PRIVACY POLICY of KIKLON PARTNERS LTD

1. Introduction

KIKLON PARTNERS LTD (referred to as “KIKLON”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect and process personal data in the course of:

  • providing legal, corporate, fiduciary, tax, relocation, real estate, banking-support, and business advisory services; and

  • operating our website [•www.kiklonpartners.com•], newsletters, online forms and any other digital channels controlled by us.

This Privacy Policy is issued in accordance with:

  • Regulation (EU) 2016/679 (the “GDPR”); and

  • the Cyprus Law on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of such Data, Law 125(I)/2018, as amended.

This Privacy Policy is addressed to natural persons who are:

  • existing or potential clients of KIKLON;

  • authorised representatives, directors, officers, shareholders or beneficial owners of our corporate or trust clients;

  • counterparties or other persons involved in matters on which we act;

  • visitors to our website or recipients of our marketing communications; and

  • any other individual whose personal data we may lawfully process in connection with our activities.

This Privacy Policy supplements any engagement letters, terms and conditions, or other notices that we may issue from time to time and is not intended to override them.

2. Who We Are – Controller and Contact Details

KIKLON PARTNERS LTD is a company incorporated under the laws of the Republic of Cyprus, with registration number HE473314 and office at 57 Spyrou Kyprianou, Office 35, 6051, Larnaca, Cyprus

For the purposes described in this Privacy Policy, KIKLON acts as Data Controller. In certain cases, associated entities or third-party providers may act as joint controllers or processors; where this is the case, you will be informed separately where required by law.

Data Protection Contact / DPO

We have designated an internal contact for data protection matters (the “Data Protection Contact”).

  • Name: Artemios Mallas

  • Email: hello@kiklonpartners.com

  • Postal address: 57 Spyrou Kyprianou, Office 35, 6051, Larnaca, Cyprus

All requests relating to this Privacy Policy or to your data protection rights should be addressed to the Data Protection Contact.

3. Your Duty to Inform Us of Changes

It is important that the personal data we hold about you is accurate and up to date. Please keep us informed if your personal data changes during your relationship with us (for example change of address, passport, or tax residency).

4. What Personal Data We Collect

“Personal data” means any information relating to an identified or identifiable natural person.

The categories of personal data we may collect and process (depending on the particular service and matter) include:

4.1 Identification and Contact Data

  • Name, surname, former names, title, date and place of birth, nationality(ies), gender.

  • Identification numbers and documents (e.g. passport, ID card, driver’s licence, migration permits, residency cards).

  • Residential and correspondence addresses, email addresses, telephone numbers and other contact details.

4.2 KYC / AML, Compliance and Risk Data

  • Information required under anti-money laundering and sanctions legislation (e.g. source of funds, source of wealth, employment/business profile, tax residency and tax identification numbers).

  • Politically Exposed Person (PEP) status and related declarations.

  • FATCA / CRS information and any other tax-reporting or regulatory information.

  • Information obtained from compliance databases, publicly-available registries and sanctions lists.

4.3 Professional, Corporate and Structuring Data

  • Profession, job title, employer, directorships and shareholdings.

  • Information relating to companies, partnerships, trusts, foundations or other structures in which you are involved (e.g. shareholder/UBO registers, trust deeds, corporate charts).

  • Information relating to fiduciary appointments (directors, secretaries, trustees, protectors, nominees) and economic substance arrangements in Cyprus or elsewhere.

4.4 Financial, Tax and Banking Data

  • Bank account details and payment instructions.

  • Information on assets, liabilities, investments and credit relationships.

  • Tax status, tax filings and tax planning information (corporate and personal).

  • Invoices, payment history and billing records.

4.5 Real Estate, Relocation and Immigration Data

  • Property ownership and transaction details for real estate acquisition, disposal, lease or management.

  • Information and documentation for residency and work permits, immigration applications, golden visa / investment migration programmes, relocation planning and foreign interest company registrations.

  • Information about family members where necessary for residency, estate planning, family office or trust structuring.

4.6 Contractual and Matter-Related Data

  • Information and documents that you or third parties provide to us in the context of legal, corporate, commercial, tax, banking-support, business growth or real estate mandates (e.g. contracts, correspondence, corporate approvals, court documents).

  • Records of advice given, meetings held, calls, emails and instructions.

4.7 Website / Technical Data

When you visit our website, we may collect:

  • IP address, browser type and version, time-zone setting, operating system and platform.

  • Information about how you use our website (pages visited, clickstream, session duration).

  • Cookie-related information (see “Cookies” below).

4.8 Marketing and Communications Data

  • Your preferences regarding receiving newsletters, event invitations and other marketing communications from us.

  • Records of your interactions with our marketing content (opens, clicks, unsubscribes).

4.9 Special Categories of Personal Data

In limited circumstances and only where lawful, we may process special categories of data (e.g. health data or information on criminal records) – for example for:

  • immigration / residency applications;

  • client due diligence;

  • litigation or legal advice; or

  • where required by law or with your explicit consent.

