1. THE CONTROLLER
1.1 MBG Digital Agency Ltd (we, us or our), a company incorporated under the laws of the Republic of Cyprus, having its registered seat at Anexartisias 187, 3040 Limassol, Cyprus, and registered with the Department of Registrar of Companies and Intellectual Property of the Republic of Cyprus under number ΗΕ 459808, operates the website at mbg-digital.com (the Website).
1.2 We are the controller of the personal data described in this policy for the purposes of Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) and of the Law Providing for the Protection of Natural Persons with Regard to the Processing of Personal Data and for the Free Movement of Such Data of 2018 (Law 125(I)/2018).
1.3 Any question concerning this policy or the personal data we hold about you may be addressed to us at [email protected] or at the registered seat set out in clause 1.1. We have not appointed a data protection officer, as we are not required to do so under Article 37 GDPR.
2. SCOPE OF THIS POLICY
2.1 This policy explains how we handle personal data in connection with the Website and with enquiries sent to us by electronic mail.
2.2 This policy does not apply to personal data that we process on behalf of our clients in the course of providing services to them. In those cases the client is the controller, we act as a processor under a separate written agreement concluded in accordance with Article 28 GDPR, and the client’s own privacy policy governs that processing.
3. PERSONAL DATA WE PROCESS
3.1 Enquiries. The Website does not host contact forms, user accounts, newsletter subscription facilities or comment functionality. If you write to us at the address published on the Website, we receive your electronic mail address, your name, and any other information you choose to include in your message and in any subsequent correspondence.
3.2 Technical data. As is the case with any website, the systems that serve the Website automatically record limited technical information about each visit, including the IP address, browser type and version, operating system, referring page, the pages requested, and the date and time of each request. We do not use this information to identify visitors and we do not combine it with any other data.
3.3 Cookies. We do not use analytics, advertising, profiling or social media cookies, and we do not track visitors across websites or over time. Cookies that are strictly necessary to deliver the Website and to protect it against automated abuse may be set by our infrastructure and security providers. Such cookies fall within the exemption in Article 4(4) of the Law on the Regulation of Electronic Communications and Postal Services of 2004 (Law 112(I)/2004), which implements Article 5(3) of Directive 2002/58/EC, and accordingly do not require your consent.
3.4 We do not carry out profiling, and we do not take decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.
4. PURPOSES AND LEGAL BASES
4.1 We process personal data for the following purposes and on the following legal bases:
| Purpose | Personal data | Legal basis |
| Reading, assessing and responding to your enquiry | Enquiry correspondence | Legitimate interests, Article 6(1)(f) GDPR — responding to a person who has chosen to contact us. Where the enquiry concerns a possible engagement, steps taken at your request prior to entering into a contract, Article 6(1)(b) GDPR |
| Keeping a record of our correspondence with you | Enquiry correspondence | Legitimate interests, Article 6(1)(f) GDPR — maintaining an accurate record of our business dealings |
| Operating, securing and maintaining the availability of the Website | Technical data | Legitimate interests, Article 6(1)(f) GDPR — network and information security |
| Establishing, exercising or defending legal claims, and complying with our legal obligations | As relevant to the matter | Legitimate interests, Article 6(1)(f) GDPR, and compliance with a legal obligation to which we are subject, Article 6(1)(c) GDPR |
4.2 Where we rely on our legitimate interests, we have weighed those interests against your interests, rights and freedoms and have concluded that our processing is confined to what a person contacting a business by electronic mail would reasonably expect. You may obtain further information about that assessment by writing to us.
4.3 We do not send marketing communications. We will not add your address to a mailing list, and we will not use it to contact you about our services otherwise than in reply to your enquiry and in the correspondence that follows from it. We do not sell personal data, and we do not share it with third parties for their own marketing purposes.
5. RECIPIENTS
5.1 We disclose personal data only to the following categories of recipient:
(b) Google Ireland Limited, our electronic mail service provider, which hosts our mailboxes;
(c) Cloudflare, Inc., which provides content delivery, electronic mail address obfuscation and security services in respect of the Website;
(d) our professional advisers, where necessary for the purposes set out in clause 4.1; and
(e) competent authorities and courts, where we are required by law to disclose or where disclosure is necessary for the establishment, exercise or defence of legal claims.
5.2 Each of the providers listed in paragraphs (a) to (c) above acts as our processor under a written agreement concluded in accordance with Article 28 GDPR and may process personal data only on our documented instructions.
6. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA
6.1 Certain of the providers referred to in clause 5.1 are established in, or process personal data from, countries outside the European Economic Area, including the United States of America. Where that is the case, the transfer is made on the basis of:
(a) the adequacy decision of the European Commission of 10 July 2023 in respect of the EU–US Data Privacy Framework, where the recipient is certified under that framework; or
(b) the standard contractual clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR, together with such supplementary measures as our transfer impact assessment indicates to be necessary.
6.2 A copy of the relevant safeguard may be obtained by writing to us at the address in clause 1.3.
7. RETENTION
7.1 We retain enquiry correspondence for 24 (twenty-four) months from the date of our last exchange with you. Where an enquiry results in an engagement, the correspondence is retained for the duration of that engagement and thereafter for such period as is required by the applicable limitation periods and by accounting and tax legislation.
7.2 Server logs are retained for 12 monthsand are thereafter deleted or aggregated such that individuals can no longer be identified.
8. YOUR RIGHTS
8.1 Subject to the conditions and exceptions provided for in the GDPR, you have the right to:
(a) obtain confirmation as to whether we process personal data concerning you and, where we do, a copy of that data and the information specified in Article 15 GDPR;
(b) obtain the rectification of inaccurate personal data and the completion of incomplete personal data (Article 16 GDPR);
(c) obtain the erasure of personal data concerning you (Article 17 GDPR);
(d) obtain the restriction of processing (Article 18 GDPR);
(e) receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to have it transmitted to another controller, where the processing is based on consent or on a contract and is carried out by automated means (Article 20 GDPR); and
(f) object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Article 21 GDPR). Where you object, we will cease processing unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.
8.2 Any of these rights may be exercised by writing to us at the address in clause 1.3. We will respond without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you of the extension and of the reasons for it within one month of receipt.
9. COMPLAINTS
9.1 If you consider that our processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with the Cypriot supervisory authority:
Office of the Commissioner for Personal Data Protection
Kypranoros 15, 1061 Nicosia, Cyprus
P.O. Box 23378, 1682 Nicosia, Cyprus
Telephone: +357 22 818 456
Electronic mail: [email protected]
Website: www.dataprotection.gov.cy
9.2 You may alternatively lodge a complaint with the supervisory authority of the Member State of your habitual residence or place of work, and you have the right to an effective judicial remedy against a controller pursuant to Article 79 GDPR.
10. SECURITY
10.1 We implement technical and organisational measures appropriate to the risk presented by our processing, including transport-layer encryption for the Website, access controls on our mailboxes, and restriction of access to correspondence to those personnel who require it for the purposes set out in clause 4.1.
10.2 No system of transmission or storage is entirely secure. Electronic mail in particular is not a secure medium, and we ask that you do not send us special categories of personal data, financial account details or authentication credentials by that means.
11. CHILDREN
11.1 The Website is directed at businesses and is not intended for children. We do not knowingly collect personal data relating to any person under the age of sixteen (16) years.
12. AMENDMENTS
12.1 We may amend this policy from time to time in order to reflect changes in our practices or in applicable law. The date stated at the head of this document indicates when it was last revised. Where we hold contact details for you and it is appropriate to do so, we will draw material amendments to your attention.