Privacy Policy

We value the trust you place in us and in this respect we are committed to protecting your privacy. This privacy policy aims to help you understand how we, Octobiz Ltd, our affiliated companies and subsidiary companies, collect, use and disclose your personal data as well as inform you of your rights regarding your personal data.

Your personal data will be controlled by us, Octobiz Ltd, a company registered under the laws of the Republic of Cyprus, with registration number ΗΕ 471900, registered address 21/3 Dimma Street, 8220 Chlorakas, Paphos, Cyprus, and office at Kyriakou Matsi 8, Antoniella Court, Office 202, 8021 Paphos, Cyprus.

This Privacy Policy is separate and in addition to the client confidentiality obligations we have towards you.

Personal Data we collect

The personal data that we may collect includes:

• Basic information: Such as your name (including name prefix or title), the company you work for, your title or position and your relationship to a person;
• Contact information: Such as your postal address, business address, residential address, email address, telephone number, mobile number, and fax number(s);
• Compliance, identification, and background information: Provided by you or collected as part of our business acceptance processes and legal due diligence / know your clients obligations which we are required to implement. This may include information such as your education, tax identification number, passport or national identity card details, country of domicile and/or your nationality. In addition, we may collect details relevant to international sanctions and restrictive measures and any other information in order to assess whether you are a politically exposed person or money laundering risk;
• Publicly available information: Information collected from publicly available resources, including but not limited to information collected from databases we use to carry out compliance screening or credit rating agencies.

Collection of your Personal Data

We may collect personal data from you:

• In the course of our business and contractual obligations;
• In order to comply with legal and regulatory obligations;
• When you or your company seek our services;
• When you or your company contact and/or request information from us through our website, in person, over email or over the telephone. We may monitor, record, and store any such communication;
• When you or your company provide services to us, or otherwise offer to do so;
• We may collect or receive information about you from publicly available sources or from third parties, most commonly where we need to conduct background checks about you.

In the event that you provide us with personal data of other people, such as your employees, directors and shareholders of your companies, or any other person who conducts your business with you, you must ensure that you are entitled to disclose that personal data to us, that they are familiar with this Privacy Policy, and that we can proceed in using and disclosing that data in the manner described herein.

We may also collect personal data from your adviser and intermediary for the purpose of providing the requested services to you.

How we use your Personal Data

We will use your personal data for the following defined purposes:

• To perform the contract we are to enter into or have entered into with you or your company;
• To provide the services you have requested;
• To manage and administer our relationship with you or your company (this includes but is not limited to accounting and finance review, operational analysis, and any other services);
• To fulfil and comply with our legal obligations, including reporting to and/or being inspected by national and international regulatory, law enforcement, and government bodies;
• Upon your instruction or request from your company, advisor, intermediary, or other relevant third party entity;
• If we have been legitimately asked to provide information for legal or regulatory purposes or as part of legal proceedings or prospective legal proceedings;
• To analyze and improve the services we provide to you.

Disclosure of your personal data

We may have to share your personal data with:

• Our professional advisors/service providers where it is necessary for us to obtain their advice or professional assistance such as subject matter experts;
• Our IT Service Providers and Data Storage Providers;
• Any third party to whom we assign or novate any of our rights or obligations;
• Companies providing services for the purposes of legally required compliance checks, as well as companies providing similar services including financial institutions;
• Third parties with whom we engage in delivering services to you;
• Relevant authorities, courts, government bodies, and law enforcement agencies when we are required to do so in accordance with any applicable law, regulation, judicial or official request.

We will obtain your prior specific consent before we share your personal data with any third party for any purpose not directly connected with the provision of our services.

Legal Grounds for Processing Your Personal Data

We will only collect and process your personal data where we have a legal basis under the EU General Data Protection Regulation (GDPR) and the Cyprus Law 125(I)/2018, such as:

• Consent (Art. 6 (1) (a) GDPR, where you have given consent for one or more specific purposes);
• Contract (Art. 6 (1) (b) GDPR, where processing is necessary for the performance of a contract or pre-contractual steps);
• Legal obligation (Art. 6 (1) (c) GDPR);
• Legitimate interest (Art. 6 (1) (f) GDPR).

