Privacy Policy
This Privacy Policy explains how Montes Auri Ltd (Company Registration Number:HE 428773), with its registered office at Agias Zonis 63, 1st Floor, Limassol, Cyprus(referred to as “we”, “us”, “our” or the “Company”), collects, uses, discloses, stores and protects personal data when individuals access or use our website, platform or services.
We are committed to processing personal data lawfully, fairly and transparently, in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation or “GDPR”) and other applicable data protection laws.
1. Who We Are – Data Controller
The data controller responsible for processing your personal data is:
Montes Auri Ltd
Registered Office: Agias Zonis 63, 1st Floor, Limassol, Cyprus
Company Registration Number: HE 428773
Email: info@montesauri.com
Telephone: +357 22 222 046
For questions about this Privacy Policy or how we process personal data, you may
contact us using the details above.
2. Purpose of This Policy
This Privacy Policy explains how the Company collects, uses, stores, discloses and
protects personal data, and describes the rights available to individuals in relation to
their personal data.
The Company processes personal data in accordance with applicable data protection legislation, including:
● General Data Protection Regulation (GDPR): Regulation (EU) 2016/679.
● Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT)
legislation: applicable EU and Cyprus legislation, including relevant requirements concerning customer due diligence, transaction monitoring and
record-keeping.
● Markets in Crypto-Assets Regulation (MiCA): Regulation (EU) 2023/1114, to the extent applicable to the Company's activities and regulatory status.
● Applicable regulatory requirements and guidance: including relevant requirements issued by the Cyprus Securities and Exchange Commission
(CySEC), where applicable.
This Policy is intended to provide transparent information about the Company's personal data processing activities, the purposes and legal bases for processing, the categories of recipients, applicable retention periods and the rights of individuals under data protection law.
3. Categories of Personal Data
3.1 Identification Data
● Full name, date of birth and nationality.
● Information contained in government-issued identity documents, such as passports, identity cards and driving licences, where accepted for verification purposes.
3.2 Contact Data
● Email address and telephone number.
● Residential address and, where relevant, business contact details.
3.3 Financial & Transaction Data
● Wallet addresses and relevant blockchain transaction identifiers.
● Transaction history, amounts, timestamps and related transaction information.
● Payment methods and relevant banking or payment account details.
3.4 KYC / AML Data
● Information and supporting documents relating to source of funds and, where required, source of wealth.
● Purpose and intended nature of the business relationship or transactions.
● Occupation, business activities and expected transaction activity.
● Politically exposed person (PEP), sanctions and adverse media screening results, where applicable.
● Customer risk assessments, risk scores and related profiling information used for compliance and risk management purposes.
3.5 Technical & Usage Data
● IP address and relevant device and browser information.
● Login activity, access records and system logs.
● Technical information generated through the use of the website or platform, where collected.
3.6 Blockchain Data
Transactions conducted through public blockchain networks may involve information, including wallet addresses and transaction details, that is publicly
accessible and recorded on an immutable or practically irreversible ledger. Such information may constitute or become personal data where it relates to an identified or identifiable individual, including when combined with other available information.
4. How We Collect Data
The Company may collect personal data through the following sources and methods, depending on the services used and the applicable legal and regulatory requirements:
● Directly from you: when you register, complete onboarding and verification procedures, provide supporting documents, communicate with us or initiate transactions.
● From third-party service providers: including identity verification and screening providers, payment service providers and fraud-prevention or
blockchain analytics providers, where relevant to the services provided and our compliance obligations.
● From public and official sources: including publicly available blockchain records, applicable sanctions lists, company registers and other reliable
public sources used for verification, screening and risk assessment.
● Automatically through our website or platform: including technical information, access records, cookies and analytics technologies, where these
are used and subject to applicable requirements.
Where personal data is obtained from sources other than the individual concerned, the Company will provide the information required by applicable data protection law, unless a relevant legal exception applies.
5. Legal Basis for Processing
The Company processes personal data only where an applicable legal basis under the GDPR or other relevant data protection legislation is available. The legal basis depends on the specific purpose and circumstances of the processing.
