The purpose of this privacy policy ("Policy") is to provide a clear explanation of when, why and how we collect and use personal data. We have designed it to be as user friendly as possible and have separate it in sections to make it easy for you to find the information that is most relevant to you.

The new European Union (EU) Data Protection Law, the General Data Protection Regulation ("GDPR"), comes into effect on 25th of May 2018. The GDPR (EU) 2016/679 gives individuals in the EU more control over how their data is used and places certain obligations on businesses that process the information of those individuals.

Who we are
CosmoCo Ltd is a company registered in Cyprus under registration number HE 243908 with its registered office located at 6 Neoptolemou Street, 1087, Nicosia, Cyprus licensed by the Institute of Certified Public Accountants of Cyprus (ICPAC) to provide Accounting Services (Certificate number E207/G/2017) and Auditing Services (Certificate number E207/A/2017). CosmoCo Ltd is also providing business consulting Services.

Who this privacy policy is directed to
This privacy policy is directed to natural persons (hereinafter our “clients”) who are either past, current or potential clients, or are authorized representatives/agents of past, current or potential clients, or are beneficial owners in legal entities who are past, current or potential clients.

Identity and contact details of the Data Controller and Data Protection Officer

(a) Data Controller

CosmoCo Ltd, a Cyprus private limited liability company, having registration number HE 243908, is the "Data Controller” pursuant to the GDPR, and related Cyprus Law, and determines how your personal data is kept and processed. 

The main establishment and the central administration of the Data Controller is situated at 6 Neoptolemou street, 1087, Nicosia, Cyprus.

(b) Data Protection Officer («DPO»)

We have designated a Data Protection Officer («DPO»), who is responsible to monitor compliance with this privacy policy as well as the applicable Laws and liaise with the Cyprus Supervisory Authority, namely the Office of the Commissioner for Personal Data Protection.

The DPO may be contacted directly with regards to all matters concerning this policy and the processing of your personal data including the enforcement of all applicable and available rights. 

Official requests may be made by post at 6 Neoptolemou street, 1087, Nicosia, Cyprus, or electronically at dpo@cosmoco.com.cy.

How do we collect personal data?
We collect and process different types of personal data which we receive from our clients in person or via their representatives in the context of our business relationship.

We may also collect and process personal data which we lawfully obtain not only from our clients and their representatives but also from other third parties e.g. other service providers, professionals such as accountants and lawyers or online screening tools. 

We may also collect and process personal data from publicly available sources (e.g. the Department of Registrar of Companies and Official Receiver, the Land Registry, the Bankruptcy Archive, commercial registers, the press, media and the Internet) which we lawfully obtain and are permitted to process.

Do we use Cookies?
We also collect and process certain browsing data from cookies, which are pieces of data stored directly on the computer or mobile device that you are using. We collect first party Cookies that is set by the domain, such as the computer you are using to access the internet, or the specific website that you have visited. We use the two main types of cookies, persistent and session cookies. A persistent cookie remains on your device after you have visited our website. These cookies will help us identify you as a unique anonymous visitor to our website by storing a randomly generated number. A session cookie is temporary and only exists for the period you access the website for (or until the browser is closed after visiting our website). This particular type of cookie assists us by helping our website remember your selections and choices whilst visiting our website and therefore avoids you having to re-enter information. This type of cookie is anonymous and does not contain personal information and cannot be used to identify you.

What categories of personal data do we collect?
We collect and use several types of information the individuals we co-operate with, including information by which you may be personally identified and that is defined as personal data under applicable law such as your first and last name, address, contact details (telephone, email), identification data (such as passport, driver’s license or ID), birth date, place of birth (city and country),  employment status (employed/self-employed), curriculum vitae,  taxation and other related financial details, reference letters, whether you hold/held a prominent public function (for PEPs), FATCA / CRS info, authentication data (e.g. signature).   

Should there be a need to further process the personal data for a purpose other than that for which they were initially collected, you will be informed in advance about the additional purpose and the relevant details in respect to the further processing. 

With your explicit consent we may collect special categories of personal data. Pursuant to the definition given by the GDPR, these data may include racial or ethnic origin, political opinions, religious or philosophical beliefs, health data, trade union membership, the processing of genetic data, biometric data, data concerning health, sex life or sexual orientation and criminal records.

What lawful reasons do we have for collecting, processing and disclosing personal data
In order to proceed with a business relationship our clients must provide their personal data to us which are necessary for the required commencement, execution and continuation of a business relationship. This is a requirement under the relevant Anti-Money Laundering Law and the regulations of our Regulator (ICPAC- Institute of Certified Public Accountants Cyprus). 

• Providing the requested services including professional advice and delivering reports related to our tax, advisory, audit and assurance, restructuring, mergers and acquisitions, consulting and other professional services. Our services may include reviewing client files for quality assurance purposes, which may involve processing personal data for the relevant client;
• Customer management: to manage your account, to provide you with customer support and with notices about your account, including notices about changes to services we offer or provide through it;
• Administering, maintaining and ensuring the security of our information systems, applications and websites;
• Functionality and security: to detect, prevent, and respond to actual or potential fraud and illegal activities;
• Compliance: to enforce our terms and conditions and to comply with our legal obligations as these derive from the applicable laws or our regulators;
• in any other way we may describe when you provide the information; or for any other purpose with your consent provided separately from this privacy policy.

• Supervisory and other regulatory and public authorities, whereby a statutory obligation exists. Some examples are the Institute of Certified Public Accountants Cyprus, the Registrar of Companies the income tax authorities, criminal prosecution authorities.
• Credit and financial institutions whereby our clients specifically instruct us.
• Any other service providers or professionals which our clients specifically instruct us to engage with, such as service providers, auditors, lawyers, business consultants etc. 

• any retention period that is required by law or professional standards;
• the end of the period in which litigation or investigations might arise in respect of the services or
• as directed by our own internal retention policies or practices, the length of which may vary depending on the nature of the information that is held.

• to receive access to your personal data (right to access).
• to rectify inaccurate personal data concerning you (right to data rectification);
• to request deletion/ erasure of your personal data (right to erasure/deletion, “right to be forgotten”);
• to receive the Personal Data provided by you in a structured, commonly used and machine-readable format and to transmit those Personal Data to another data controller (right to data portability);
• to object to the use of your personal data where such use is based on our legitimate interests or on public interests (right to object);
• in some cases to request the restriction of processing of your personal data (right to restriction of processing);
• to withdraw the consent given to us with regard to the processing of your personal data at any time. Note that any withdrawal of consent will not affect the lawfulness of processing based on consent before it was withdrawn.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information or to exercise any of your other rights. This helps us to ensure that personal data is not disclosed to any person who has no right to receive it. No fee is required to make a request unless your request is clearly unfounded or excessive. Depending on the circumstances, we may be unable to comply with your request based on other lawful grounds.

How to raise a complaint
To exercise any of the above rights, or for any questions or complaints about our use of your personal data, please contact our Data Protection Officer, either by post at 6 Neoptolemou street, 1087, Nicosia, Cyprus, or electronically at dpo@cosmoco.com.cy.

Complaints may also be lodged to the supervisory authority in Cyprus (Office of the Commissioner for Personal Data Protection, by post at 1 Iasonos Str. 1082, Nicosia, Republic of Cyprus. More information can be found at http://www.dataprotection.gov.cy.