Privacy Policy

1. Introduction

1.1. This Privacy Policy (the “Policy”) describes how RISTWEBY LIMITED, a company incorporated in the Republic of Cyprus under company registration number HE 499401 (hereinafter referred to as the “Company”, “RISTWEBY”, “we”, “us” or “our”) collects, uses, stores, discloses and otherwise processes personal data in connection with the operation of its website and the communication facilities made available through it.

1.2. This Policy applies to individuals who visit or browse our website, submit enquiries through our contact form, communicate with us by email or telephone, or otherwise interact with the Company in connection with the Website (collectively, the “Users” or “you”). This Policy concerns the Company's website-related activities. Where the Company provides digital strategy, advisory, product engineering, user experience, launch, scaling or other professional services under a separate agreement, the processing of personal data in connection with those services may be subject to additional contractual terms, privacy notices or data processing arrangements.

1.3. This Policy is intended to be read together with our Terms of Use.

2. Categories of Personal Data We May Process

2.1. The categories of personal data processed by the Company depend on how you interact with the Website and which information you choose to provide. We may process:

a. Contact and Identification Information

When you contact us through the Website, by email or by telephone, we may process information such as your name, your business email address, your telephone number, if provided, your company or organisation name, if provided; and other professional contact details that you voluntarily include in your communication. We do not require Users to create an account or register a profile to access the publicly available Website.

b. Enquiry and Communication Information

When you submit a message or business enquiry, we may process the contents of that communication, including: the subject and text of your enquiry; information concerning your business, project or service requirements; information necessary to respond to your request; and subsequent correspondence between you and the Company. You should provide only information reasonably necessary for your enquiry and avoid submitting sensitive personal data, passwords, payment details, identity documents or other confidential information unless specifically requested through an appropriate and secure process.

c. Technical and Usage Information

When you access the Website, certain technical information may be processed automatically, such as device information and information necessary to detect suspicious activity, prevent abuse or maintain the security of the Website.

d. Cookie and Similar Technology Information

The Website does not use cookies or similar technologies to collect, store, or process users’ personal data.

3. Purposes of Processing and Legal Bases

3.1. The Company processes personal data only where an applicable legal basis exists and for specified, explicit and legitimate purposes. Depending on the circumstances, the following purposes and legal bases may apply.

a. Responding to Enquiries and Business Communications – we process contact details and enquiry content to review incoming messages, respond to questions, clarify requirements and communicate with prospective clients or business partners. The applicable legal basis may be: taking steps at your request before entering into a contract, where your enquiry concerns a potential engagement; or our legitimate interests in communicating with individuals who contact us and managing ordinary business correspondence, provided that such interests are not overridden by your rights and freedoms.

b. Evaluating Potential Business Relationships – where you contact us regarding potential cooperation, we may process relevant professional information to understand the nature of your enquiry, assess whether our services may be suitable and determine whether further discussions are appropriate. Depending on the circumstances, this processing may be based on pre-contractual steps requested by you or our legitimate interests in developing and managing business relationships. Submitting an enquiry does not oblige the Company to accept a project or enter into a contract.

c. Operating and Maintaining the Website – we may process Technical and Usage Information necessary to deliver Website content, maintain functionality, identify technical errors, support compatibility and ensure the ordinary operation of the Website. The legal basis may be our legitimate interests in operating and maintaining a functioning Website or compliance with an applicable legal obligation, where relevant.

d. Security, Fraud Prevention and Abuse Detection – we may process relevant Technical and Usage Information and Enquiry and Communication Information to investigate suspicious activity, protect the Website, detect unauthorised access, prevent misuse and establish, exercise or defend legal claims where necessary. The legal basis may be our legitimate interests in protecting our systems, business operations and legal rights, or compliance with applicable legal obligations.

e. Legal and Regulatory Compliance – we may process and retain personal data where necessary to comply with applicable legal requirements, respond to lawful requests from competent authorities, maintain legally required records or establish, exercise or defend legal claims. Where processing is necessary to comply with a legal obligation, the relevant legal obligation shall constitute the applicable legal basis.

f. Analytics and Website Improvement – the Company may process relevant Technical and Usage Information to understand how the Website is used, identify technical issues and improve its structure, content or functionality. The applicable legal basis shall depend on the particular analytics technology, the data involved and the applicable legal requirements. Where consent is required, the relevant technology shall not be activated until the required consent has been obtained.

4. Disclosure of Personal Data to Third Parties

4.1. The Company does not make personal data available to third parties indiscriminately. Personal data may be disclosed only where necessary for a disclosed purpose, permitted by an applicable legal basis and consistent with applicable law. Depending on the actual services used and the circumstances of processing, recipients may include the following categories:

• a. Hosting and Technical Service Providers – providers involved in hosting, maintaining, securing or delivering the Website may process certain technical information as necessary to perform their services.
• b. Email and Communication Providers – providers responsible for transmitting, delivering, hosting or storing emails may process information included in communications sent to the Company.
• c. IT, Security and Maintenance Providers – the Company may engage providers to maintain the Website, troubleshoot technical issues, monitor security or support its IT infrastructure.
• d. Professional Advisers – lawyers, accountants, auditors and other professional advisers may receive relevant information where necessary to provide services to the Company or protect its legal interests.
• e. Public Authorities and Other Recipients – personal data may be disclosed to courts, regulators, law enforcement authorities or other recipients where disclosure is required by law, necessary to respond to a lawful request or otherwise permitted under applicable law.
• f. Corporate Transactions – where permitted by law, relevant personal data may be disclosed in connection with an actual or proposed merger, restructuring, acquisition, sale of assets or other corporate transaction, subject to appropriate confidentiality and data protection safeguards.

