Privacy Policy

Last updated: 13/05/2026

This Privacy Policy describes how PBA Consulting LTD collects, uses, and protects the personal data of users of the website: www.pbaconsulting.agency, in accordance with Regulation (EU) 2016/679 (GDPR) and Cyprus Law No. 125(I)/2018 on the protection of natural persons with regard to the processing of personal data.

1. Data Controller

The Data Controller is:
Company name: PBA Consulting LTD
Registered office: Strovolou 77,Strovolos Center, Flat/Office 301, 2018 Strovolos, Nicosia, Cyprus

Registration number: HE473945
VAT number: CY60168460H
Email: pba@pbaconsulting.agency

2. What Personal Data We Collect

We collect only the personal datastrictly necessary for the purposes described below.

‍2.1 Data Provided Through the Contact Form
‍When you contact us through the contact form available on the website, we may request:
- First and last name
- Email address
- [Phone number — if requested by the form]
- [Subject and content of the message]

‍2.2 Data Provided Through Newsletter Subscription
‍When you subscribe to our newsletter, we collect:
- Email address
- [Name — if requested]
- Date and time of subscription and consent provided

‍2.3 Automatically Collected Data
‍For technical and security purposes, our servers automatically record certain browsing data (IP address, browser type, operatingsystem, visited pages, date/time of the visit). These data are processed inaggregated form and are not used to identify individual users.

3. Purposes of Processing and Legal Basis

Purpose

Responding to requests sent through the contact form
Sending newsletterscontaining news, updates, and promotional communications
Ensuring the security, stability, and proper  functioning of the website
Compliance with legal obligations (tax,  accounting, etc.)

Legal basis (Art. 6GDPR)

Performance of pre-contractual measures at the request of the data subject (Art. 6(1)(b)) and/or the legitimate interest of the Data Controller in managing correspondence (Art. 6(1)(f))
Explicit consent of thedata subject (Art. 6(1)(a))
Legitimate interest of the Data Controller (Art. 6(1)(f))
Legal obligation (Art. 6(1)(c))
4. Methods of Processing

Personal data are processed using electronic and paper-based tools, adopting appropriate technical and organizational measures to ensure their security, integrity, and confidentiality, in accordance with Article 32 GDPR. Access to the data is restricted to authorized personnel and service providers appointed as Data Processors pursuant to Article 28 GDPR.

5. Data Retention Period

Type of data

Contact form data
Newsletter data
System logs
Data related to legalobligations

Retention period

For the time necessary to handle the request and subsequently for [12–24] months for archiving purposes, unless longer retention is required by law
Until consent is withdrawn (unsubscribe from the mailing list)
Maximum [6–12] months
For the period required by applicable law  (e.g., 6 years for tax records)
6. Recipients and Data Transfers

Personal data may be disclosed to:
- Authorized personnel of the Data Controller who have received appropriate training
- Technical service providers appointed as Data Processors pursuant to Article 28 GDPR, including in particular:
*Hosting provider: Hostinger International Ltd. (Lithuania, EU) — provider of the website hosting services
*Newsletter service provider: Brevo (Sendinblue SAS, France, EU) — management of newsletter subscriptions and distribution
- Public authorities, upon justified request and in compliance with legal obligations

Data Transfers
‍All service providers used are based and operate infrastructure within the European Union / European Economic Area. Therefore, no transfers of personal data to third countries are currently envisaged. Should this change in the future, any transfer will take place only where thesafeguards provided under Articles 44–49 GDPR are in place (adequacy decisions, Standard Contractual Clauses, etc.).

7. Your Rights

As a data subject, you have the rightsprovided for under Articles 15–22 GDPR, including:
- Access to your personal data
- Rectification of inaccurate or incomplete data
- Erasure (“right to be forgotten”)
- Restriction of processing
- Data portability in a structuredand readable format
- Objection to processing based on legitimate interest
- Withdrawal of consent at any time, without affecting the lawfulness of processing based on consent before its withrawal
- The right not to be subject to decisions based solely on automated processing

To exercise these rights, you may contact us at pba@pbaconsulting.agency. We will respond within 30 days of receiving the request.

8. Right to Lodge a Complaint with the Supervisory Authority

If you believe that the processing of your personal data violates applicable legislation, you have the right to lodge a complaint with the Cypriot supervisory authority:
Commissioner for Personal Data Protection
Address: 15 Kypranoros Street, 1061
Nicosia, Cyprus
‍
Tel: +357 22 818 456
Email:commissioner@dataprotection.gov.cy
Website: www.dataprotection.gov.cy

9. Minors

The website is not intended for children under the age of 13. Under Cyprus Law 125(I)/2018, the minimum age for consenting to the processing of personal data in relation to information society services is 13 years. For children below this age, consent from the holder of parental responsibility is required.

10. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy at any time. Any changes will be published on this page together with the updated revision date. You are encouraged to review this page regularly.

11. Contact Details

For any questions regarding this Privacy Policy or the processing of your personal data:

Email: pba@pbaconsulting.agency
Postal address: PBA Consulting LTD, Strovolou 77, Strovolos Center, Flat/Office 301, 2018 Strovolos, Nicosia, Cyprus