technologies that are not strictly necessary, we ask for your consent in line with the Cyprus Electronic Communications and Postal Services Law (Law 112(I)/2004), Article 99.

We rely on these legal bases: Consent (Art. 6(1)(a) GDPR), steps prior to entering into a contract or the performance of a contract (Art. 6(1)(b)), compliance with legal obligations (Art. 6(1)(c)), and our legitimate interests (Art. 6(1)(f)) in operating a secure, fast and functional website and in communicating with business contacts.

3. Hosting and server log files

This website is hosted by Hostinger International Ltd, Cyprus, on servers in the European Union. Hostinger processes data on our behalf under a data processing agreement (Art. 28 GDPR).

When you visit the website, the server automatically records log files: IP address, date and time of access, requested page or file, referrer URL, HTTP status code, amount of data transferred, browser type and version, and operating system. We need this data to deliver the website, ensure stability and security and investigate attacks. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Log files are deleted after no more than 30 days, unless a security incident requires longer retention for clarification.

4. Content delivery network (KeyCDN)

To deliver images, scripts and stylesheets quickly, we use KeyCDN, a service of proinity LLC, Switzerland. When files are delivered, your IP address and technical request data are processed by KeyCDN servers. Switzerland has an adequacy decision by the European Commission. The legal basis is our legitimate interest in fast, reliable delivery (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with the provider.

5. Fonts

We use the Montserrat typeface, hosted on our own server. No connection to Google Fonts or any other font provider is established when you visit the website.

6. Security (Wordfence)

We protect the website with the Wordfence security plugin of Defiant, Inc., Seattle, USA. Wordfence runs on our server as a firewall and malware scanner. To detect attacks, it processes the IP address, the requested URL, the user agent and the time of access, and compares IP addresses with a threat list. Where threat data is exchanged with Defiant, IP addresses may be transferred to the USA on the basis of the European Commission’s Standard Contractual Clauses. The legal basis is our legitimate interest in protecting the website and its users (Art. 6(1)(f) GDPR). Security logs are kept for up to 30 days.

7. Contact form, email and phone

When you contact us through the form (Contact Form 7), by email, phone or WhatsApp, we process the data you provide: Name, company, email address, phone number, your role and your message. We use it only to answer your request and, if you wish, to prepare an engagement. The legal basis is Art. 6(1)(b) GDPR for requests aimed at a contract and Art. 6(1)(f) GDPR for other business inquiries. Form submissions are sent to us by email and are not stored in the website database. We keep correspondence for as long as needed to handle your request and delete it when it is no longer needed, unless statutory retention periods apply, for example six years for business correspondence under Cyprus tax law.

Please do not send confidential company figures through the form. We share a non-disclosure agreement before any sensitive data is exchanged. Data provided in a mandate is governed by the engagement letter and, where applicable, a separate data processing agreement.

8. Spam protection (Cloudflare Turnstile)

To protect the contact form against spam and bots, we use Cloudflare Turnstile, a service of Cloudflare, Inc., San Francisco, USA. Turnstile checks in your browser whether the request comes from a human. For this purpose it processes technical data such as IP address, browser and device characteristics and interaction signals. Turnstile does not use cookies for advertising. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, which provides an adequate level of protection under the European Commission’s adequacy decision of July 10, 2023. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

9. Cookies and consent management (Real Cookie Banner)

We use the Real Cookie Banner plugin of devowl.io GmbH, Germany, to obtain and document your consent. The plugin runs on our server. It stores your consent decision in a cookie and records the consent in our database together with a pseudonymized identifier, the time and the version of the banner, so that we can prove consent as required by Art. 7(1) GDPR. The legal basis is our legal obligation (Art. 6(1)(c) GDPR). Consent records are kept for up to three years.

Strictly necessary cookies are set without consent. Matomo, our only analytics tool, runs only after you have consented. You can change or withdraw your consent at any time with effect for the future through the cookie settings link in the footer of every page.

10. Web analytics with Matomo (consent)

With your consent, we use Matomo, an open-source analytics tool installed on our own server. No data is passed to third parties. Matomo helps us understand which pages are useful and how visitors find us. IP addresses are anonymized by removing the last two bytes before storage. Matomo sets the cookies listed below. The legal basis is your consent (Art. 6(1)(a) GDPR). Analytics data is deleted after 25 months.