We will only process such data where this is strictly necessary and on an appropriate legal basis.

4.10 Children’s Data

We do not intentionally seek to collect children’s data through our website. Where our services relate to minors (e.g. estate planning, trusts or relocation for families), we will only process children’s data with the consent or authorisation of the parent or legal guardian or as otherwise permitted by law.

5. How We Collect Your Personal Data

We may collect personal data:

  • Directly from you: when you engage us, complete our client onboarding/KYC forms, send us documents, correspond by email, telephone or post, meet us in person, subscribe to our newsletter or fill in a website form.

  • From third parties: for example from professional advisers, intermediaries, banks, former service providers, introducers, property agents, migration agents, public authorities, regulators, courts and counterparties.

  • From public sources: such as the Registrar of Companies, Land Registry, commercial registries, sanctions lists, social media, and other online publications.

  • Automatically: via cookies and similar technologies when you use our website (see “Cookies” section).

6. Legal Basis and Purposes of Processing

We will only process your personal data where a lawful basis exists under the GDPR. Depending on the context, we may rely on one or more of the following grounds:

6.1 Performance of a Contract or Pre-Contractual Steps

To take steps at your request prior to entering into a contract and to perform our engagement with you, including:

  • assessing whether we can accept you as a client;

  • providing legal, corporate, fiduciary, trust, relocation, tax, real estate, business advisory, banking-support and other services;

  • opening and administering client and matter files;

  • facilitating bank account opening, payments, escrow and fiduciary cash management;

  • coordinating with third-party service providers, counterparties and authorities on your matters; and

  • communicating with you about the services and matters we handle for you.

6.2 Compliance with Legal and Regulatory Obligations

To comply with obligations imposed on us by applicable law and by professional and supervisory authorities, including:

  • anti-money laundering, counter-terrorist financing, sanctions and “know-your-client” obligations;

  • tax reporting and exchange of information (including FATCA / CRS and other international arrangements);

  • company, trust and corporate services regulation;

  • data-protection, accounting, audit and record-keeping requirements;

  • responding to lawful requests, orders or directions from courts, regulators, tax or other competent authorities; and

  • conflict-of-interest, professional conduct and other regulatory duties.

6.3 Legitimate Interests

Where necessary for purposes pursued by KIKLON or a third party, provided that your interests and fundamental rights do not override those interests, including:

  • managing and developing our business, services, website and IT systems;

  • ensuring the security of our premises, systems and confidential information;

  • managing client relationships, billing, debt collection and internal reporting;

  • evaluating potential transactions and structuring options for clients;

  • defending and exercising legal claims or handling complaints;

  • risk management, internal quality control, training and know-how;

  • organising and promoting events and publications aimed at existing or potential clients;

  • sharing data within our group / associated entities for client-onboarding, compliance and service-delivery purposes.

Where we rely on legitimate interests, we do so only after we have balanced such interests against your rights and expectations.

6.4 Consent

In certain situations, we may process your data on the basis of your explicit consent, for example:

  • sending you electronic marketing (where consent is required);

  • processing certain special categories of data that are not otherwise covered by a legal obligation or other lawful basis;

  • transferring your personal data to certain third countries where no other safeguard is available.

You have the right to withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing prior to withdrawal.

7. Obligation to Provide Data / Consequences of Failure

In many cases, the personal data we request is necessary for us to:

  • comply with statutory AML / KYC / sanctions obligations; and/or

  • enter into or perform our engagement with you.

If you fail or refuse to provide such information when requested, we may not be able to commence or continue our relationship or provide services, and we may be obliged to terminate or decline the engagement.

8. Change of Purpose

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another compatible purpose and the legal basis allows us to do so.

If we need to process your personal data for a purpose unrelated to the original purpose, we will notify you where required and explain the applicable legal basis.

9. Marketing

We may use your identification, contact and marketing preference data to:

  • send you legal, tax and regulatory updates relevant to Cyprus and other jurisdictions;

  • inform you about new services, events, seminars or publications; and

  • invite you to participate in surveys or feedback exercises.

You may opt out of marketing at any time:

  • by clicking the “unsubscribe” link in any marketing email; or

  • by contacting us at hello@kiklonpartners.com

Opting out of marketing will not affect our other communications with you in relation to active matters or our ongoing relationship.

10. Cookies and Website Tracking

Our website may use cookies and similar technologies in order to:

  • operate and secure the site;

  • remember user preferences;

  • generate statistics on website use; and

  • improve the content and user experience.

You can control cookies through your browser settings. Blocking certain cookies may affect the functionality of our website.

If we maintain a separate Cookies Policy, that policy will provide further details and should be read together with this Privacy Policy.

11. Sharing Your Personal Data

In the course of our business and for the purposes outlined above, we may disclose your personal data to:

  • Personnel of KIKLON: employees, directors and consultants who need access for the performance of their duties and are subject to confidentiality obligations.

