PRIVACY POLICY
1. Introduction
This Privacy Policy explains how we collect, use, disclose, and otherwise process personal data when individuals access or interact with the EU One Stop Shop for Supporting Green Line Trade and Businesses website (the “Website”). The Website is part of an initiative established by the European Commission in cooperation with, and supported by, the Cyprus Chamber of Commerce and Industry (CCCI/KEBE) and the Turkish Cypriot Chamber of Commerce (TCCC/KTTO). The project aims to support trade across the Green Line, promote cross community business cooperation, inform stakeholders about legal aspects and procedures, and promote compliance with EU standards and consumer protection requirements. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Cyprus Law 125(I)/2018 (together, the “Data Protection Laws”).
2. Data Controller
For the purposes of this Website, the primary controller is:
NIRAS IC Sp. Zo.o.
Address: UI. Pulawska 182, 02-670 Warsaw, Poland
Email: info@gdekconsultants.com
3. Categories of Personal Data Processed
We may process identification and contact details you submit, including name, organisation or business affiliation, job title, email address, telephone number, and country or location when you input these details on the Marketplace. We may process communication data when you submit enquiries, contact the project team, request information, or subscribe to updates or newsletters, including correspondence, attachments, and feedback or survey responses. We may automatically collect technical and usage data such as IP address, device identifiers, browser type and version, operating system, referring website, time and date of access, pages visited, and navigation paths. For event registrations (for example, workshops or consultations), we may collect your name, organisation, contact details, professional role, and attendance information.
4. Purposes of Processing
We process personal data to operate, administer, and secure the Website; to communicate with businesses, chambers of commerce, public authorities, and economic operators; to provide information on Green Line trade frameworks, regulatory requirements, procedures, documentation, and relevant EU acquis; to manage event registrations and participation; to analyse Website usage to improve accessibility and assess project impact; and to comply with legal obligations.
5. Legal Bases for Processing
Personal data is processed on the following legal bases in accordance with Article 6 of the GDPR. Processing is carried out based on legitimate interests for the operation and administration of the Website, for responding to enquiries from you, and for security measures including the prevention of fraud. Data collected for event registration is processed either on the basis of the performance of a contract or, where applicable, with the individual’s consent. Newsletter subscriptions rely on the individual’s consent, which may be withdrawn at any time without affecting the lawfulness of prior processing. Additionally, personal data is processed to comply with applicable legal obligations under EU or national law. These legal bases ensure that all processing activities are conducted lawfully, transparently, and with respect for individuals’ rights.
6. Cookies and Tracking Technologies
The Website uses cookies and similar tracking technologies to enhance user experience, ensure smooth operation, and gather insights for improvement. These technologies are employed to support essential website functionality, enabling features such as secure access, navigation, and interactive elements that are critical for the Website to operate correctly. In addition, cookies are used for analytics and performance measurement, allowing the Website to monitor usage patterns, assess the effectiveness of content and services, and identify areas for optimization. They also help in storing user preferences, such as language settings or display options, so that each visit can be tailored to the individual’s needs, improving convenience and overall usability. By combining these functions, the use of cookies ensures both the reliable operation of the Website and a more personalized and efficient experience for users.
Further information is available in the Website’s Cookie Policy.
7. Disclosure of Personal Data
We may disclose personal data to project partners, including the European Commission, the Cyprus Chamber of Commerce and Industry, and the Turkish Cypriot Chamber of Commerce, as part of project implementation. We engage third‑party service providers (such as hosting, IT, analytics, and event management platforms) under contracts that impose strict data protection obligations. We may share data with public authorities where required by law. While processing generally occurs within the EEA, if data is transferred outside the EEA, we implement appropriate safeguards such as EU adequacy decisions or Standard Contractual Clauses.
8. International Transfers
Personal data will be processed and stored within the European Economic Area (EEA) to ensure compliance with EU data protection standards. In cases where it becomes necessary to transfer personal data to countries outside the EEA, such transfers will only take place with appropriate safeguards in place to maintain a high level of protection. These safeguards may include the use of adequacy decisions issued by the European Commission, which recognize that a third country ensures an adequate level of data protection, or the implementation of Standard Contractual Clauses approved by the European Commission, which legally bind the recipient to uphold EU data protection requirements. Such measures are designed to ensure that personal data continues to be handled securely and in accordance with applicable privacy laws, even when processed internationally.
9. Data Retention
We maintain and store your personal data processed by us for as long as is considered necessary for the purpose for which it was collected and in accordance with applicable Data Protection Laws. Personal data will be retained for a period of 7 days for security troubleshooting and historical record purposes. We never share your data with third parties for any reason unless to ensure compliance with legal obligations and the legitimate purposes of processing, after which the data will be securely deleted or anonymised.
For users who submit information in the marketplace section of the website, the data provided for product listings is retained only for as long as the products remain published. Once a trader removes a product listing, all associated personal data relating to that listing is permanently deleted. We do not keep marketplace data beyond the period required to display the trader’s products.
10. Data Security
We implement appropriate technical and organisational measures to ensure the protection of personal data, including encryption and secure communications, access control mechanisms, a secure hosting infrastructure, and regular security monitoring. We adhere to generally accepted standards of technological and operational security to safeguard personally identifiable information from loss, misuse, alteration, or destruction. Access to such information is strictly limited to specifically authorized personnel of NIRAS, all of whom have formally agreed to maintain the confidentiality of the data they handle.
11. Data Subject Rights
Under the General Data Protection Regulation, you have specific rights regarding the processing of your personal data. We have developed a mechanism to ensure that requests relating to your personal data are handled effectively. Please note that some of the rights listed below may not apply in all circumstances.
- Right of Access: You have the right to request access to the personal data we hold about you. Upon request, and provided we maintain your data in electronic format, you may receive a copy of your personal data.
- Right to Rectification: You have the right to request the correction or completion of inaccurate or incomplete personal data we hold about you. Supporting documentation may be required in such cases.
- Right to Erasure (“Right to be Forgotten”): You may request the deletion of your personal data without undue delay, especially where the data is no longer necessary for the purposes for which it was collected. Please note that data will be deleted in accordance with our data erasure policy and applicable legal obligations.
- Right to Restriction of Processing: You can request the restriction of processing of your personal data if its accuracy is contested, if processing is unlawful, or if the data is no longer needed by us but you require it for legal claims.
- Right to Object: You may object at any time to the processing of your personal data. In such a case, we will cease processing unless there are compelling legitimate grounds or the data is needed for the establishment, exercise, or defense of legal claims.
- Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to request the transfer of such data to another controller.
- Right to Withdraw Consent: If the processing of your data is based on your consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before the withdrawal. However, withdrawing your consent may affect the services we are able to provide.
- Right to Lodge a Complaint: If you believe your rights have been violated or are dissatisfied with the outcome of a request, you may lodge a complaint with the Commissioner for the Protection of Personal Data in Cyprus by using the following details:
Office of the Commissioner for the Protection of Personal Data
1 Iasonos Street, 2nd Floor, 1082 Nicosia
P.O. Box 23378, 1682 Nicosia
Tel.: +357 22818456
Email: commissioner@dataprotection.gov.cy.
To exercise any of the rights listed above, or if you have any questions or require further clarification about your rights, please contact info@gdekconsultants.com
14. Amendments
Our ongoing responsibility to transparency requires us to keep this Privacy Policy updated through regular review.
This Privacy Policy was last updated on 15 October 2026.