Privacy Policy

This policy explains what CPA MOTOR WORKS LIMITED does with personal data collected through cpamotorworks.cy, why, on what legal basis, and for how long. It is written to Articles 12 to 14 of the General Data Protection Regulation (EU) 2016/679, as applied in Cyprus by Law 125(I)/2018.

1. Who is responsible for your data

The data controller is CPA MOTOR WORKS LIMITED, a company registered in the Republic of Cyprus under number HE 122997, with its registered office at Párodos Panagías Evangelístrias 3, Káto Polemídia, 4156 Limassol, Cyprus.

• Controller — CPA MOTOR WORKS LIMITED
• Registration — HE 122997
• Registered office — Párodos Panagías Evangelístrias 3, Káto Polemídia, 4156 Limassol, Cyprus
• Email — cpamotorworks@primehome.com
• Telephone — +357 25 575575

We have not appointed a Data Protection Officer. We are not a public authority, our core activities do not consist of large-scale regular monitoring of individuals, and we do not process special categories of data on a large scale, so Article 37 does not require one. Data protection questions go to the address above and are answered by the company directly.

2. What we process, why, and on what basis

We keep this deliberately short, because we collect little. Every purpose we process personal data for is listed here. If a purpose is not in this table, we are not doing it.

Processing register

• Purpose: Answering an enquiry sent through the website form — Data: Name, telephone number, email address if given, and whatever you write in the message — Legal basis: Article 6(1)(b) — steps taken at your request before entering into a contract. Where your message is not about work on a vehicle, Article 6(1)(f), our legitimate interest in responding to people who contact us — Kept for: Up to 24 months from your last contact, then deleted
• Purpose: Preventing automated abuse of the enquiry form — Data: IP address, the time between the form loading and being submitted, and — through Cloudflare Turnstile, which loads only once you start filling in the form — technical characteristics of your browser and connection. Never what you type — Legal basis: Article 6(1)(f) — our legitimate interest in keeping the form usable and our inbox free of automated submissions — Kept for: IP addresses used for rate limiting are discarded after 1 hour. The Turnstile result is checked once and not stored by us
• Purpose: Understanding how the website is used — Data: Pages viewed, approximate location derived from a truncated IP address, device and browser type, referring site, and interactions such as tapping a telephone number; and, through Microsoft Clarity, recordings of how pages are used — clicks, taps, scrolling and mouse movement — with everything typed into the enquiry form masked before it leaves your browser — Legal basis: Article 6(1)(a) — your consent, given through the cookie banner and withdrawable at any time — Kept for: 14 months from your last visit (Google Analytics retention setting). Microsoft Clarity keeps recordings for 30 days and aggregated heatmaps for 13 months
• Purpose: Remembering your cookie choice — Data: Your decision, when you made it, and the version of this policy in force at the time. Stored in your own browser — Legal basis: Article 6(1)(c) — a legal obligation: Article 7(1) requires us to be able to demonstrate consent — Kept for: 12 months, after which we ask again
• Purpose: Keeping a record that we asked, and what you answered — Data: A receipt holding a random identifier generated by your own browser, the server's timestamp, your decision, the policy version, your site language, a coarse browser family such as "Chrome on macOS", and a salted one-way hash of your IP address. Your IP address itself is never stored, and we cannot identify you from a receipt — only you can, using the identifier held in your browser — Legal basis: Article 6(1)(c) — a legal obligation: Article 7(1) places on us the burden of demonstrating that consent was given — Kept for: 24 months, then deleted
• Purpose: Keeping records of work carried out on a vehicle — Data: Name, contact details, vehicle details and service history — Legal basis: Article 6(1)(b) — performance of our contract with you, and Article 6(1)(c) — our legal and tax record-keeping obligations — Kept for: 6 years, the period Cypriot tax law requires records to be kept

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights. In each case the processing is limited, expected, and of a kind you can object to at any time.

3. Do you have to give us your data?

No. You can browse this website without giving us anything. If you use the enquiry form we need a name, a message, and either a telephone number or an email address, because without a way to reply the enquiry has no purpose. If you do not want to provide them, telephone us instead.