Where we rely on your consent to process personal data, you have the right to withdraw or decline your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. Where we rely on legitimate interests, we shall specify the legitimate interests pursued and you have the right to object.

Security of your Personal Data

We use a range of physical, technical, and organizational measures to keep your personal data secure and confidential.

International Transfers of your Personal Data

In order to provide our services, we may need to transfer your personal data to jurisdictions outside the European Union. In such cases, we ensure an adequate level of protection, either through an adequacy decision of the European Commission (e.g. Switzerland, or the EU-U.S. Data Privacy Framework for certified U.S. companies) or through European Commission standard contractual clauses.

How long do we keep your personal data?

We will retain your personal data only as long as it is reasonably necessary to do so for the requested services, or where we are legally required to keep it.

This includes satisfying any legal, accounting, compliance, or reporting obligations.

Access and Control Your Personal Data

You have the right to:

• Delete data: Request erasure of all or some of your personal data (e.g., if no longer necessary or upon consent withdrawal).
• Change or correct data: Request updates or corrections if inaccurate. Email us at info@octo.biz with updates.
• Object to, limit, or restrict use of data: Ask us to stop or limit usage if you believe we have no legal right to use it.
• Access and/or transfer your data: Request a copy of your data and the data you provided in machine-readable form.

You also have the right to object at any time to processing based on our legitimate interests (Art. 21 GDPR) and to withdraw consent with effect for the future. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

If you wish to exercise any of these rights, contact us at info@octo.biz. We may request identity verification before fulfilling such requests.

We may charge a reasonable administrative fee for unfounded, repetitive requests or for additional copies of your data.

If you are not satisfied with how we manage your personal data, you have the right to make a complaint to the supervisory authority in Cyprus, the Commissioner for Personal Data Protection, Nicosia: www.dataprotection.gov.cy

Our website: Which data is processed and by whom

This section explains which personal data is processed when you visit octo.biz, which service providers are involved and on which legal basis. Services that set cookies or read information from your device, and are not strictly necessary, are only activated after your consent in our cookie banner (Art. 6 (1) (a) GDPR in conjunction with section 99 of the Cyprus Law 112(I)/2004 on electronic communications). You can change or withdraw your consent at any time by reopening the privacy settings of the cookie banner.

Hosting and server log files

Our website is hosted by Hostinger International Ltd., Larnaca, Cyprus, on servers within the European Union. Hostinger acts as our processor under a data processing agreement (Art. 28 GDPR).

Every time you access the website, the server automatically records technical data: IP address, date and time of the request, the page requested, referrer URL, browser and operating system. This is necessary to deliver the website and to keep it secure. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in a stable and secure website). Log files are deleted after 30 days at the latest, unless they are needed to investigate a security incident.

Content delivery network (KeyCDN)

Images and media files are delivered via the content delivery network KeyCDN of proinity LLC, Switzerland. To deliver the files, your IP address and technical request data are processed by KeyCDN. Switzerland has an adequacy decision of the European Commission. Legal basis: Art. 6 (1) (f) GDPR (fast and reliable delivery of our website).

Fonts

All fonts are hosted on our own server. No connection to Google Fonts or any other font provider is established.

Website security (Wordfence)

To protect the website against attacks, we use the security plugin Wordfence of Defiant Inc., Seattle, USA. Wordfence checks requests to our website, processes IP addresses for this purpose and compares them with lists of known attackers; for this, IP addresses may be transmitted to Defiant Inc. in the USA. Transfers are based on the EU Standard Contractual Clauses. Legal basis: Art. 6 (1) (f) GDPR (protection of our website and our visitors). Wordfence sets a technically necessary cookie only for logged-in administrators.