11. WhatsApp chat button (Click to Chat)

A WhatsApp button lets you start a chat with us. The plugin itself does not transfer data. Only when you click the button are you forwarded to WhatsApp, a service of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, part of Meta. From that moment WhatsApp’s privacy policy applies, and data may be transferred to Meta Platforms, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework. If you message us, we process your phone number, profile name and message to answer you (Art. 6(1)(b) or (f) GDPR). If you prefer, use email or phone instead.

12. Google Maps links

We do not embed Google Maps. Our contact page contains a plain link to our office location. Only when you click it are you forwarded to Google Maps, operated by Google Ireland Limited, and Google’s privacy policy applies.

13. Performance, SEO and maintenance plugins

WP Rocket (WP Media, France) creates cached copies of our pages to make them load faster. It runs on our server and does not process visitor data beyond what the server needs to deliver the page.

Rank Math SEO generates titles, descriptions and structured data for search engines. Its 404 monitor records requested URLs that do not exist, without IP addresses, so that we can fix broken links.

Redirection forwards old addresses to new ones. Its logs record the requested URL, time and referrer. IP logging is disabled. Logs are deleted after 30 days.

UpdraftPlus creates regular backups of the website, including its database. Backups are stored on Hostinger servers in the EU and kept for up to 30 days. The legal basis for these plugins is our legitimate interest in a fast, findable and secure website (Art. 6(1)(f) GDPR).

14. Cookies used on this website

Name	Provider	Purpose	Duration	Basis
real_cookie_banner-*	Octobiz (Real Cookie Banner)	Stores your consent decision	1 year	Legal obligation
wordfence_verifiedHuman, wfwaf-authcookie-*	Octobiz (Wordfence)	Security, bot detection; login protection for administrators	1 day to 12 hours	Legitimate interest
_pk_id.*	Octobiz (Matomo)	Recognizes returning visitors for statistics	13 months	Consent
_pk_ses.*	Octobiz (Matomo)	Groups page views into a visit	30 minutes	Consent

15. Recipients

We share personal data only with the service providers named in this policy, who act as processors under data processing agreements or as independent controllers where stated, and with authorities where the law requires it. We do not sell personal data.

16. Transfers outside the European Economic Area

Where data is transferred to countries outside the EEA, we rely on an adequacy decision of the European Commission (for Switzerland, and for the USA for providers certified under the EU-U.S. Data Privacy Framework) or on Standard Contractual Clauses under Art. 46(2)(c) GDPR.

17. Retention

We keep personal data only as long as necessary for the purposes described or as required by law. Retention periods are stated in each section above. When the purpose no longer applies and no statutory retention obligation exists, the data is deleted.

18. Your rights

Under the GDPR and Law 125(I)/2018 you have the right:

to access your personal data and receive a copy (Art. 15 GDPR),
to rectification of inaccurate data (Art. 16 GDPR),
to erasure (Art. 17 GDPR),
to restriction of processing (Art. 18 GDPR),
to data portability (Art. 20 GDPR),
to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21 GDPR),
to withdraw your consent at any time with effect for the future, without affecting the lawfulness of processing before the withdrawal (Art. 7(3) GDPR), and
not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly affects you (Art. 22 GDPR). We do not make such decisions on this website.

To exercise your rights, write to info@octo.biz. We answer within one month, as set out in Art. 12(3) GDPR.

19. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority in Cyprus is the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus (postal address: P.O. Box 23378, 1682 Nicosia). Phone: +357 22 818 456. Email: commissioner@dataprotection.gov.cy. Website: www.dataprotection.gov.cy. You may also contact the supervisory authority in the EU member state where you live or work.

20. Obligation to provide data

You are not obliged to provide personal data. Without the data marked as required in the contact form, we cannot answer your request through the form, but you can always call or email us.

21. Data security

We use TLS encryption for all connections to this website, keep our systems up to date and protect them with technical and organizational measures appropriate to the risk (Art. 32 GDPR).

22. Changes to this policy

We update this policy when our website or the law changes. The version published on this page applies.

Privacy policy

9. Cookies and consent management (Real Cookie Banner)