01Introduction
PAYPILOT CY LTD (“PayPilot”, “Company”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal data processed in connection with its public website at https://paypilot.cy (the “Website”).
This Privacy Policy explains how we collect, use, disclose, retain and protect personal data and how individuals may exercise their rights under Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and applicable Cyprus data protection legislation.
This Policy concerns the public informational Website and communications with its visitors. It does not describe the processing associated with future regulated crypto-asset services, client onboarding, identity verification or transaction monitoring, which are not currently offered through the Website.
02Data Controller
The controller responsible for personal data processed under this Policy is:
PAYPILOT CY LTDRegistration Number: HE 497184Agiou Andreou 2963035 Limassol, CyprusEmail: [email protected]Website: https://paypilot.cyPrivacy enquiries and requests concerning personal data may be submitted to [email protected].
03Personal Data We Collect
Depending on how you interact with the Website, we may process the following categories of personal data.
3.1 Information You Provide
When you contact us through the Website or by email, we may collect:
- Your name, if provided;
- Your email address;
- Your organisation or business name, if provided;
- The subject and content of your enquiry;
- Information included in attachments or correspondence; and
- Records of our communications with you.
When you submit a complaint, we may additionally process the circumstances described in the complaint, supporting information, correspondence history and the outcome of its review.
Please do not send identity documents, payment credentials, private cryptographic keys, wallet recovery phrases or other sensitive information through general Website communication channels.
3.2 Technical Information
When you visit the Website, our systems and technical service providers may process limited technical information required to operate, secure and maintain the Website, including:
- IP address;
- Date and time of access;
- Browser type and device-related technical information;
- Requested pages and technical request information;
- Error and security event records; and
- Information associated with strictly necessary cookies or similar technologies.
We do not use the Website to perform customer identity verification or to collect KYC documentation before the commencement of authorised services.
04Purposes and Legal Bases of Processing
We process personal data only where there is an appropriate legal basis under Article 6 GDPR.
| Purpose | Legal Basis |
|---|---|
| Receiving and responding to general enquiries | Legitimate interests under Article 6(1)(f) GDPR in managing communications and responding to persons who contact us |
| Receiving, reviewing and resolving Website-related complaints | Legitimate interests under Article 6(1)(f) GDPR in investigating concerns, maintaining accountability and resolving disputes |
| Operating, maintaining and securing the Website | Legitimate interests under Article 6(1)(f) GDPR in ensuring Website functionality, integrity and security |
| Preventing misuse, fraud or unauthorised access affecting the Website | Legitimate interests under Article 6(1)(f) GDPR in protecting our systems and communications |
| Complying with applicable legal obligations | Article 6(1)(c) GDPR, where processing is necessary for compliance with a legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests under Article 6(1)(f) GDPR, where applicable and subject to the rights and interests of affected individuals |
| Handling requests to exercise data protection rights | Article 6(1)(c) GDPR, where processing is necessary to comply with GDPR obligations |
Where processing relies on legitimate interests, we consider the necessity of the processing and balance those interests against the rights and freedoms of the individuals concerned.
We do not rely on consent as the default legal basis for ordinary Website enquiries or strictly necessary technical operations.
05Contact Forms and Correspondence
Information submitted through contact forms is used to receive, assess and respond to your message and to maintain an appropriate record of the communication.
Messages submitted through the Website may be transmitted and stored using email delivery, hosting and related technical service providers acting on our behalf.
We do not use contact form submissions to enrol visitors in a marketing mailing list or to initiate regulated client onboarding.
06Complaints
Personal data submitted in connection with a Website-related complaint is used to acknowledge, investigate, respond to and document the complaint.
Access to complaint information is restricted to personnel and advisers who require it for the handling of the matter, subject to appropriate confidentiality and security arrangements.
Further information is available in our Complaints Handling Policy.
08Recipients of Personal Data
Personal data may be disclosed, where necessary and proportionate, to:
- Personnel authorised to handle enquiries, complaints and Website administration;
- Website hosting and infrastructure service providers;
- Email delivery and communication service providers;
- IT maintenance and information security service providers;
- Professional advisers, including legal and compliance advisers, where necessary;
- Competent public authorities, regulators or courts where disclosure is legally required; and
- Other recipients where disclosure is lawful and necessary to establish, exercise or defend legal rights.
Service providers processing personal data on our behalf are required to act under appropriate contractual and data protection arrangements, including Article 28 GDPR where applicable.
We do not sell visitors' personal data.
09International Data Transfers
PayPilot seeks to use appropriate technical and organisational arrangements for the processing of Website-related personal data.
Where personal data is transferred outside the European Economic Area, we will ensure that the transfer complies with Chapter V GDPR, including through an applicable adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses, together with any additional measures required in the circumstances.
The location of a hosting server does not by itself determine whether an international transfer occurs; relevant access and processing arrangements must also be considered.
10Data Retention
We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable legal obligations and the need to establish, exercise or defend legal claims.
Our standard retention periods are:
| Data Category | Standard Retention Period |
|---|---|
| General enquiries and related correspondence | 12 months after the enquiry is closed |
| Website-related complaints and supporting correspondence | 3 years after the complaint is closed |
| Technical security and access logs | Up to 90 days |
| Records relating to GDPR rights requests | 3 years after completion of the request |
Information may be retained for a longer period where necessary to comply with a legal obligation, respond to an ongoing investigation, or establish, exercise or defend legal claims. In such cases, access and retention are limited to what is necessary.
Data is deleted or anonymised when the applicable retention period expires, subject to relevant technical backup cycles and lawful exceptions.
Retention of strictly necessary cookies is addressed separately in our Cookie Policy.
11Data Security
We implement technical and organisational measures appropriate to the nature of the personal data and the risks associated with its processing.
These measures may include access restrictions, secure transmission, controlled administration, system maintenance, security monitoring and procedures for responding to suspected personal data breaches.
No method of internet transmission or electronic storage can be guaranteed to be entirely secure. We nevertheless take reasonable and proportionate steps to protect the personal data we process.
12Your Rights
Subject to the conditions and limitations provided by the GDPR, you may have the right to:
- Request access to your personal data;
- Request correction of inaccurate or incomplete data;
- Request erasure of personal data;
- Request restriction of processing;
- Object to processing based on legitimate interests;
- Request data portability where the legal conditions apply;
- Withdraw consent where processing is based on consent, without affecting prior lawful processing; and
- Lodge a complaint with a competent data protection supervisory authority.
You may exercise your rights by emailing [email protected].
We may request information reasonably necessary to verify your identity before responding to a request. We will respond within the periods required by the GDPR, ordinarily within one month of receipt, subject to permitted extensions.
13Automated Decision-Making
The Website does not perform automated decision-making that produces legal effects or similarly significant effects on visitors within the meaning of Article 22 GDPR.
14Children
The Website is intended to provide information about a proposed business involving regulated crypto-asset services. It is not directed at children, and we do not knowingly seek to collect children's personal data through the Website.
If we become aware that personal data has been submitted in circumstances requiring deletion or other protective action under applicable law, we will take appropriate steps.
16Changes to This Privacy Policy
We may amend this Privacy Policy to reflect changes in legal requirements, Website functionality or our data processing practices.
The current version will be published on the Website with its effective date. Where required by law, we will provide additional notice or obtain consent before implementing a material change in processing.
17Contact
For privacy enquiries or requests to exercise your rights:
PAYPILOT CY LTDAgiou Andreou 2963035 Limassol, CyprusEmail: [email protected]