Privacy Policy

Who we are

FIRMCY Screening is operated by Ioannou & Sharpe LLC, a Cyprus limited liability company (reg. HE 447364), of Griva Digeni, Limassol Center, Block B, 3rd Floor, Office 304, 3095 Limassol, Cyprus, VAT CY60007091D. Our data-protection contact is [email protected].

What this covers

This policy covers two surfaces: firm.cy (this marketing website, including the contact form) and screening.firm.cy (the service — your account, billing, and the screening of persons you submit). Your role, and ours, differs between them.

Roles

• When you visit firm.cy — IOS is the controller of the personal data you give us as a website visitor (e.g. a contact-form enquiry).
• When you screen your own clients on screening.firm.cy — your organisation is the controller of the screened person's data, and IOS acts as your processor under the Data Processing Agreement. You are responsible for your own lawful basis and your own privacy notice toward the people you screen.
• For your account and billing data on screening.firm.cy — IOS is the controller (to provide and administer the service and meet our own legal obligations).

What we process

Contact-form submissions; account and billing data; screening subject data (as your processor, under the DPA — not under this policy); usage and technical data (IP, user agent, audit logs); and our email correspondence with you.

Lawful basis

Contract (providing your account, responding to enquiries), legal obligation (accounting, tax, AML where applicable), legitimate interests (security, audit, abuse prevention), and consent where you give us information voluntarily. For the people you screen, the lawful basis is yours to establish per run.

Where data is stored

All personal data covered by this policy is hosted in the European Union (AWS eu-central-1, Frankfurt; xAI EU endpoint with zero-data-retention; EU payment and email sub-processors; Cloudflare at the EU edge). No Chapter V transfer mechanism is required for the data covered.

Retention

Contact-form submissions are kept only as long as needed to respond and for a reasonable period thereafter. Account data is kept for the life of the account and a reasonable period after closure for accounting, tax and dispute purposes. Screening subject data and evidence are retained as your processor per the DPA.

Your rights

You have the right to access, rectify, erase, restrict, port, object to and (where we rely on consent) withdraw consent to processing, and to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy). Contact [email protected] to exercise a right. Requests about the people you screen should go to your own organisation as controller.

Cookies

This website and the service use only essential cookies (the authenticated session cookie on screening.firm.cy and Cloudflare's edge security/routing). We run no cross-site tracking, advertising or profiling analytics.

Read the full Privacy Policy

The current, definitive Privacy Policy is at screening.firm.cy/legal/privacy.