Cookie Policy

Version 3.0 | Effective from: 01 September 2026 | Supersedes: Version 2.0 of 6 August 2026

1. Summary

The Website uses only technically necessary storage, and only to remember the choice you make in the consent banner.

We do not use analytics cookies, advertising or retargeting technologies, tracking pixels, social-media plug-ins, embedded third-party video or maps, or externally hosted fonts. No information is stored on or read from your device for any non-essential purpose.

Our contact forms are protected by a bot-detection service from Cloudflare. It does not set a cookie and stores nothing on your device, but it does process technical data about your browser. Section 8 explains this, and Section 8 of the Privacy Policy sets it out in full.

The rest of this Policy explains this in detail.

2. Scope

This Cookie Policy explains how INVESTUDIO LTD (“INVESTUDIO”, “we”, “us” or “our”) uses cookies and similar technologies on investud.io, its language versions and subdomains (the “Website”).

Read it together with our Privacy Policy, which contains fuller information about personal data processing and your rights. Where the two documents differ on cookies and similar technologies, this Cookie Policy prevails.

Controller: INVESTUDIO LTD, a private company limited by shares incorporated in the Republic of Cyprus, registration number HE 362494, registered office at Omirou 10, 3095 Limassol, Cyprus. Data protection contact: office@investud.io; telephone +357 25 030 252.

This Policy covers the public Website only. 

3. What are cookies and similar technologies?

Cookies are small text files or identifiers stored on, or read from, your browser or device. Session cookies normally expire when the browser closes; persistent cookies remain until their stated expiry or until you delete them. First-party cookies are set by the Website domain; third-party cookies or identifiers are set or accessed by another provider.

Similar technologies include local and session storage, pixels, tags, software development kits, device identifiers, tracking parameters in URLs and scripts that store information on a device or access information already stored there. The same legal rules apply to them.

4. Legal standard

Our approach is based on:

• Article 5(3) of Directive 2002/58/EC, as amended by Directive 2009/136/EC, as implemented in Cyprus by section 99(5) of the Regulation of Electronic Communications and Postal Services Law of 2004 (Law 112(I)/2004), as amended;
• the GDPR standard of consent (Articles 4(11) and 7), as interpreted by the Court of Justice of the European Union in Case C-673/17 Planet49 and Case C-61/19 Orange România; and
• EDPB Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive (version 2.0, adopted 7 October 2024), which confirm that the rule extends beyond cookies to pixels, URL tracking, local processing, SDKs, unique identifiers and device fingerprinting.

Storing information on, or accessing information already stored in, your device without consent is permitted only where this is strictly necessary to carry out the transmission of a communication or to provide a service or feature that you have expressly requested.

The Website relies on that exemption for one purpose only: remembering your cookie choice. No other storage takes place.

5. What is stored, and when

Before you interact with the banner, nothing is stored on your device. This has been verified: on a first visit, with the banner untouched, the Website sets no cookie and writes nothing to local or session storage.

When you make a choice in the banner, a small number of first-party cookies are written to record that choice, so that the banner does not reappear and so that we can demonstrate what you were shown and what you selected. These are listed in Annex A.

There is nothing else to switch on or off. The banner offers a single category, “Functional”, which covers the storage of your own choice.

6. Technologies we do not use

For clarity and because their absence is itself material information:

Links to our profiles on professional and social networks are ordinary hyperlinks. Nothing is loaded from those services while you are on our pages, and no data is sent to them unless you choose to follow the link.

7. Audience measurement without cookies

We do measure how the Website is used, but not by means of cookies or any other storage on your device.

Self-hosted software on our own server records the address of the page visited, the time spent on it, and whether a contact form was submitted. It is configured so that no cookie is set, no unique identifier is created, and no device fingerprinting is performed. No data is sent to any third party.

Because nothing is stored on or read from your device, section 99(5) of Law 112(I)/2004 and Article 5(3) of Directive 2002/58/EC do not apply, and no consent is required under those provisions. Your IP address is received by our server in the ordinary course of the request, so the processing relies on Article 6(1)(f) GDPR. Records are deleted automatically after 12 months.

Section 6 of the Privacy Policy sets this out in full, including how to object. The software also honours the “Do Not Track” and Global Privacy Control signals sent by browsers.

8. Protecting our contact forms

Our contact forms are protected in two ways.

Local checks. A hidden field that a human visitor never sees or completes, and a check on how long the form took to complete. Both run entirely on our own server. Neither stores anything on your device, creates any identifier, or sends any data to a third party.

Cloudflare Turnstile. A bot-detection service provided by Cloudflare, Inc. When a page loads, a small script from Cloudflare runs in your browser and assesses whether the traffic is automated. In some cases, you are asked to tick a confirmation box; usually the check completes without interaction.

Turnstile does not store anything on your device. It is configured without the “pre-clearance” feature, which is the only mode in which it would set a cookie. We have verified by direct browser inspection that no cookie is set, and nothing is written to local or session storage. Section 99(5) of Law 112(I)/2004 and Article 5(3) of Directive 2002/58/EC therefore do not apply to it, and no consent is required under those provisions.

