Privacy Policy

Version 3.0 | Effective from: 01 September 2026 | Supersedes: version 2.0 of 6 August 2026

1. Scope and legal framework

This Privacy Policy explains how INVESTUDIO LTD (“INVESTUDIO”, “we”, “us” or “our”) collects and uses personal data in connection with our public website at investud.io, including its language versions and subdomains (the “Website”).

It applies when you visit the Website, submit an enquiry through it, or otherwise communicate with us in connection with the Website.

It is intended to provide the information required by Articles 12 to 14 of Regulation (EU) 2016/679 (the “GDPR”), the Cyprus Law Providing for the Protection of Natural Persons concerning the Processing of Personal Data and for the Free Movement of such Data of 2018 (Law 125(I)/2018), and, where relevant, the Regulation of Electronic Communications and Postal Services Law of 2004 (Law 112(I)/2004), as amended.

This Policy concerns the public Website only. 

2. Who is the controller and how to contact us

The controller is:

INVESTUDIO LTD, a private company limited by shares incorporated in the Republic of Cyprus, registration number HE 362494

Registered office: 18 Efskiou Pefki, 3110 Limassol, Cyprus

Contact for data protection matters and general enquiries: office@investud.io

Telephone: +357 25 030 252

References to a data protection contact mean the address above. They do not state or imply that a Data Protection Officer within the meaning of Article 37 GDPR has been appointed, unless the Website expressly identifies one.

3. Personal data we collect and where it comes from

Depending on how you interact with the Website, we may collect:

• identity and contact data — name, surname, email address and telephone number;
• professional and relationship data — organisation, the nature of your enquiry, correspondence and meeting notes;
• technical and usage data — IP address, device and browser information, requested URLs, timestamps, referring pages, diagnostic data and security logs;
• audience measurement data — the address of the page visited and the time spent on it, together with the fact that a contact form was submitted, recorded without any identifier (see section 6);
• cookie preference data — the choice you make in the consent banner, as described in our Cookie Policy;
• bot-protection data — technical data about your browser and connection, processed by our bot-protection provider to distinguish human visitors from automated traffic (see section 8);
• any other personal data you voluntarily include in a message.

We obtain personal data:

• directly from you;
• automatically from your browser or device;
• from service providers acting on our behalf;
• in a business context, from the organisation you represent or from a person who referred you to us;
• from publicly accessible professional sources, namely professional networking platforms, public company registers, organisations’ own websites and industry directories, where it is reasonable and lawful to use them.

Do not send sensitive information through the contact forms. They are not intended for account credentials, payment-card data, government identifiers, detailed financial records, health information or other special categories of personal data within the meaning of Article 9 GDPR. If such information is received unintentionally, we will restrict or delete it unless its retention and use are lawfully necessary.

4. Why we use personal data, on what legal basis, and for how long

5. When information is required

Fields marked as required on a contact form are necessary for us to receive and respond to your enquiry. If you do not provide them, we may be unable to respond or to take the pre-contractual steps you request.

Everything else is optional. Refusing optional processing does not prevent access to any content of the Website.

6. Audience measurement

We use self-hosted analytics software running on our own server to understand in aggregate how the Website is used.

It is configured in its most privacy-protective mode. In this mode it:

• does not store any cookie or other information on your device;
• does not read information already stored on your device;
• does not create a unique identifier for you;
• does not perform device or browser fingerprinting;
• does not track you across other websites;
• does not send any data to a third party.

What is recorded is the address of the page, the time spent on it, and whether a contact form was submitted. Because no information is stored on or read from your device, section 99(5) of Law 112(I)/2004 and Article 5(3) of Directive 2002/58/EC do not apply, and no consent is required under those provisions. Your IP address is nevertheless received by our server in the ordinary course of the request, so the processing relies on Article 6(1)(f) GDPR.

Records are deleted automatically after 12 months.

You may object at any time on grounds relating to your particular situation, by contacting us at office@investud.io. See section 13. The software also honours the “Do Not Track” and Global Privacy Control signals sent by browsers; where such a signal is present, no measurement takes place.

7. Cookies and similar technologies

The Website uses only technically necessary storage, to remember the choice you make in the consent banner. We do not use analytics cookies, advertising or retargeting technologies, social-media plug-ins, embedded third-party content, or any other technology that stores or reads information on your device for a non-essential purpose.

Full details are in our Cookie Policy. Where this Policy and the Cookie Policy differ on cookies and similar technologies, the Cookie Policy prevails.

