1. Introduction & Data Controller
ORVO Group ("we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, store, process, and protect your personal data when you interact with our website, request consultation sessions, or engage our advisory services in Cyprus and across the European Union.
For the purposes of the EU General Data Protection Regulation (GDPR) and the Cyprus Processing of Personal Data (Protection of Individuals) Law, ORVO Group acts as the Data Controller.
2. Information We Collect
We may collect and process the following categories of personal data:
- Identity & Contact Data: Full name, date of birth, email address, telephone number, WhatsApp contact, nationality, and residency status.
- Advisory & Inquiry Data: Details regarding your insurance requirements, financial objectives, property preferences, business operations, or relocation needs.
- Financial & Compliance Information: Estimated net worth brackets, investment ranges, and compliance/KYC documents provided during formal engagements.
- Technical & Usage Data: IP address, browser type, operating system, pages visited, and interaction timestamps collected automatically when navigating our platform.
3. Legal Basis for Processing
We process your personal data under the following GDPR legal bases:
- Contractual Necessity (GDPR Art. 6(1)(b)): To review your service requests, schedule consultations, and deliver advisory mandates.
- Legitimate Interests (GDPR Art. 6(1)(f)): To improve our service offerings, maintain website security, and respond promptly to prospective client inquiries.
- Legal & Regulatory Compliance (GDPR Art. 6(1)(c)): To comply with mandatory anti-money laundering (AML), tax, and statutory record-keeping obligations in Cyprus.
- Consent (GDPR Art. 6(1)(a)): Where you explicitly opt in to receive strategic market updates or newsletters.
4. How We Share Your Information
We do not sell, rent, or trade your personal data. We may share information strictly on a need-to-know basis with:
- Licensed Specialists & Partners: Vetted underwriters, legal counsels, tax advisors, and real estate developers directly involved in executing your requested mandate.
- Service Providers: Secure cloud hosting, database management, and authentication infrastructure providers operating under strict data processing agreements.
- Regulatory Authorities: Public bodies or law enforcement agencies when strictly required by applicable Cyprus or EU law.
5. Data Retention & Security
We apply technical and organizational security measures, including SSL/TLS encryption, restricted access controls, and secure database protocols to prevent unauthorized access or disclosure.
Personal data collected for consultations is retained only as long as necessary to fulfill the purpose for which it was gathered, or to comply with statutory statutory retention periods in the Republic of Cyprus (typically 5 to 7 years for financial and compliance records).
6. Your Rights Under GDPR
As a data subject in the European Union, you hold the following rights:
- Right of Access: Request a copy of the personal information we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete data.
- Right to Erasure ("Right to be Forgotten"): Request deletion of your data where no overriding legal retention ground exists.
- Right to Restriction of Processing: Request suspension of processing under specific legal conditions.
- Right to Data Portability: Obtain your data in a structured, machine-readable format.
- Right to Object: Object to processing based on legitimate interests or direct marketing.
You also have the right to lodge a formal complaint with the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy).
7. Contact Information
If you have any questions regarding this Privacy Policy or wish to exercise your data protection rights, please contact our Data Protection representative through our consultation portal or by submitting an advisory inquiry.