1. INTRODUCTION
This Privacy Policy sets out how we, STELMACO LTD and/or its affiliated entities (“the Company”, “we” ,“us”), collect and process personal data relating to visitors to our website and premises, job applicants, employees, prospective clients and clients to whom we may provide services pursuant to an Engagement Letter or other means that establish an attorney-client relationship (“you” / “your”) , in accordance with applicable data protection laws including the General Data Protection Regulation (EU) 2016/679, as this may be amended or supplemented from time to time (“GDPR”).
2. DATA CONTROLLER
STELMACO LTD, with registered address at Spyrou Kyprianou 68, Germasogeia, 4042, Limassol, Cyprus and registration number ΗΕ 378653, is the data controller responsible for your personal data.
We are a private office and administrative service provider offering fiduciary and administration services to private clients and family offices globally.
Our office is located at Spyrou Kyprianou 68, Germasogeia, 4042, Limassol, Cyprus. We handle all personal data with the utmost confidentiality, ensuring proper training for staff and alignment with legal standards.
3. WEBSITE VISITORS
| CATEGORY OF PERSONAL DATA |
PURPOSE OF PROCESSING |
LEGAL BASIS (GDPR) |
| Name, telephone number, message content (via contact form) |
To respond to enquiries and communicate with website visitors |
Legitimate interest (Art. 6(1)(f)) / pre-contractual steps (Art. 6(1)(b)) |
| Technical data (e.g. IP address, basic server logs) |
Website security, fraud prevention, and technical maintenance |
Legitimate interest (Art. 6(1)(f)) |
4. JOB APPLICANTS
| CATEGORY OF PERSONAL DATA |
PURPOSE OF PROCESSING |
LEGAL BASIS (GDPR) |
| Name, contact details (email/phone) |
To communicate with applicants regarding recruitment process |
Pre-contractual steps (Art. 6(1)(b)) |
| CV and employment history |
To assess suitability for available positions |
Pre-contractual steps (Art. 6(1)(b)) |
| Education, qualifications and skills |
To evaluate candidate suitability for the role
|
Pre-contractual steps (Art. 6(1)(b)) |
| Interview notes and assessment results |
To evaluate candidates during recruitment process |
Legitimate interest (Art. 6(1)(f)) |
| References (if provided) |
To verify experience and suitability
|
Legitimate interest (Art. 6(1)(f)) |
5. EMPLOYEES
| CATEGORY OF PERSONAL DATA |
PURPOSE OF PROCESSING |
LEGAL BASIS (GDPR) |
| Identification data (name, surname, date of birth, ID/passport number) |
Managing the employment relationship; employee identification; record keeping |
Performance of a contract (Art. 6(1)(b)) |
|
Compliance with legal and regulatory obligations (e.g. employment law, immigration requirements) |
Legal obligation (Art. 6(1)(c) ) |
| Contact details (address, email, telephone number) |
Communication with employees; HR administration |
Performance of a contract (Art. 6(1)(b)) |
| Employment data (job title, department, start date, employment history, performance records) |
Workforce management, planning, performance evaluation, promotions, and reporting |
Performance of a contract (Art. 6(1)(b)) |
| Financial data (salary, bank details, tax and social insurance information) |
Payroll, benefits, tax reporting, and compliance with statutory obligations |
Legal obligation (Art. 6(1)(c ); Performance of a contract (Art. 6(1)(b)) |
| IT and usage data (login credentials, system usage, emails, device information, internet and network activity logs) |
Ensuring IT security, system integrity, business continuity, and policy compliance |
Legitimate interests (Art. 6(1)(f)).
Processing is limited to what is necessary and proportionate and carried out in accordance with applicable guidance of the Cyprus Commissioner for Personal Data Protection. |
|
Detecting, preventing, and investigating security incidents or misconduct |
Legitimate interests (Art. 6(1)(f)) |
| Special category data (health data, e.g. sick leave records) |
Compliance with employment, social security, and social protection law obligations; management of absence |
Legal obligation (Art. 6(1)(c _ ) and Article 9(2)(b) GDPR (employment and social services law) and applicable provisions of Cyprus law |
6. PROSPECTIVE & CURRENT CLIENTS
| CATEGORY OF PERSONAL DATA |
PURPOSE OF PROCESSING |
LEGAL BASIS (GDPR) |
| Identification details of directors, shareholders, UBOs, authorised signatories (e.g. name, surname, date of birth, nationality) |
Client onboarding, corporate structuring, and ongoing administration of corporate services |
Contract performance (Art. 6(1)(b)) / Legal obligation (Art. 6(1)(C)) |
| Contact details of directors, shareholders, UBOs (email, phone, address) |
Communication, service delivery, and regulatory correspondence |
Contract performance (Art. 6(1)(b)) |
| Due diligence documentation (copies of ID documents, passports, proof of address) |
KYC/AML compliance and client verification |
Legal obligation (Art. 6(1)(C)) |
| Source of funds and source of wealth information |
Anti-money laundering (AML) compliance and regulatory obligations |
Legal obligation (Art. 6(1)(C)) |
| Correspondence with individuals (emails, instructions, service requests) |
Service administration, client instructions, and audit trail |
Contract performance (Art. 6(1)(b)) / Legal obligation (Art. 6(1)(C)) |
| Payment-related data linked to individuals (where applicable, e.g. signatory details on invoices or mandates) |
Billing, accounting, and financial administration |
Contract performance (Art. 6(1)(b)) / Legal obligation (Art. 6(1)(C)) |
7. VISIT TO OUR PREMISES
| CATEGORY OF PERSONAL DATA |
PURPOSE OF PROCESSING |
LEGAL BASIS (GDPR) |
| CCTV footage (video recordings of individuals entering, exiting, or present within our premises) |
Security of premises, prevention and detection of crime, protection of staff, visitors, and property |
Legitimate interest (Art. 6(1)(f)) |
8. PERSONAL DATA OBTAINED FROM THIRD PARTIES
In the course of providing our services, we may collect and process personal data relating not only to our clients but also to other individuals associated with our clients. This may include, where applicable, directors, officers, shareholders, ultimate beneficial owners, authorised signatories, authorised representatives, employees, contractors, beneficiaries, settlors, protectors, family members, and other related persons.