Contact form and spam protection (Cloudflare Turnstile)

If you contact us via the contact form or by email, we process the data you provide (name, email address, subject, message) to answer your request. Legal basis: Art. 6 (1) (b) GDPR where your request relates to a possible engagement, otherwise Art. 6 (1) (f) GDPR (answering inquiries). We delete inquiries that do not lead to an engagement after 24 months at the latest, unless statutory retention periods apply.

To protect the form against spam and bots, we use Cloudflare Turnstile of Cloudflare, Inc., San Francisco, USA. Turnstile analyzes technical characteristics of your browser and request (e.g. IP address, browser information) to tell humans from bots, without showing a puzzle. Data may be transferred to the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework. Legal basis: Art. 6 (1) (f) GDPR (protection against abuse).

Web analytics (Matomo)

With your consent, we use the open-source analytics software Matomo, which runs on our own server. No data is passed to third parties. Matomo helps us understand how the website is used (pages visited, time on page, device type, approximate region). IP addresses are anonymized (shortened by two bytes) before storage. Matomo may set cookies (e.g. _pk_id, _pk_ses) for up to 13 months. Legal basis: Art. 6 (1) (a) GDPR. Analytics data is deleted after 24 months.

Google Site Kit, Google Analytics and Google Search Console

We use Google Site Kit, a WordPress plugin by Google, to connect our website with Google services. Through Site Kit, Google Analytics 4 may be used for statistical analysis of website usage, only after your consent. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies (e.g. _ga, _ga_*) with a lifetime of up to 2 years and processes usage data and shortened IP addresses; data may be transferred to Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework. Legal basis: Art. 6 (1) (a) GDPR. Data is retained for 14 months. Further information: policies.google.com/privacy.

Google Search Console shows us how our website appears in Google Search. It does not set cookies on our website and does not process data of individual visitors on our website.

WhatsApp chat button

Our website may show a WhatsApp button (plugin “Click to Chat”). The button is a simple link: No data is transferred to WhatsApp when you load our website. Only when you click it, WhatsApp of WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland (Meta group), opens and the data processing of WhatsApp applies. Data may be transferred to the USA; Meta is certified under the EU-U.S. Data Privacy Framework. Please do not send confidential information via WhatsApp; use email or phone instead.

Links to Google Maps and other websites

We link to Google Maps for directions to our office. No map is embedded, so no data is transmitted to Google until you click the link.

Caching, SEO and backups

We use WP Rocket to cache pages, Rank Math for search engine optimization and Redirection to forward outdated URLs. These tools work on our own server. Redirection may log the IP address of requests to outdated or missing pages to detect broken links; such logs are deleted after 30 days. Backups of the website are created with UpdraftPlus and stored with our hosting provider Hostinger on servers within the EU. Legal basis: Art. 6 (1) (f) GDPR.

Cookies

Cookies are small text files stored on your device by websites you visit. We use technically necessary cookies (e.g. to store your cookie choices) on the basis of Art. 6 (1) (f) GDPR. All other cookies, in particular for analytics, are only set with your consent (Art. 6 (1) (a) GDPR).

You can change or withdraw your consent at any time in the privacy settings of the cookie banner, and you can delete cookies in your browser settings.

Cookie Management

To manage cookies and similar technologies (tracking pixels, web beacons, etc.) and the related consents, we use the consent tool Real Cookie Banner of devowl.io GmbH, Germany. The tool runs on our own server. It stores your consent decision together with a pseudonymized identifier, the date and the banner version, to be able to prove your consent (Art. 7 (1) GDPR). Consent records are kept for the duration required by law, generally up to 3 years. Details: devowl.io/rcb/data-processing.

The legal basis for the processing of personal data in this context is Art. 6 (1) (c) GDPR and Art. 6 (1) (f) GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.

The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. If you do not provide the personal data, we will not be able to manage your consents.

Changes to our Privacy Policy

We reserve the right to update this Privacy Policy when required by law or when deemed necessary.

Updates will be posted to our website and take immediate effect once made available.

Get in touch

Please contact us with any questions, comments, or clarifications at: info@octo.biz

Version: 24 October 2026