5. International Transfers of Personal Data

5.1. The Company is incorporated in Cyprus. Depending on the providers used to operate the Website and communicate with Users, personal data may be processed or accessed in countries other than the country in which the relevant User is located. Where personal data are transferred outside the European Economic Area (“EEA”), the Company shall ensure that the transfer complies with applicable data protection legislation. Depending on the circumstances, an international transfer may rely on:

• a. an applicable adequacy decision adopted by the European Commission;
• b. appropriate safeguards, such as standard contractual clauses approved by the European Commission, where applicable; or
• c. another transfer mechanism or derogation permitted under applicable law.

6. Data Retention

6.1. The Company retains personal data only for as long as reasonably necessary to fulfil the purposes for which the data were collected, unless a longer retention period is required or permitted by applicable law. The retention period depends on the nature of the information, the purpose of processing, the sensitivity of the data, applicable legal obligations and the need to establish, exercise or defend legal claims.

6.2. When personal data are no longer required, the Company takes reasonable steps to delete, anonymise or otherwise securely dispose of the information, subject to technical limitations and applicable legal requirements.

7. Data Security

7.1. The Company takes reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access. Depending on the nature of the processing and the risks involved, such measures may include access restrictions, appropriate account security, secure transmission mechanisms, software maintenance, system monitoring, backup arrangements and controls over access to business communications.

7.2. No website, electronic communication channel or storage system can be guaranteed to be completely secure in every circumstance. Accordingly, the Company cannot guarantee absolute security but shall address applicable security obligations in accordance with relevant law. Users should avoid transmitting sensitive information through ordinary contact forms or unsecured communication channels.

8. Your Rights Under Data Protection Law

8.1. Where the GDPR or other applicable data protection legislation applies, you may have certain rights concerning your personal data. Depending on the circumstances and applicable legal conditions, these rights may include the following:

a. Right of Access – you may request confirmation as to whether the Company processes your personal data and, where applicable, request access to those data and information about the processing.

b. Right to Rectification – you may request correction of inaccurate personal data or completion of incomplete personal data, taking into account the purposes of processing.

c. Right to Erasure – you may request deletion of your personal data where the relevant legal conditions are satisfied. This right is not absolute and may be subject to legal retention requirements or other lawful grounds for continued processing.

d. Right to Restriction of Processing – you may request restriction of processing in circumstances specified by applicable law.

e. Right to Object – where processing is based on legitimate interests or another applicable legal ground that provides an objection right, you may object to the processing on grounds relating to your particular situation. Where personal data are processed for direct marketing, you may have the right to object at any time to such processing, including related profiling, to the extent provided by applicable law.

f. Right to Data Portability – where the legal requirements are met, you may request to receive personal data that you have provided to the Company in a structured, commonly used and machine-readable format or request that the data be transmitted to another controller where technically feasible and legally applicable.

g. Right to Withdraw Consent – where processing is based on your consent, you may withdraw that consent at any time. Withdrawal shall not affect the lawfulness of processing carried out before the withdrawal. It shall also not affect processing carried out on another valid legal basis, where applicable.

h. Right to Lodge a Complaint – you may also lodge a complaint with the competent data protection supervisory authority. In Cyprus, this is the Commissioner for Personal Data Protection. Information on how to lodge a complaint is available at https://www.gov.cy/dataprotection/en/information-for-the-public/lodge-a-complaint/.

8.2. To submit a privacy request or ask a question concerning the processing of your personal data, contact us at: info@ristweby.com. Please describe your request clearly and provide sufficient information to enable us to identify the relevant processing activity. We may request additional information where reasonably necessary to verify your identity or clarify the scope of your request. We will assess and respond to your request in accordance with applicable law. Where we are unable to comply with a request, we will explain the relevant reasons to the extent required by law.

9. Children's Privacy

9.1. The Website is intended for general corporate and professional informational purposes and is not specifically directed at children. The Company does not knowingly seek to collect personal data from children through the Website for purposes that are not permitted by applicable law. If the Company becomes aware that personal data have been collected from a child in circumstances where the processing is unlawful, it shall assess the circumstances and take appropriate steps in accordance with applicable law.

10. Changes to This Privacy Policy

10.1. The Company may update this Policy from time to time to reflect changes in applicable law, the Company's activities, the Website's functionality, technical infrastructure or personal data processing practices. The updated version shall be published on the Website together with the revised “Last Updated” date. Users are encouraged to review this Policy periodically to remain informed about the Company's personal data processing practices.

11. Contact Information and Privacy Requests

For questions, comments, complaints or requests relating to this Policy or the processing of personal data by RISTWEBY LIMITED, please contact: info@ristweby.com.

The data controller responsible for the processing described in this Policy is:

This Privacy Policy was last updated on 26 October 2026.