Privacy Policy

1. Introduction & Who We Are

Nexora Cyprus is operated by Ebrovia Ltd ("we", "us", or "our"), the controller for the personal data described in this policy. Our address is Lesvou 11b, 8021, Paphos, Cyprus.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website at nexoracyprus.com, contact us, or engage our services. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and the Processing of Personal Data (Protection of Individuals) Law of 2018, as amended (Cyprus Law 125(I)/2018).

If you have any questions about this policy or our data practices, please contact us at privacy@nexoracyprus.com.

2. What Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Identity data: Full name, date of birth, nationality, passport or national identity card details.
• Contact data: Email address, telephone number, country of residence, and postal address.
• Business data: Company name, industry, proposed business activities, existing corporate structure, and source of funds information.
• Correspondence data: The content of emails, messages, and enquiry form submissions you send to us.
• Technical data: IP address, browser type, operating system, pages visited, and time of access when you visit our website.
• KYC / due diligence data: Identity documents, proof of address, source of funds declarations, and other documents required for anti-money laundering compliance.

We do not knowingly collect personal data from individuals under the age of 18.

3. How We Use Your Data

We use your personal data for the following purposes:

• Responding to enquiries: To process and respond to your questions, quote requests, and consultation requests submitted via our website or by email.
• Service delivery: To incorporate your Cyprus company, maintain your corporate records, provide nominee services, file compliance documents, and deliver all contracted services.
• KYC / AML compliance: To verify your identity and source of funds as required by Cyprus AML legislation (Law 188(I)/2007 and related instruments) where applicable to the services requested.
• Client relationship management: To manage our ongoing client relationship, including billing, account management, and service improvements.
• Legal and regulatory compliance: To comply with applicable laws, court orders, regulatory requirements, and requests from competent authorities.
• Marketing communications: To send you relevant regulatory updates, tax alerts, and information about our services, where you have consented to receive them. You may opt out at any time.

4. Legal Basis for Processing

Under GDPR Article 6, we process your personal data on the following legal bases:

• Contractual necessity (Art. 6(1)(b)): Where processing is necessary to perform a contract with you or to take steps at your request prior to entering into a contract (e.g., responding to enquiries, delivering services).
• Legal obligation (Art. 6(1)(c)): Where we are required to process data to comply with AML obligations, regulatory requirements, or other legal duties to which we are subject.
• Legitimate interests (Art. 6(1)(f)): Where processing is necessary for our legitimate business interests — such as improving our services, managing our business, and communicating relevant updates — provided these interests are not overridden by your rights.
• Consent (Art. 6(1)(a)): Where you have given clear consent for us to process your data for a specific purpose, such as subscribing to our newsletter. You may withdraw consent at any time.

5. Data Retention

Retention depends on the purpose and category of the record. Relevant criteria include whether an enquiry or engagement remains active, outstanding contractual obligations, applicable accounting or regulatory retention requirements, and the need to establish, exercise or defend legal claims.

For information about the retention period and basis applicable to your records, or to request erasure, contact privacy@nexoracyprus.com. A legal retention obligation may limit an erasure request.

6. Data Sharing

We do not sell, rent, or trade your personal data. We may share your data with:

• Service providers: Third-party providers who assist us in delivering our services (e.g., licensed auditors, legal counsel, registered agents, cloud storage providers). Their role depends on the service: some act as processors, while professional advisers or authorities may act as independent controllers.
• Regulatory and governmental authorities: The Cyprus Registrar of Companies, Cyprus Tax Department, competent AML supervisory authorities, and other authorities as required by law or court order.
• Professional advisers: Our legal advisers, accountants, and insurers, where necessary for the conduct of our business and subject to professional confidentiality obligations.

We will not share your personal data with third parties for their own marketing purposes.

7. Your Rights Under GDPR

Subject to applicable exemptions, you have the following rights in relation to your personal data:

• Right of access: To obtain a copy of the personal data we hold about you.
• Right to rectification: To have inaccurate or incomplete personal data corrected.
• Right to erasure: To request deletion of your personal data where there is no legitimate reason for us to continue processing it.
• Right to restriction: To request that we restrict processing of your data in certain circumstances.
• Right to data portability: To receive your personal data in a structured, machine-readable format and to transmit it to another controller.
• Right to object: To object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making: We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

To exercise any of these rights, please contact us at privacy@nexoracyprus.com. We respond without undue delay and ordinarily within one month. If a lawful extension is needed because of complexity or the number of requests, we will explain it within that month. We may need to verify your identity.

8. Cookies

Our website uses cookies to ensure essential functionality and to improve your experience. For detailed information about the cookies we use, how they work, and how to manage your cookie preferences, please see our Cookie Policy.

9. International & Cross-Border Data Transfers

Our hosting, email and analytics providers may process personal data outside Cyprus, including outside the European Economic Area (EEA). Their locations depend on the service and its configuration; this policy does not promise EU-only storage.

Transfers outside the EEA require a valid GDPR transfer mechanism, such as an applicable adequacy decision or appropriate safeguards including Standard Contractual Clauses. Contact privacy@nexoracyprus.com for details of the destinations and safeguards applicable to your information and how to obtain a copy.

10. Form Submissions and Consent

Enquiry forms ask you to agree to be contacted about the enquiry. Submitted details are passed to our team through our email service; the contact notification includes the consent choice and submission time. Cookie preferences are stored in your browser. A newsletter request is separate from an enquiry and is not treated as a confirmed mailing-list subscription unless a mailing-list service accepts it.

You can withdraw consent at any time by emailing privacy@nexoracyprus.com — withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

11. Website Service Providers

The website uses the following services. The information involved depends on whether you browse, submit an enquiry or consent to optional analytics. A link to an external social or booking service is separate from submitting a form on this website.

Contact us for information about the providers and processing arrangements relevant to your enquiry or engagement. Optional services used during an engagement may involve additional providers.

12. Privacy Contact

Please direct privacy questions and requests to the contact below so they can be routed to the person responsible for the relevant processing.

You can contact us at privacy@nexoracyprus.com.

13. Incident Response

In the event of a personal-data breach (as defined by Article 4(12) GDPR) that is likely to result in a risk to the rights and freedoms of natural persons, Nexora Cyprus will notify the Cyprus Office of the Commissioner for Personal Data Protection within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk to the rights and freedoms of natural persons, we will also notify affected data subjects without undue delay, with clear, plain-language information on the nature of the breach and the steps taken to mitigate it (Article 34 GDPR).

Article 33(5) GDPR requires the controller to document personal-data breaches, their effects and the remedial action taken, so that the supervisory authority can verify compliance.

14. Contact Us for Privacy Matters

If you have any questions, concerns, or requests regarding this Privacy Policy or our processing of your personal data, please contact us:

15. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority. In Cyprus, this is the:

We would, however, appreciate the opportunity to address your concerns directly before you approach the supervisory authority. Please contact us in the first instance at privacy@nexoracyprus.com.