The data controller responsible for processing your personal data is:
Montes Auri Ltd
Registered Office: Agias Zonis 63, 1st Floor, Limassol, Cyprus
Company Registration Number: HE 428773
Email: info@montesauri.com
Telephone: +357 22 222 046
For questions about this Privacy Policy or how we process personal data, you may
contact us using the details above.
2. Purpose of This Policy
This Privacy Policy explains how the Company collects, uses, stores, discloses and
protects personal data, and describes the rights available to individuals in relation to
their personal data.
The Company processes personal data in accordance with applicable data protection legislation, including:
● General Data Protection Regulation (GDPR): Regulation (EU) 2016/679.
● Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT)
legislation: applicable EU and Cyprus legislation, including relevant requirements concerning customer due diligence, transaction monitoring and
record-keeping.
● Markets in Crypto-Assets Regulation (MiCA): Regulation (EU) 2023/1114, to the extent applicable to the Company's activities and regulatory status.
● Applicable regulatory requirements and guidance: including relevant requirements issued by the Cyprus Securities and Exchange Commission
(CySEC), where applicable.
This Policy is intended to provide transparent information about the Company's personal data processing activities, the purposes and legal bases for processing, the categories of recipients, applicable retention periods and the rights of individuals under data protection law.
3. Categories of Personal Data
3.1 Identification Data
● Full name, date of birth and nationality.
● Information contained in government-issued identity documents, such as passports, identity cards and driving licences, where accepted for verification purposes.
3.2 Contact Data
● Email address and telephone number.
● Residential address and, where relevant, business contact details.
3.3 Financial & Transaction Data
● Wallet addresses and relevant blockchain transaction identifiers.
● Transaction history, amounts, timestamps and related transaction information.
● Payment methods and relevant banking or payment account details.
3.4 KYC / AML Data
● Information and supporting documents relating to source of funds and, where required, source of wealth.
● Purpose and intended nature of the business relationship or transactions.
● Occupation, business activities and expected transaction activity.
● Politically exposed person (PEP), sanctions and adverse media screening results, where applicable.
● Customer risk assessments, risk scores and related profiling information used for compliance and risk management purposes.
3.5 Technical & Usage Data
● IP address and relevant device and browser information.
● Login activity, access records and system logs.
● Technical information generated through the use of the website or platform, where collected.
3.6 Blockchain Data
Transactions conducted through public blockchain networks may involve information, including wallet addresses and transaction details, that is publicly
accessible and recorded on an immutable or practically irreversible ledger. Such information may constitute or become personal data where it relates to an identified or identifiable individual, including when combined with other available information.
4. How We Collect Data
The Company may collect personal data through the following sources and methods, depending on the services used and the applicable legal and regulatory requirements:
● Directly from you: when you register, complete onboarding and verification procedures, provide supporting documents, communicate with us or initiate transactions.
● From third-party service providers: including identity verification and screening providers, payment service providers and fraud-prevention or
blockchain analytics providers, where relevant to the services provided and our compliance obligations.
● From public and official sources: including publicly available blockchain records, applicable sanctions lists, company registers and other reliable
public sources used for verification, screening and risk assessment.
● Automatically through our website or platform: including technical information, access records, cookies and analytics technologies, where these
are used and subject to applicable requirements.
Where personal data is obtained from sources other than the individual concerned, the Company will provide the information required by applicable data protection law, unless a relevant legal exception applies.
5. Legal Basis for Processing
The Company processes personal data only where an applicable legal basis under the GDPR or other relevant data protection legislation is available. The legal basis depends on the specific purpose and circumstances of the processing.
Purpose
Legal Basis
Account creation and provision of requested services
Performance of a contract or steps taken at the individual's request before entering into a contract, where applicable.
Customer identification, KYC and AML/CFT checks
Compliance with a legalobligation, where theprocessing is required byapplicable law.
Fraud prevention, platform security and protection against misuse
Legitimate interests, whereapplicable, subject toassessing the individual'srights and freedoms and anyother legal requirements
Customer risk assessment, sanctions screening and transaction monitoring
Compliance with a legalobligation where required byapplicable law; otherwise, legitimate interests may applywhere appropriate and lawful.
Marketing communications
Consent where required byapplicable law. Where anotherlawful basis is relied upon, theCompany will comply withapplicable direct marketing andelectronic communicationsrequirements.