Such personal data may be obtained indirectly from our clients or their authorised representatives, as well as from professional advisers, financial institutions, regulatory or public authorities, public registers, publicly available sources, compliance and due diligence databases, and other lawful third-party sources, rather than directly from the individuals concerned.
Where we process such personal data, we do so in accordance with applicable data protection legislation. The processing is carried out for purposes including the provision of corporate and administrative services, compliance with legal and regulatory obligations (including anti-money laundering and know-your-client requirements), and the pursuit of our legitimate business interests (i.e. risk management, fraud prevention andcorporate governance administration) provided such interests are not overridden by the rights and freedoms of the individuals concerned.
9. DATA SHARING
We may share personal data only where this is necessary for the provision of our services, to comply with legal obligations, or to protect our legitimate business interests.
Your personal data may be shared, where appropriate, with:
- Other companies within our group, where this is necessary for internal administration and service delivery
- Carefully selected service providers who assist us in operating our business (such as IT and cloud service providers, cybersecurity providers, and CCTV system providers)
- Professional advisers, including lawyers, auditors, and consultants
- Banks, payment service providers, and financial institutions involved in processing transactions
- Regulatory authorities, courts, and government bodies, where required by law or regulation
We ensure that all third parties who process personal data on our behalf are subject to appropriate confidentiality and data protection obligations and are only permitted to process personal data in accordance with our instructions and applicable data protection laws.
10. INTERNATIONAL TRANSFERS
Where it is necessary for the provision of our services, your personal data may be transferred and processed outside the European Economic Area (EEA), including in jurisdictions where we engage service providers, professional advisers, or registered agents.
In such cases, we ensure that appropriate safeguards are in place to protect your personal data in accordance with applicable data protection law. These safeguards may include, where applicable:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Supplementary technical, organisational, and contractual measures based on a transfer risk assessment
- Encryption, access controls, and data minimisation measures, where appropriate
- Assessment of local laws and practices in the recipient jurisdiction to ensure adequate protection standards
We only transfer personal data outside the EEA where this is necessary for service delivery or compliance purposes, and we take steps to ensure that an equivalent level of protection is maintained.
Recipients of personal data outside the EEA may include, where relevant:
- Offshore registered agents and corporate service providers
- Banks and financial institutions involved in cross-border transactions
- IT, cloud, and cybersecurity service providers
- Professional advisers and compliance service providers
All such recipients are contractually required to implement appropriate safeguards and to process personal data only in accordance with our instructions and applicable data protection laws.
11. DATA RETENTION
We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Specific retention periods may vary depending on the nature of data and applicable legal obligations and are determined based on legal, regulatory and business requirements.
CCTV footage and system/log data are retained for a limited period proportionate to their purpose, unless required for an investigation or legal proceedings.
Indicative retention periods include:
- Employee records: retained for the duration of employment and for a period thereafter in accordance with applicable employment, tax, and social security legislation
- Payroll and tax data: retained for the period required under applicable tax, accounting, and social insurance laws
- Client records (including corporate administration and related files): retained for the duration of the client relationship and thereafter for the period required under applicable law, regulatory obligations, and professional rules, including applicable requirements of the Cyprus Bar Association
- CCTV footage: typically retained for a limited period of up to 30 days, unless retention is necessary for incident investigation, security purposes, or legal proceedings
- IT systems and access logs: retained for a limited period proportionate to security, operational, and fraud prevention purposes
Retention periods may be extended where necessary for the establishment, exercise, or defence of legal claims, or where required to comply with applicable legal, regulatory, or professional obligations.
12. DATA SECURITY
The Company implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or disclosure.
Access to personal data is restricted on a need-to-know basis and is subject to confidentiality obligations.
The Company operates CCTV systems, IT monitoring tools, and access control systems as part of its security framework. Such measures:
- are implemented in a proportionate and transparent manner;
- are limited to what is necessary for legitimate business and security purposes;
- do not involve continuous or excessive monitoring; and
- are not used for solely automated decision-making affecting employees without human involvement.
Employees are expected to handle personal data responsibly and in accordance with Company policies.
If you access any third-party websites through links on our site, we are not responsible for their content or privacy practices. Always check their privacy notices before sharing personal data.
13. YOUR RIGHTS
Under applicable data protection law, you have the right to:
- Access your personal data
- Request correction of inaccurate or incomplete data
- Request erasure of your data (in certain circumstances)
- Restrict processing
- Object to processing based on legitimate interests
- Request data portability (where applicable)
Where processing is based on consent (if applicable), you have the right to withdraw your consent at any time.
14. CONTACT INFORMATION & COMPLAINTS
Contact us at
info@stelmaco.com or
+357 25 258600 to ask any questions about this privacy notice, exercise your rights or lodge a complaint. You may also contact the Cyprus Data Protection Commissioner.
15. UPDATES
We may update this Privacy Notice from time to time. Any changes will be published on our website and where appropriate, notified to you.
Last Updated: 11/06/2026