4. Who else sees your data

We do not sell personal data and we do not share it for anyone else's marketing. The following processors handle data on our behalf, under contract and only on our instructions:

• Who: Google Ireland Limited — What they do: Google Analytics — website usage statistics, only if you consent — Where: Ireland, with onward transfer to Google LLC in the United States
• Who: Cloudflare, Inc. — What they do: Cloudflare Turnstile — checks that the enquiry form is being used by a person — Where: United States
• Who: Resend, Inc. — What they do: Delivering enquiry emails from the website form to our mailbox — Where: United States
• Who: Hetzner Online GmbH — What they do: Hosting this website and the consent receipt log — Where: Helsinki, Finland (EU)
• Who: ThunderWorx (primehome.com) — What they do: Receiving enquiry emails sent from the website — Where: Cyprus (EU)

Two recipients also act on their own account. Microsoft Corporation, which provides Microsoft Clarity, receives the Clarity data only if you agree to analytics, and receives it as an independent controller rather than as our processor: Microsoft may use it for its own purposes, including to provide Microsoft Advertising, under the Microsoft Privacy Statement (privacy.microsoft.com/privacystatement). Cloudflare uses the technical signals from the form check, as its own controller, to improve its detection of automated traffic; it does not use them to identify, profile or target you.

We will also disclose data where we are legally required to — for example to a tax authority, a court, or a regulator acting within its powers.

5. Transfers outside the EEA

Google Analytics data may be transferred to Google LLC in the United States. That transfer relies on the EU–US Data Privacy Framework, under which the European Commission has decided the United States offers an adequate level of protection for certified organisations, and on the European Commission's Standard Contractual Clauses as an additional safeguard. IP addresses are truncated before storage, so the address is not retained in full. Microsoft Clarity data is stored by Microsoft Corporation in the United States, and Resend and Cloudflare Turnstile process data there too; all three companies are certified under the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards in place.

6. How we protect your data

The website is served only over an encrypted connection (HTTPS), with HTTP Strict Transport Security enabled. Enquiries are rate limited and screened for automated submissions. Access to the mailbox that receives enquiries is limited to people at the company who need it. Analytics data is pseudonymous and we do not attempt to re-identify it.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the Commissioner within 72 hours as Article 33 requires, and we will tell you directly where Article 34 requires it.

7. Your rights

You have the following rights over your personal data. They are free to exercise, and we will respond within one month — extendable by two further months for complex requests, in which case we will tell you why within the first month.

• Access — a copy of the personal data we hold about you, and confirmation of how we use it (Article 15).
• Rectification — correction of anything inaccurate, and completion of anything incomplete (Article 16).
• Erasure — deletion, where we no longer need the data, where you withdraw consent that was the only basis for it, or where you successfully object (Article 17). This does not override records we are legally required to keep.
• Restriction — a pause on processing while an inaccuracy or an objection is resolved (Article 18).
• Portability — the data you gave us, in a structured, machine-readable format, where we rely on consent or contract (Article 20).
• Objection — to any processing based on legitimate interests, including on grounds relating to your particular situation (Article 21).
• Withdrawal of consent — at any time, without affecting anything done before you withdrew it (Article 7(3)). For analytics cookies, use the cookie settings link in the footer of any page.

To exercise any of these, contact us at cpamotorworks@primehome.com or +357 25 575575. We may ask you to confirm your identity before we act, so that we do not disclose your data to somebody else.

8. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22.

9. Children

This website is not directed at children and we do not knowingly collect their data. If you believe a child has sent us personal data, contact us and we will delete it.

10. Complaining

If you are unhappy with how we have handled your data, please tell us first — we would rather fix it. You also have the right to complain directly to the Cypriot supervisory authority at any time:

• Authority — Office of the Commissioner for Personal Data Protection (Γραφείο Επιτρόπου Προστασίας Δεδομένων Προσωπικού Χαρακτήρα)
• Address — Iasonos 1, 1082 Nicosia, Cyprus
• Post — P.O. Box 23378, 1682 Nicosia
• Telephone — +357 22 818 456
• Email — commissioner@dataprotection.gov.cy
• Website — dataprotection.gov.cy

If you live in another EU or EEA country, you may complain to your own national authority instead.

11. Changes to this policy

When we change this policy we update the date shown at the top of the page. Where a change materially affects how we use your data, we will make it obvious rather than relying on you to notice — and where the change concerns cookies, we ask for your consent again rather than carrying the old one forward.