Website analytics and cookies
Consent where required by applicable law; otherwise, legitimate interests may apply only where legally permitted. Non-essential cookies or similar technologies will be used subject to applicable consent requirements.
Where processing is based on consent, individuals may withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Where the Company relies on legitimate interests, those interests will be assessed against the rights and freedoms of the individuals concerned. Where processing is required by law, the Company may be unable to provide or continue providing certain services if the necessary personal data is not supplied.
The Company will identify and document the applicable legal basis for its actual processing activities and provide further information where required by law.
6. How We Use Personal Data
The Company may process personal data for the following purposes, depending on the services provided, the individual's relationship with the Company and applicable legal and regulatory requirements:
● Service provision: to establish and administer customer relationships and provide the services requested, where applicable.
● Identity and business verification: to verify the identity of individual customers and, where relevant, corporate customers and their beneficial owners, throughKYC/KYB procedures and supporting documentation.
● AML/CFT compliance: to conduct customer due diligence, screening, risk-based monitoring and, where legally required, reporting to the competent
authorities.
● Risk assessment and fraud prevention: to assess customer and transaction risks, detect potentially suspicious or fraudulent activity, and protect the
Company, its customers and its systems from misuse.
● Legal and regulatory compliance: to meet applicable record-keeping, reporting, information-request and other legal or regulatory obligations.
● Service development and security: to maintain, secure and improve the website, platform and related services, where such processing is carried out
and permitted by law.
● Communications and support: to respond to enquiries, provide service-related information, manage requests and communicate with customers and other relevant individuals.
Personal data will be processed only for specified and legitimate purposes and will not be used in a manner incompatible with those purposes, unless permitted by applicable law. The Company will apply appropriate safeguards and retain personal data only for as long as necessary for the relevant purpose or as required by law.
7. Automated Decision-Making & Profiling
The Company may use automated tools and processes to support compliance, security and risk management activities, including:
● Customer risk scoring and profiling.
● Fraud detection and prevention.
● Transaction monitoring and the identification of potentially suspicious activity.
These tools may analyse personal data and generate risk indicators, alerts or recommendations. Their results may be used to support further checks, compliance reviews or decisions concerning access to, or the continued provision of, services.
Where automated processing is used, the Company will assess whether it constitutes solely automated decision-making that produces legal effects or
similarly significantly affects an individual within the meaning of Article 22 GDPR. Where Article 22 applies, the Company will provide the safeguards required by law, including information about the processing and access to applicable rights, such as requesting human intervention, expressing a point of view and contesting the decision, where legally available.
Individuals may contact the Company at info@montesauri.com with questions or requests concerning the use of their personal data in these processes.
8. Sharing of Personal Data
The Company may disclose personal data to the following categories of recipients, where necessary for the purposes described in this Privacy Policy and subject to applicable data protection law:
● Competent authorities and regulators: including CySEC, the Cyprus Financial Intelligence Unit (MOKAS) and other competent authorities, where disclosure is required or otherwise permitted by law.
● Identity verification and AML/CFT service providers: providers supporting identity verification, customer screening, blockchain analytics and related
compliance activities, where applicable.
● Payment service providers and financial institutions: where necessary to process payments or support relevant financial transactions.
● Cloud, technology and IT service providers: providers supporting the Company's website, platform, systems, hosting, security and related technical
operations.
● Professional advisers: including legal advisers, auditors and compliance consultants, where their involvement is necessary and appropriate.
Personal data may also be disclosed where necessary and lawful to:
● Comply with legal or regulatory obligations, or respond to lawful requests from competent authorities.
● Prevent, detect or investigate suspected fraud, financial crime, security incidents or other unlawful activity.
● Support a merger, restructuring, acquisition or transfer of business, subject to applicable confidentiality and data protection requirements.
The Company will limit disclosures to personal data that is relevant and necessary for the applicable purpose. Where required, appropriate contractual, organisational and technical safeguards will be applied, including safeguards governing processing by service providers and any international transfers of personal data.
9. International Data Transfers
The Company may transfer personal data to countries outside the European Economic Area (EEA) where this is necessary for the purposes described in this Privacy Policy, including where relevant service providers or technology infrastructure are located outside the EEA.