What Cloudflare receives. Your IP address, technical characteristics of your browser and connection, and the identifier of the widget on our site. It does not receive the content of the form.

Where it runs. The Turnstile widget itself is displayed only on the pages of the Website that contain a contact form. The underlying script, however, loads on all pages, including pages that contain no form, and establishes a connection to Cloudflare on each of them. On a page without a form, the service performs no function beyond establishing that connection.

Legal basis. Because nothing is stored on or read from your device, the ePrivacy rules on consent do not apply. The related processing of personal data relies on Article 6(1)(f) GDPR — preventing automated abuse of our contact forms. You may object on grounds relating to your particular situation; section 13 of the Privacy Policy explains how.

Further information is in Cloudflare’s privacy policy. We provide this information ourselves and do not rely on the notice inside the Cloudflare widget to discharge our obligation to inform you.

9. Third parties and international transfers

Two external providers are involved in the Website, and only one of them is outside the EEA.

Hosting — within the EEA. The Website and its database are hosted by Hetzner Online GmbH on servers located in Germany. Everything you submit through a contact form is processed there.

Bot protection — United States. Cloudflare, Inc. processes the technical data described in section 8. Cloudflare, Inc. is an active participant in the EU–U.S. Data Privacy Framework, certified for both HR and non-HR data, and we rely on Commission Implementing Decision (EU) 2023/1795 as the transfer mechanism. The Cloudflare Customer Data Processing Addendum additionally incorporates the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, which apply if the adequacy decision ceases to be available. We verify the currency of the certification on the official Data Privacy Framework list and retain dated evidence.

No other transfer takes place. No analytics, advertising, font, content-delivery or embedded-content service outside the EEA is used.

The consent banner and the audience measurement described in sections 7 and 8 are provided by software installed on our own server, which does not transmit personal data of visitors to its developers or to anyone else.

10. Your choices

In the banner. You may accept or decline. Both options are presented with equal prominence on the first layer, and declining does not restrict access to any content of the Website.

Consent is requested by a clear affirmative action. It is not inferred from inactivity, scrolling, continuing to browse, closing the banner, or accepting this Policy. Nothing is pre-selected.

Changing your mind. Use the persistent Cookie Settings control available from every page. Withdrawal is as easy as giving consent, and prevents future use of the affected storage; it does not affect the lawfulness of anything done beforehand.

Browser controls. Your browser can block or delete cookies and clear local storage. Deleting stored data may also remove the record of your choice, so the banner may appear again. Browser controls supplement, but do not replace, our obligations.

Automated signals. We honour the “Do Not Track” and Global Privacy Control signals sent by browsers. Where such a signal is present, no audience measurement takes place, and the banner is treated as declined.

11. How long the record of your choice lasts

Two different periods apply and should not be confused:

• The cookies that store your choice have a lifetime of 12 months, as shown in Annex A. When they expire, or if they can no longer be read, you will be asked again.
• The content of the record — the categories selected, the timestamp and the version identifier of the notice shown to you — is held in those same cookies on your own device. We do not maintain a separate server-side database of consent records.

We will ask you to renew your choice where the purposes change materially, or where an earlier consent does not validly cover a change.

12. Changes to this Policy and version history

We may update this Policy to reflect changes in law or in Website technology. The new version number and effective date will be shown above. We will request fresh consent before activating any new non-essential purpose.

13. Contact, rights and complaints

Questions about cookies or related personal-data processing may be sent to office@investud.io, or by post to INVESTUDIO LTD, Omirou 10, 3095 Limassol, Cyprus.

The Privacy Policy explains how to exercise your rights under Articles 15 to 22 GDPR. You may also lodge a complaint with the Office of the Commissioner for Personal Data Protection, Kypranoros 15, 1061 Nicosia, Cyprus (P.O. Box 23378, 1682 Nicosia); commissioner@dataprotection.gov.cy; +357 22 818456; www.dataprotection.gov.cy.

Annex A — Storage inventory

Verified by direct browser inspection on 31 August 2026, on the home page, on a news article and on a page containing a contact form, both before and after interacting with the consent banner. This Annex is reviewed at least every 6 months and after any material change to the Website.

A.1 Before you interact with the banner

Nothing. No cookie is set, and no entry is written to local or session storage.

A.2 After you make a choice — strictly necessary

All of the following are first-party cookies set by our own domain. None is accessible to any third party. All are used solely to record and apply your choice.

A.3 Third-party storage

None. In particular, the Cloudflare Turnstile bot-protection service described in section 8 sets no cookie and writes nothing to local or session storage. This was verified by direct browser inspection on 31 August 2026, on the home page, on a news article and on a page containing a contact form.

A.4 Other technologies

None. No pixels, tags, SDKs, fingerprinting, local storage or session storage are used by the Website.

Hosting. The Website is hosted on servers located in Germany. No transfer outside the European Economic Area takes place by reason of hosting or of anything described in this Annex.