Last updated 18 September 2026
This policy explains how CypInfo handles personal data. It is governed by the General Data Protection Regulation (EU) 2016/679 and Cypriot data protection law. It is written to be read, rather than to hide behind legal language.
1. Who we are
The data controller for the processing described here is CypInfo, which operates the website cypinfo.com. For anything concerning personal data, contact [email protected].
2. What we collect
| When | What we collect | Why |
|---|---|---|
| Owner account | Full name, email address, hashed password | So you can sign in and manage your listing |
| Message to a business | Name, email, phone (optional), your message | To pass it to the business you chose |
| Review | Name, email, rating, comment | To publish the review and to check it is genuine |
| Payment | Subscription details and transaction history | To manage your plan and to keep accounting records |
| Visiting the site | Per-listing view counts, technical browsing data | So owners can see their exposure, and for security |
| Searching | The search term and how many results it returned — no IP address, no account, no session identifier | To see what the directory is missing and add it |
Your card details never reach our servers. Payments happen entirely inside Stripe's environment; we receive only the outcome of the transaction and the last digits for identification.
3. Business listing information
The directory holds business contact information — trading name, address, phone, email, website. Most of it comes from sources the businesses themselves made public, and we process it on the basis of our legitimate interest in operating a public business directory.
Where such information also identifies an individual — a sole trader whose business number is their personal one, for example — you have the same rights set out below, and you can ask for correction or removal at any time. We will act on that without asking you to pay or to create an account.
4. Legal bases for processing
- Performance of a contract — for owner accounts, plans and payments.
- Legitimate interests — to operate and secure the directory, keep it accurate, and produce aggregate view statistics.
- Consent — for optional analytics cookies and for marketing email where required; you can withdraw it at any time.
- Legal obligation — for tax and accounting records of transactions.
5. Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
| Session cookie | Keeps you signed in and protects forms. Strictly necessary. | Until you close your browser |
| cyp_consent | Remembers your cookie choice so we do not ask again. Strictly necessary. | 12 months |
| cyp_ref | Remembers the referral code you arrived through. | 30 days |
| cyp_claim_dismissed_* | Remembers that you dismissed a listing's claim prompt. | 14 days |
| Google Analytics | Aggregate traffic statistics. Set only if you accept them — if you choose "Necessary only", it is never loaded at all. | Up to 2 years |
| Cloudflare | Security and filtering of malicious traffic. | Up to 30 days |
Analytics cookies are not activated before you consent. You can change your choice at any time from the "Cookie settings" link at the bottom of every page.
You can also delete or block cookies in your browser settings. If you block the strictly necessary ones, signing in and submitting forms will not work correctly.
6. Who we share data with
We do not sell personal data. We share it only with providers who are necessary to run the service:
- Stripe — payment and subscription processing.
- Brevo — sending system and notification email.
- Cloudflare — content delivery and protection against attacks.
- Google — traffic analytics and web fonts.
- OpenAI — drafting listing descriptions from publicly available business information.
When you send a message to a business through the site, your message and contact details are passed to that business — that is the purpose of the form. How the business then handles your details is its own responsibility.
Some of the providers above may process data outside the European Economic Area. Where that happens, the transfer relies on the European Commission's standard contractual clauses or on an equivalent adequacy decision.
7. How long we keep it
- Owner accounts — for as long as the account is active. When it is deleted, personal details are removed and listings are detached from you.
- Messages to businesses — up to 24 months, so a dispute or abuse report can still be investigated.
- Reviews — for as long as the listing is published, unless you ask us to delete them.
- Transaction records — for as long as tax law requires.
- View statistics — held in aggregate per day and per listing, and do not identify visitors.
8. Your rights
Under the GDPR you have the right to:
- access the data we hold about you;
- have inaccurate details corrected;
- have your data erased;
- restrict or object to processing;
- receive your data in a portable, structured format;
- withdraw your consent at any time.
Send your request to [email protected] and we will respond within one month. If you believe we have mishandled your data, you have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus.
9. Security
The site is served exclusively over encrypted HTTPS connections. Passwords are stored only as irreversible cryptographic hashes — we do not know them and cannot remind you of them, only let you set a new one. Access to data is limited to those who need it to operate the service.
10. Changes to this policy
When we make a material change to this policy we update the date at the top of the page. For significant changes that affect your rights, we will notify registered owners by email.