Where personal data is transferred to a country outside the EEA, the Company will ensure that the transfer complies with applicable data protection law. Depending on the circumstances, the safeguards may include:
● Adequacy decisions: transfers to countries recognised by the European Commission as providing an adequate level of data protection.
● Standard Contractual Clauses (SCCs): contractual safeguards approved by the European Commission, where applicable.
● Additional safeguards: supplementary technical, organisational or contractual measures where required following an assessment of the transfer.
Information about the applicable transfer mechanism may be requested from the Company using the contact details provided in this Privacy Policy, subject to applicable legal restrictions.
10. Data Retention
The Company retains personal data only for as long as necessary to fulfil the purposes for which it was collected, taking into account applicable legal and regulatory requirements, the nature of the data and the need to establish, exercise or defend legal claims.
In particular:
● AML/CFT records: Personal data contained in customer due diligence records, transaction records and other relevant AML/CFT documentation will
generally be retained for at least five years after the end of the business relationship or the date of an occasional transaction, as applicable under
Cyprus AML/CFT legislation.
● Extended retention: Where permitted or required by applicable law or a competent authority, the retention period may be extended, including for up to an additional five years where the relevant legal conditions are satisfied.
● Other personal data: Information processed for contractual, technical, security, communication or other purposes will be retained for the period
necessary for the relevant purpose, unless a different retention period is required or permitted by law.
When the applicable retention period expires, personal data will be securely deleted or anonymised, unless continued retention is legally required or justified under an applicable legal basis.
Personal data subject to mandatory legal retention requirements may not be deleted solely because an individual requests erasure. Such requests will be assessed in accordance with applicable data protection law, and any lawful exceptions to the right to erasure will be applied as appropriate.
11. Data Security
The Company applies appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the nature of the data, the risks associated with its processing and applicable legal requirements.
Depending on the systems and services used, these measures may include:
● Encryption: encryption of personal data in transit and at rest, where supported and implemented.
● Access controls: restrictions on access to personal data based on authorised roles and business needs, together with appropriate authentication
mechanisms.
● Monitoring and incident detection: security logging, monitoring and measures to detect and respond to suspected unauthorised access or other security incidents, where implemented.
● Secure infrastructure and storage: safeguards designed to protect the systems, networks and storage environments used to process personal data.
● Organisational safeguards: internal procedures, confidentiality requirements and appropriate staff awareness measures to support the secure handling of personal data.
The Company periodically reviews the adequacy of its security measures and seeks to address identified weaknesses in accordance with its risk management processes and applicable legal obligations.
No method of electronic transmission or storage can be guaranteed to be completely secure. However, the Company seeks to maintain safeguards appropriate to the risks involved in processing personal data.
12. Your Rights (GDPR)
Subject to the conditions and limitations set out in applicable data protection law, you may have the following rights in relation to your personal data:
● Right of access: to request confirmation of whether we process your personal data and, where applicable, obtain a copy of that data.
● Right to rectification: to request correction of inaccurate personal data or completion of incomplete data.
● Right to erasure: to request deletion of your personal data where the legal conditions for erasure are met.
● Right to restriction of processing: to request that we restrict the processing of your personal data in circumstances provided for by law.
● Right to object: to object to processing based on our legitimate interests or carried out for direct marketing, subject to the applicable legal requirements.
● Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format and, where legally applicable,
request its transmission to another controller.
● Right to withdraw consent: where processing is based on your consent, to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise these rights, please contact us at info@montesauri.com. We may request information reasonably necessary to verify your identity before responding. We will respond to requests within the time limits required by applicable data protection law. Certain rights may be limited where a lawful exception applies, including where processing or retention is necessary to comply with AML/CFT, record-keeping or other legal obligations. Any restriction will be assessed on a case-by-case basis in accordance with applicable law. You also have the right to lodge a complaint with the competent data protection supervisory authority, including the Office of the Commissioner for Personal Data Protection in Cyprus, if you believe that your personal data has been processed in breach of applicable data protection law.
13. Marketing
The Company may send marketing communications about its services where permitted by applicable data protection and electronic communications laws.
Marketing communications will be sent only where the Company has obtained consent, where required by law, or where another lawful basis and applicable conditions permit such communications.
