FIRMCY Screening is operated by Ioannou & Sharpe LLC, a Cyprus limited liability company (reg. HE 447364), of Griva Digeni, Limassol Center, Block B, 3rd Floor, Office 304, 3095 Limassol, Cyprus, VAT CY60007091D. Our data-protection contact is [email protected].
This policy covers two surfaces: firm.cy (this website, including its contact form, training registration and, once it opens, a public name-only PEP and sanctions search) and screening.firm.cy (the service — your account, billing, and the screening of persons you submit). Your role, and ours, differs between them.
Contact-form submissions; training-registration and attendance records (see below); public-search data (described below); account and billing data; authenticated screening subject data (as your processor, under the DPA — not under this policy); usage and technical data (IP, user agent, audit logs); and our email correspondence with you.
Contract (providing your account, responding to enquiries), legal obligation (accounting, tax, AML where applicable), legitimate interests (providing the public-list search described below, security, audit and abuse prevention), and consent where you give us information voluntarily. For people screened in the authenticated service, the lawful basis is yours to establish per run.
All personal data covered by this policy is hosted in the European Union (AWS eu-central-1, Frankfurt; xAI EU endpoint with zero-data-retention; EU payment and email sub-processors; Cloudflare at the EU edge). No Chapter V transfer mechanism is required for the data covered.
Contact-form submissions are kept only as long as needed to respond and for a reasonable period thereafter. Public-search names and results are not retained; the short-lived abuse-control key is described below. Account data is kept for the life of the account and a reasonable period after closure for accounting, tax and dispute purposes. Authenticated screening subject data and evidence are retained as your processor per the DPA.
You have the right to access, rectify, erase, restrict, port, object to and (where we rely on consent) withdraw consent to processing, and to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy). Contact [email protected] to exercise a right. A person named in the public search may also contact us there; because we do not retain a query or result, we normally cannot retrieve a past search. Requests about people screened in the authenticated service should go to the customer organisation acting as controller.
This website and the service use only essential cookies (the authenticated session cookie on screening.firm.cy and Cloudflare's edge security/routing). We run no cross-site tracking, advertising or profiling analytics.
We measure how often each page of firm.cy is read using our own counter — there is no analytics provider, no advertising pixel and no third-party script. A small script on each page tells our server two things: which page you opened, and, if you arrived from another website, that website's address (its hostname — never the full link). Nothing else is sent. The script sets no cookies, writes nothing to and reads nothing from your device, and creates no visitor, session or device identifier, so there is nothing that could be linked back to you.
What we store is a daily tally: for each day, each page, and each referring website's hostname, a count of views. There are no individual records and no way to reconstruct one person's visits. Your IP address reaches our server, as it must for any request to any website, and we use it only in the moment — to tell automated traffic from human traffic and to limit abuse. The visit counter never stores it. (One thing on this site does record an IP: a training registration, described below.) Tallies are deleted after 13 months. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, the script sends nothing.
This search is not yet open; this section describes how it will work.
What happens. You submit a person's name to IOS. Our EU-hosted screening engine compares it with public PEP and sanctions records and returns up to eight possible matches. The public response is limited to the listed name, match category, public office or role, source title and the date of the underlying data. It excludes birth dates, addresses, identifiers, source links, internal scores and engine identifiers.
Our role and purpose. IOS is the controller for this public search. We process the submitted name and the limited public-list fields to provide a proportionate compliance-screening tool. Our basis is our and the user's legitimate interests in checking whether a name may correspond to a public PEP or sanctions record (Article 6(1)(f) GDPR), subject to data minimisation and the safeguards described here. The result is a set of possible public-list matches, not a finding about identity, wrongdoing or risk, and the search makes no decision with legal or similarly significant effect.
Retention and abuse control. The submitted name and result are processed in memory and are not written to the website's logs, traffic database or a case file. The engine is stateless for this request. To limit automated abuse, the website temporarily keeps the requester's network address in an in-memory rate-limit bucket for no more than ten minutes; Cloudflare also handles the request at the EU edge for security and routing. We do not use the search for advertising, profiling or model training.
Sources and use. Match information comes from official or otherwise public PEP and sanctions sources. Use the search only for a lawful compliance or due-diligence purpose. A name match can refer to a different person: verify identity and context before acting, and do not use the public result as the sole basis for a decision affecting someone. Contact [email protected] about a result or to object to this processing.
Registering for an in-person training session at firm.cy/trainings is double opt-in: the form records your details as pending and emails you a link, and your place is taken only when you open it. Until then nothing is held, and if the link is never opened the pending record expires within 48 hours — at which point your details are deleted from it, not merely disregarded.
What we record. Your name, your firm or organisation, your email address, the role you select, the session you chose, your registration reference and its status, the time you submitted the form, the time you confirmed, whether you attended, and the IP address the registration came from (kept to limit abuse of the form and to evidence how the consent was given). We do not add you to any mailing list, and registering is not a subscription to anything.
Why, and on what basis. To hold your place, to email you about that session, to keep the attendance register a professional body may expect us to be able to produce, and to issue a certificate of attendance in your name if you attend. The lawful basis is your consent (Article 6(1)(a) GDPR), given by opening the confirmation link — which is why we send one rather than taking a tick-box at face value.
How long. The registration and attendance record is kept for three years from the session, which is the period over which a certificate of attendance may need to be evidenced. A pending registration that is never confirmed expires after 48 hours, and its details are deleted at that point; only a bare reference and the session remain, so the same reference is never issued twice.
Withdrawing, and erasure. You can withdraw your consent at any time, and ask for a copy of what we hold or for it to be erased, by writing to [email protected]. Withdrawal takes effect for the future: it releases your place and stops the emails, and erasure removes your details from the register. Withdrawing does not make the fact that you attended a session that has already happened untrue, but we will erase your details from the record on request.
Who sees it. Only Ioannou & Sharpe LLC. The register is not shared with any professional body, venue or third party, and the confirmation and reminder emails are sent through our own mail provider. It is stored in the EU like everything else covered by this policy.
The current, definitive Privacy Policy is at screening.firm.cy/legal/privacy.
