1 · Who we are
G.Z. Icarus 222 Ltd, a company registered in the Republic of Cyprus under number HE 415772, with offices at 56 Vasileos Pavlou, Agios Dometios, 2363 Nicosia, Cyprus, is the controller of the personal data described here. Questions about this policy and requests about your data: [email protected] · +357 99 643209. We have not appointed a Data Protection Officer; Article 37 of the GDPR does not require one for a business of our size and activity. The director answers every request personally.
2 · What we collect
When you contact us. Through the form on this site: your name, email address, telephone number and industry. Through email or telephone: whatever you choose to tell us, and our replies.
When we prepare a site study. Floor plans, ceiling heights, room use, hours of occupancy, photographs of ceilings and, for cleanrooms, the grade and gowning route. These describe rooms, not people, but they may incidentally contain personal data — a name on a drawing, a person in a photograph. Please send only what the study needs.
When you become a client or supplier. The business contact details of the people we deal with — name, role, employer, work email and telephone — together with quotations, orders, contracts, invoices and payment records. At commissioning, the signed training record required by ISO 15858 (clause 4.4) names the members of your staff who were trained on the equipment.
When you visit the site. Our host, Cloudflare, processes the technical data needed to deliver and protect the pages — IP address, browser type, pages requested, time of visit. The site itself sets no cookies; the Cookies page explains the two narrow exceptions. We do not use visitor analytics, advertising or cross-site tracking.
What we do not collect. No special categories of data (health, biometrics and the like), no data from social networks, no location tracking. This site has no user accounts.
3 · Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|
| Answering your enquiry, preparing a site study and a quotation | Art. 6(1)(b) — steps prior to a contract, taken at your request | 24 months after our last exchange, if no contract follows |
| Delivering, installing and commissioning equipment; warranty; training records; after-sales support | Art. 6(1)(b) — performance of the contract | The life of the installation, and at least six years after the last invoice |
| Invoicing, accounting, tax and company records | Art. 6(1)(c) — legal obligation under Cyprus tax and company law | At least six years from the end of the tax year concerned (Assessment and Collection of Taxes Law, Law 4/1978, as amended) |
| Recording meetings with public officials | Art. 6(1)(c) — Transparency in Public Decision-Making Law of 2022, Law 20(I)/2022 | As the law and the Independent Authority against Corruption require |
| Running the website securely and preventing abuse | Art. 6(1)(f) — our legitimate interest in a working, secure site | Short-term security logs kept by our host |
| Playing the TED talk embedded on the Invention page | Art. 6(1)(a) — your consent, given by pressing play | See the Cookies page |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) — legitimate interest | Until the claim is time-barred |
We do not send marketing emails or newsletters. We do not make automated decisions about you, and we do not profile you.
4 · Who receives it
- Cloudflare, Inc., 101 Townsend Street, San Francisco, United States — hosts and protects this website and delivers the messages sent through its contact form to our email, under Cloudflare's Data Processing Addendum.
- Google (Google Ireland Ltd for the EEA) — provides the email service through which we correspond with you.
- UV Medico A/S, Åbyhøj, Denmark — the manufacturer, which receives the delivery address, site contact and installation configuration needed to supply the equipment, register the warranty and support it.
- Our installation partners in Greece and Cyprus — the colleague and the UV Medico-trained electricians who carry out site visits and installations, bound by confidentiality and by this policy.
- Our accountants and auditors, for the records the law requires, and public authorities where the law obliges us: the Tax Department, the Independent Authority against Corruption, a court.
We do not sell personal data, and we do not share it with anyone for their own marketing.
5 · Transfers outside the European Economic Area
Cloudflare, Inc. is established in the United States and is certified under the EU–US Data Privacy Framework; its Data Processing Addendum also incorporates the European Commission's Standard Contractual Clauses. Google's EEA services are provided by Google Ireland Ltd; where data reaches the United States, Google LLC's certification under the EU–US Data Privacy Framework applies. Copies of the relevant clauses are available from us on request.
6 · How long we keep it
For the periods in the table above. When a period ends, the data is deleted or anonymised. Where the same document serves two purposes — an invoice is also a contract record — the longer period applies.
7 · Your rights
Under Articles 15 to 22 of the GDPR you may ask us to: confirm whether we hold data about you and give you a copy; correct it; delete it; restrict its use; give it to you or to another provider in a portable format; and object to processing based on our legitimate interests. Where processing rests on your consent, you may withdraw it at any time; the withdrawal does not affect what was done before. Write to [email protected]. We reply within one month, extendable by two months for complex requests, and we may ask you to confirm your identity first. The service is free unless a request is manifestly unfounded or excessive.
8 · Security
The site is served over HTTPS. Messages sent through the contact form arrive by email and, like the rest of our correspondence, are held in the company's Google account, protected by a strong password and two-factor authentication, and accessible only to the director and, for Greek installations, the colleague responsible there. The website itself stores nothing you send. Paper records are kept at the company's office. Site-study material is deleted from working devices once the study is delivered and archived.
9 · Cookies
What cookies this site sets, why, for how long, and how to change your choice are set out on the Cookies page, which forms part of this policy.
10 · Children
This site and our services are addressed to businesses and institutions. We do not knowingly collect data from anyone under 18; if you believe we have, tell us and we will delete it.
11 · Changes
We will update this policy when our processing changes. The date and version at the top tell you which text applies; substantive changes will be announced on the site before they take effect.
12 · Complaints and supervisory authority
If you think we have handled your data wrongly, tell us first — we would rather fix it than argue about it. You also have the right to lodge a complaint with the supervisory authority: Commissioner for Personal Data Protection, 15 Kypranoros Street, 1061 Nicosia · P.O. Box 23378, 1682 Nicosia · +357 22 818 456 · [email protected] · www.dataprotection.gov.cy. If you live in Greece you may instead contact the Hellenic Data Protection Authority, Kifissias 1-3, 115 23 Athens · +30 210 6475600 · [email protected].
Legal references: Regulation (EU) 2016/679 (GDPR) · Law 125(I)/2018 on the Protection of Natural Persons with regard to the Processing of Personal Data (Cyprus) · Law 112(I)/2004 on Electronic Communications and Postal Services, s. 99(5) (Cyprus) · Law 20(I)/2022 on Transparency in Public Decision-Making (Cyprus) · Commission Implementing Decision (EU) 2023/1795 (EU–US Data Privacy Framework).