You may opt out of marketing communications at any time by using the unsubscribe mechanism provided in the communication, where available, or by contacting us at info@montesauri.com.
Opting out of marketing communications will not affect service-related communications or the processing of personal data necessary to comply with legal or regulatory obligations.
14. Cookies
The Company may use cookies and similar technologies on its website to support essential functionality, maintain security and, where applicable, analyse website usage and improve user experience.
Cookies and similar technologies will be used in accordance with applicable data protection and electronic communications laws. Where consent is required, non-essential cookies will only be placed or used after the necessary consent has been obtained.
For further information about the types of cookies used, their purposes, retention periods and how to manage your preferences, please refer to our Cookie Policy.
15. Children
The Company's website, platform and services are intended for individuals aged 18 or over and are not directed at children.
The Company does not knowingly collect personal data from individuals under the age of 18 in connection with these services. If the Company becomes aware that it has collected such personal data, it will assess the circumstances and take appropriate steps in accordance with applicable law, which may include deleting the data where there is no lawful basis for retaining or processing it.
If you believe that an individual under the age of 18 has provided personal data to the Company, please contact us at info@montesauri.com.
16. Complaints
You have the right to lodge a complaint with the competent data protection supervisory authority if you believe that the processing of your personal data
infringes applicable data protection law.
In Cyprus, the competent authority is:
Office of the Commissioner for Personal Data Protection
● Email: commissioner@dataprotection.gov.cy
● Website: https://www.dataprotection.gov.cy
● Telephone: +357 22818456
You may contact the Company at info@montesauri.com to raise a concern or seek clarification about the processing of your personal data. However, contacting the Company first is optional and does not affect your right to lodge a complaint with the supervisory authority.
Further information on how to submit a complaint is available on the authority's official website.
17. Changes to This Policy
The Company may update this Privacy Policy from time to time to reflect changes in its personal data processing activities, services, legal or regulatory requirements, or other relevant circumstances.
The latest version will be published on the Company's website, together with the date of the latest update or revision.
Where required by applicable law, the Company will provide additional notice of material changes to affected individuals.
Individuals are encouraged to review this Privacy Policy periodically to remain informed about how the Company processes personal data.
Where the Company relies on legitimate interests, those interests will be assessed against the rights and freedoms of the individuals concerned. Where processing is required by law, the Company may be unable to provide or continue providing certain services if the necessary personal data is not supplied.
The Company will identify and document the applicable legal basis for its actual processing activities and provide further information where required by law.
6. How We Use Personal Data
The Company may process personal data for the following purposes, depending on the services provided, the individual's relationship with the Company and applicable legal and regulatory requirements:
● Service provision: to establish and administer customer relationships and provide the services requested, where applicable.
● Identity and business verification: to verify the identity of individual customers and, where relevant, corporate customers and their beneficial owners, throughKYC/KYB procedures and supporting documentation.
● AML/CFT compliance: to conduct customer due diligence, screening, risk-based monitoring and, where legally required, reporting to the competent
authorities.
● Risk assessment and fraud prevention: to assess customer and transaction risks, detect potentially suspicious or fraudulent activity, and protect the
Company, its customers and its systems from misuse.
● Legal and regulatory compliance: to meet applicable record-keeping, reporting, information-request and other legal or regulatory obligations.
● Service development and security: to maintain, secure and improve the website, platform and related services, where such processing is carried out
and permitted by law.
● Communications and support: to respond to enquiries, provide service-related information, manage requests and communicate with customers and other relevant individuals.
Personal data will be processed only for specified and legitimate purposes and will not be used in a manner incompatible with those purposes, unless permitted by applicable law. The Company will apply appropriate safeguards and retain personal data only for as long as necessary for the relevant purpose or as required by law.
7. Automated Decision-Making & Profiling
The Company may use automated tools and processes to support compliance, security and risk management activities, including:
● Customer risk scoring and profiling.
● Fraud detection and prevention.
● Transaction monitoring and the identification of potentially suspicious activity.
These tools may analyse personal data and generate risk indicators, alerts or recommendations. Their results may be used to support further checks, compliance reviews or decisions concerning access to, or the continued provision of, services.