  • Associated entities / member firms / related service providers engaged in your matter (for example, associated law firms or tax advisors where appropriate).

  • Professional advisers and service providers: lawyers, notaries, auditors, accountants, valuers, tax advisers, compliance consultants, immigration agents, real estate agents, property managers, business consultants and similar professionals.

  • Financial institutions and payment providers: banks, payment processors, escrow agents and other financial entities when facilitating banking, loan, escrow or cash-management arrangements.

  • Corporate and fiduciary service providers: company secretaries, corporate administrators, trustees, registrars, nominee service providers and directors where necessary to establish or manage structures.

  • IT and infrastructure providers: providers of cloud services, document management, email, archiving, cybersecurity, website hosting and analytics.

  • Public authorities, regulators and courts: the Cyprus Registrar of Companies and other registries, the Tax Department, Migration authorities, Land Registry, supervisory bodies (including the Cyprus Bar Association / other competent regulators), law-enforcement agencies, courts and tribunals, where disclosure is required or appropriate.

  • Counterparties and their advisers: where reasonably necessary in the context of transactions, negotiations, legal proceedings or other matters on which we act.

  • Event and marketing partners: organisers, venues and mailing platforms that assist us in hosting events or distributing publications.

We require all recipients who act as our processors to:

  • process your personal data only on our instructions;

  • implement appropriate technical and organisational measures to protect it; and

  • maintain confidentiality.

We do not sell or rent your personal data to third parties.

12. International Transfers

In certain circumstances, we may transfer your personal data to recipients located outside the European Economic Area (“EEA”), for example:

  • where your matter has connections with non-EEA jurisdictions;

  • where counterparties, banks or advisers are based outside the EEA; or

  • where our IT or cloud providers host data in third countries.

Where such transfers occur, we will ensure that one of the following safeguards is in place:

  • an adequacy decision by the European Commission for the relevant country;

  • Standard Contractual Clauses (SCCs) or other contractual protections approved under the GDPR; or

  • another appropriate safeguard as permitted by law.

In limited cases, we may rely on your explicit consent or on another permitted derogation under the GDPR.

13. Data Security

We have implemented appropriate technical and organisational measures to safeguard personal data against:

  • unauthorised or unlawful access, alteration, disclosure or destruction; and

  • accidental loss or damage.

While we take reasonable steps to protect your data, no system or transmission over the internet can be guaranteed as completely secure.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the competent supervisory authority where required by law.

14. Data Retention

We will keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for:

  • the performance of our engagement and the management of our relationship;

  • compliance with legal, regulatory and professional obligations (including AML and tax-record requirements); and

  • the establishment, exercise or defence of legal claims.

As a general rule, and unless a longer period is required or allowed by law or professional rules, we retain client and matter files (including related personal data) as per the applicable GDPR regulation and other applicable laws. 

When the retention period expires, we will securely delete or anonymise your personal data, unless further retention is justified or required.

15. Your Rights

Subject to the conditions and limitations set out in the GDPR and applicable law, you have the following rights in relation to your personal data:

  1. Right of access – to obtain confirmation as to whether we process personal data about you and, if so, to receive a copy and certain information about the processing.
  2. Right to rectification – to have inaccurate or incomplete personal data corrected or completed.
  3. Right to erasure (“right to be forgotten”) – to request the deletion of your personal data in specific circumstances (for example where the data is no longer necessary, or processing is based on consent which has been withdrawn), subject to our legal and regulatory obligations.
  4. Right to restriction of processing – to request that we limit the processing of your personal data in certain situations (e.g. while we verify its accuracy or where you object to processing).
  5. Right to data portability – in certain cases, to receive personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller.
  6. Right to object – to object, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time to processing for direct-marketing purposes.
  7. Right to withdraw consent – where processing is based on your consent, you may withdraw that consent at any time.
  8. Rights in relation to automated decision-making – we do not carry out automated decision-making producing legal effects concerning you; if this changes, we will inform you.

To exercise any of the above rights, please contact our Data Protection Contact at hello@kiklonpartners.com or at the postal address stated in section 2.

We may need to request specific information from you to confirm your identity and to ensure your right to access your data or exercise any of your other rights. We aim to respond within one month, or within any extended period permitted by law for complex requests.

16. Right to Complain

If you are dissatisfied with the way we process your personal data, we would encourage you to contact us first so that we can seek to resolve your concerns.

You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus, which is the competent supervisory authority. Information on how to submit a complaint is available on the Commissioner’s official website.

17. Third-Party Websites

Our website may contain links to third-party websites or services. We do not control these websites and are not responsible for their privacy practices. When you follow a link to another site, you should read that site’s privacy policy.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation, our practices or our services.

  • 18th of November 2025

The most recent version will always be available on our website. Continued use of our services or website after changes take effect will constitute your acknowledgement of the updated Privacy Policy.