Privacy Policy

The protection of your personal data matters to us. This privacy policy explains comprehensively, in line with the General Data Protection Regulation (GDPR) and the supplementary provisions of the Republic of Cyprus, which personal data we process when you visit this website and when you contact us, for which purposes, on which legal basis and what rights you have.

1. Controller

The controller within the meaning of the GDPR is:
CMC Family Office Group Ltd
Serghides House, Suite 102, 61 Archbishop Makarios III Avenue, 6017 Larnaca, Republic of Cyprus
Registration number HE 495795 · Chairman: Constantinos Zourides
Email: contact@cmc-family-office.com · Phone: +357 24 400 246

For any data-protection matters and to exercise your rights, please contact us at the email address above. We are not legally required to appoint a data protection officer, as the relevant conditions are not met.

2. Definitions and general principles

Personal data is any information relating to an identified or identifiable natural person. We process such data in accordance with the principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality (Art. 5 GDPR) and in line with Cyprus Law 125(I)/2018. Processing takes place only where there is a legal basis or where you have consented.

3. Legal bases for processing

Depending on the purpose, we base processing on Art. 6(1) GDPR: your consent (a), the performance of a contract or pre-contractual measures (b), compliance with a legal obligation (c), or our legitimate interests or those of a third party (f). Legitimate interests include, in particular, the secure and functional operation of the website, responding to enquiries and preventing misuse. We state the applicable basis for each processing activity and in the overview below.

4. Overview of processing activities

5. Website access and server log files

When you access the website, our hosting provider automatically collects information transmitted by your browser: browser type and version, operating system, referrer URL, host name of the accessing device, IP address and the date and time of access. This data serves the technical delivery, stability and security of the website and is not merged with other data sources. The legal basis is our legitimate interest in secure and trouble-free operation (Art. 6(1)(f) GDPR). Log files are deleted as soon as they are no longer required for the purpose of collection, at the latest after 30 days; longer storage only occurs where there are specific indications of an attack or misuse.

6. Hosting

This website is hosted by a specialised service provider that processes the data arising from the operation of the website on our behalf and exclusively in accordance with our instructions, on the basis of a data-processing agreement pursuant to Art. 28 GDPR. Servers within the European Union are preferred.

7. Cookies and local fonts

This website does not use tracking, analytics or advertising cookies. There is no reach measurement and no profiling. Fonts are served locally from our own server; there is no connection to external providers (such as Google Fonts) and therefore no transfer of your IP address to third parties. A cookie consent banner is consequently not required. Should services requiring consent be used in the future, we will obtain your consent beforehand.

8. Contacting us (email, phone, form)

If you contact us by email, telephone or via the contact form, we process the information you provide (e.g. name, email address, telephone number and the content of your message) in order to handle your enquiry and for any follow-up questions. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to the conclusion or performance of a contract, and otherwise our legitimate interest in responding (f). The contact form opens your local email programme and sends the message by email; no form data is stored on this web server. We retain your enquiry until it has been fully dealt with and no statutory retention obligations apply.

9. Contact via WhatsApp

This website contains links to WhatsApp. If you use this channel, the operator (WhatsApp Ireland Ltd. / Meta Platforms) processes the data arising (including your phone number and message content) on its own responsibility; this may involve a transfer to the USA. The legal basis for providing the contact option is our legitimate interest in an easy means of contact (Art. 6(1)(f) GDPR) or your consent through active use (a). For details please see the WhatsApp/Meta privacy policy. If you wish to avoid this transfer, please use email or telephone.

10. Appointment booking

To arrange appointments we use the booking system of the provider Calendly (Calendly LLC, USA). When you book an appointment, the data you enter (e.g. name, email address, preferred time, optional notes) is processed to organise and hold the appointment. The legal basis is Art. 6(1)(b) GDPR (performance of pre-contractual measures). A data-processing agreement pursuant to Art. 28 GDPR is in place with the provider; as the provider is based in the USA, data may be transferred to the USA, safeguarded by the EU standard contractual clauses or a certification under the EU-U.S. Data Privacy Framework.

11. Recipients and processors

Your data is transferred to third parties only where this is necessary to perform the contract, you have consented, or we are legally obliged to do so. As processors we use, in particular, providers for hosting, email and appointment booking, who are contractually bound under Art. 28 GDPR. Authorities receive data only within the framework of mandatory statutory requirements.

12. Cooperation with authorised partners

To implement mandates we cooperate with independent, authorised partners (such as lawyers, tax advisers, auditors and banks). Where a transfer of your data is required for this, it takes place only to the extent necessary and generally on the basis of Art. 6(1)(b) GDPR. These partners are responsible for the processing within their own area of responsibility as separate controllers and inform you about their processing separately.

13. Transfers to third countries

Where data is transferred to recipients in countries outside the European Economic Area (for example when using WhatsApp), this only takes place where an adequacy decision of the EU Commission exists or where appropriate safeguards such as the EU standard contractual clauses have been agreed. On request, we will provide you with information on the safeguards in place.

14. Storage period and erasure

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods. Commercial and tax retention obligations may require storage of up to six or seven years. After expiry, the data is deleted or anonymised.

15. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing (Art. 21). To exercise these, an informal message to the email address above is sufficient. We will respond without undue delay and at the latest within one month; to protect your rights, we may request further information to confirm your identity.

16. Right to object

Where we base processing on a legitimate interest (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then cease the processing unless we can demonstrate compelling legitimate grounds that override your interests.

17. Withdrawal of consent

Where you have consented to processing, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out until withdrawal remains unaffected.

18. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority. In Cyprus the competent authority is the Office of the Commissioner for Personal Data Protection, 1 Iasonos Street, 1082 Nicosia, Cyprus. Users in Germany or Austria may also contact the authority responsible for their place of residence or work.

19. Obligation to provide data

In the context of an enquiry or a contractual relationship, you must provide the data required for processing or performance or prescribed by law. Without this data, we may not be able to process the respective enquiry or contract.

20. Data security and technical measures

This website uses SSL/TLS encryption to protect the transmission of your data. In addition, we take appropriate technical and organisational measures (Art. 32 GDPR) to protect your data against unauthorised access, loss or manipulation; these measures are continuously adapted to the state of the art.

21. Minors

Our services are addressed to entrepreneurs and adult prospects. Persons under the age of 18 should not transmit personal data to us without the consent of their legal guardians.

22. No automated decision-making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

23. External links

This website contains links to external third-party websites. We have no influence over their content or data processing; the privacy notices of the respective providers apply.

24. Updates and changes

This privacy policy is dated July 2026. Further development of the website or changes in legal requirements may make an update necessary. The version published on this page applies in each case.