Where automated processing is used, the Company will assess whether it constitutes solely automated decision-making that produces legal effects or
similarly significantly affects an individual within the meaning of Article 22 GDPR. Where Article 22 applies, the Company will provide the safeguards required by law, including information about the processing and access to applicable rights, such as requesting human intervention, expressing a point of view and contesting the decision, where legally available.
Individuals may contact the Company at info@montesauri.com with questions or requests concerning the use of their personal data in these processes.
8. Sharing of Personal Data
The Company may disclose personal data to the following categories of recipients, where necessary for the purposes described in this Privacy Policy and subject to applicable data protection law:
● Competent authorities and regulators: including CySEC, the Cyprus Financial Intelligence Unit (MOKAS) and other competent authorities, where disclosure is required or otherwise permitted by law.
● Identity verification and AML/CFT service providers: providers supporting identity verification, customer screening, blockchain analytics and related
compliance activities, where applicable.
● Payment service providers and financial institutions: where necessary to process payments or support relevant financial transactions.
● Cloud, technology and IT service providers: providers supporting the Company's website, platform, systems, hosting, security and related technical
operations.
● Professional advisers: including legal advisers, auditors and compliance consultants, where their involvement is necessary and appropriate.
Personal data may also be disclosed where necessary and lawful to:
● Comply with legal or regulatory obligations, or respond to lawful requests from competent authorities.
● Prevent, detect or investigate suspected fraud, financial crime, security incidents or other unlawful activity.
● Support a merger, restructuring, acquisition or transfer of business, subject to applicable confidentiality and data protection requirements.
The Company will limit disclosures to personal data that is relevant and necessary for the applicable purpose. Where required, appropriate contractual, organisational and technical safeguards will be applied, including safeguards governing processing by service providers and any international transfers of personal data.
9. International Data Transfers
The Company may transfer personal data to countries outside the European Economic Area (EEA) where this is necessary for the purposes described in this Privacy Policy, including where relevant service providers or technology infrastructure are located outside the EEA.
Where personal data is transferred to a country outside the EEA, the Company will ensure that the transfer complies with applicable data protection law. Depending on the circumstances, the safeguards may include:
● Adequacy decisions: transfers to countries recognised by the European Commission as providing an adequate level of data protection.
● Standard Contractual Clauses (SCCs): contractual safeguards approved by the European Commission, where applicable.
● Additional safeguards: supplementary technical, organisational or contractual measures where required following an assessment of the transfer.
Information about the applicable transfer mechanism may be requested from the Company using the contact details provided in this Privacy Policy, subject to applicable legal restrictions.
10. Data Retention
The Company retains personal data only for as long as necessary to fulfil the purposes for which it was collected, taking into account applicable legal and regulatory requirements, the nature of the data and the need to establish, exercise or defend legal claims.
In particular:
● AML/CFT records: Personal data contained in customer due diligence records, transaction records and other relevant AML/CFT documentation will
generally be retained for at least five years after the end of the business relationship or the date of an occasional transaction, as applicable under
Cyprus AML/CFT legislation.
● Extended retention: Where permitted or required by applicable law or a competent authority, the retention period may be extended, including for up to an additional five years where the relevant legal conditions are satisfied.
● Other personal data: Information processed for contractual, technical, security, communication or other purposes will be retained for the period
necessary for the relevant purpose, unless a different retention period is required or permitted by law.
When the applicable retention period expires, personal data will be securely deleted or anonymised, unless continued retention is legally required or justified under an applicable legal basis.
Personal data subject to mandatory legal retention requirements may not be deleted solely because an individual requests erasure. Such requests will be assessed in accordance with applicable data protection law, and any lawful exceptions to the right to erasure will be applied as appropriate.
11. Data Security
The Company applies appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the nature of the data, the risks associated with its processing and applicable legal requirements.
Depending on the systems and services used, these measures may include:
● Encryption: encryption of personal data in transit and at rest, where supported and implemented.
● Access controls: restrictions on access to personal data based on authorised roles and business needs, together with appropriate authentication
mechanisms.
● Monitoring and incident detection: security logging, monitoring and measures to detect and respond to suspected unauthorised access or other security incidents, where implemented.
● Secure infrastructure and storage: safeguards designed to protect the systems, networks and storage environments used to process personal data.
● Organisational safeguards: internal procedures, confidentiality requirements and appropriate staff awareness measures to support the secure handling of personal data.
The Company periodically reviews the adequacy of its security measures and seeks to address identified weaknesses in accordance with its risk management processes and applicable legal obligations.
No method of electronic transmission or storage can be guaranteed to be completely secure. However, the Company seeks to maintain safeguards appropriate to the risks involved in processing personal data.
12. Your Rights (GDPR)
Subject to the conditions and limitations set out in applicable data protection law, you may have the following rights in relation to your personal data:
● Right of access: to request confirmation of whether we process your personal data and, where applicable, obtain a copy of that data.
● Right to rectification: to request correction of inaccurate personal data or completion of incomplete data.
● Right to erasure: to request deletion of your personal data where the legal conditions for erasure are met.
● Right to restriction of processing: to request that we restrict the processing of your personal data in circumstances provided for by law.
● Right to object: to object to processing based on our legitimate interests or carried out for direct marketing, subject to the applicable legal requirements.
● Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format and, where legally applicable,
request its transmission to another controller.
● Right to withdraw consent: where processing is based on your consent, to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise these rights, please contact us at info@montesauri.com. We may request information reasonably necessary to verify your identity before responding. We will respond to requests within the time limits required by applicable data protection law. Certain rights may be limited where a lawful exception applies, including where processing or retention is necessary to comply with AML/CFT, record-keeping or other legal obligations. Any restriction will be assessed on a case-by-case basis in accordance with applicable law. You also have the right to lodge a complaint with the competent data protection supervisory authority, including the Office of the Commissioner for Personal Data Protection in Cyprus, if you believe that your personal data has been processed in breach of applicable data protection law.
13. Marketing
The Company may send marketing communications about its services where permitted by applicable data protection and electronic communications laws.
Marketing communications will be sent only where the Company has obtained consent, where required by law, or where another lawful basis and applicable conditions permit such communications.
You may opt out of marketing communications at any time by using the unsubscribe mechanism provided in the communication, where available, or by contacting us at info@montesauri.com.
Opting out of marketing communications will not affect service-related communications or the processing of personal data necessary to comply with legal or regulatory obligations.
14. Cookies
The Company may use cookies and similar technologies on its website to support essential functionality, maintain security and, where applicable, analyse website usage and improve user experience.
Cookies and similar technologies will be used in accordance with applicable data protection and electronic communications laws. Where consent is required, non-essential cookies will only be placed or used after the necessary consent has been obtained.
For further information about the types of cookies used, their purposes, retention periods and how to manage your preferences, please refer to our Cookie Policy.
15. Children
The Company's website, platform and services are intended for individuals aged 18 or over and are not directed at children.
The Company does not knowingly collect personal data from individuals under the age of 18 in connection with these services. If the Company becomes aware that it has collected such personal data, it will assess the circumstances and take appropriate steps in accordance with applicable law, which may include deleting the data where there is no lawful basis for retaining or processing it.
If you believe that an individual under the age of 18 has provided personal data to the Company, please contact us at info@montesauri.com.
16. Complaints
You have the right to lodge a complaint with the competent data protection supervisory authority if you believe that the processing of your personal data
infringes applicable data protection law.
In Cyprus, the competent authority is:
Office of the Commissioner for Personal Data Protection
● Email: commissioner@dataprotection.gov.cy
● Website: https://www.dataprotection.gov.cy
● Telephone: +357 22818456
You may contact the Company at info@montesauri.com to raise a concern or seek clarification about the processing of your personal data. However, contacting the Company first is optional and does not affect your right to lodge a complaint with the supervisory authority.
Further information on how to submit a complaint is available on the authority's official website.
17. Changes to This Policy
The Company may update this Privacy Policy from time to time to reflect changes in its personal data processing activities, services, legal or regulatory requirements, or other relevant circumstances.
The latest version will be published on the Company's website, together with the date of the latest update or revision.
Where required by applicable law, the Company will provide additional notice of material changes to affected individuals.
Individuals are encouraged to review this Privacy Policy periodically to remain informed about how the Company processes personal data.