8. Bot protection

Our contact forms are protected by Cloudflare Turnstile, a bot-detection service provided by Cloudflare, Inc.

What it does. When a page loads, a small script from Cloudflare runs in your browser and assesses whether the traffic is likely to be automated. In some cases you are asked to tick a confirmation box; in most cases the check completes without any interaction.

What is processed. Cloudflare receives your IP address together with technical characteristics of your browser and connection, and the identifier of the widget on our site. It does not receive the form content, and we do not receive or store the technical data Cloudflare uses for the assessment.

No storage on your device. Turnstile is configured without the “pre-clearance” feature, which is the only mode in which it would set a cookie. We have verified by direct browser inspection that no cookie is set and nothing is written to local or session storage. Section 99(5) of Law 112(I)/2004 and Article 5(3) of Directive 2002/58/EC therefore do not apply, and no consent is required under those provisions.

Where it runs. The Turnstile widget itself is displayed only on the pages of the Website that contain a contact form. The underlying script, however, loads on all pages, including pages that contain no form, and establishes a connection to Cloudflare on each of them. This is a limitation of the form software, which cannot determine in advance which page will render a form. On a page without a form the service performs no function beyond establishing that connection. We keep this under review.

Legal basis. Legitimate interests (Article 6(1)(f) GDPR) — preventing automated abuse of our contact forms and protecting our systems. Automated submissions began within hours of an earlier protection mechanism being removed, so the interest is real and present. You may object on grounds relating to your particular situation; see section 13.

International transfer. See section 11.

Further information is available in Cloudflare’s privacy policy at cloudflare.com/privacypolicy and in the Turnstile privacy documentation. We provide this information ourselves and do not rely on the notice displayed within the Cloudflare widget to discharge our obligation under Article 13 GDPR.

9. Direct marketing

We do not send electronic direct marketing. We do not operate a newsletter or a mailing list, and we do not use the Website to build marketing audiences.

If this changes, we will update this Policy before any marketing begins, and we will apply the following standards:

• Consent is the rule. Under section 106 of Law 112(I)/2004, electronic mail, SMS and automated calling may be used for direct marketing only with the prior consent of the recipient. We would request consent separately, by clear affirmative action, and would not infer it from your submitting an enquiry or giving us an email address.
• Business contacts are protected too. In Cyprus, protection against unsolicited direct-marketing communications has been extended to legal persons by Order 34/2005 issued under Law 112(I)/2004. We would apply the same standard to business contacts as to individuals.
• The existing-customer exception is narrow. We would rely on it only where INVESTUDIO LTD obtained your contact details in the context of a sale of a service to you, the marketing relates to our own similar services, and you were given a free and simple means of objecting both when your details were collected and in every subsequent message.
• Every message would identify us clearly, would not conceal or disguise the identity of the sender, and would carry a valid address for a free-of-charge request to stop.

We do not upload contact details to social-media or advertising platforms for customer-list targeting.

10. Recipients of personal data

We disclose personal data only where necessary and proportionate.

Two external recipients are used in connection with the Website: our hosting provider and our bot-protection provider. No analytics, advertising, consent-management, content-delivery, form-processing or other third-party service receives personal data collected through the Website. Both recipients are identified in Annex 1.

In addition, personal data may be accessible to:

• our personnel and contractors who need it for the stated purpose and are subject to appropriate confidentiality and data-protection obligations;
• professional advisers, auditors, insurers, financing sources and prospective parties to a genuine corporate transaction, subject to appropriate safeguards;
• courts, regulators, law-enforcement bodies and other authorities where disclosure is required or legally justified.

Service providers that process personal data only on our documented instructions are bound by data processing terms meeting Article 28 GDPR.

We are not a joint controller with any third party in respect of the Website, and no processing described in this Policy is carried out under a joint controller arrangement within the meaning of Article 26 GDPR.

11. International transfers

Personal data that you submit to us through the Website — your name, contact details and the content of your message — is processed within the European Economic Area and is not transferred outside it. The Website and its database are hosted in Germany.

One transfer to a third country does take place, and only for bot protection:

Cloudflare, Inc. (United States). As described in section 8, the bot-protection service processes your IP address and your browser’s technical characteristics. Cloudflare, Inc. is an active participant in the EU–U.S. Data Privacy Framework, certified for both HR and non-HR data, and we rely on Commission Implementing Decision (EU) 2023/1795 as the transfer mechanism. In addition, the Cloudflare Customer Data Processing Addendum incorporates the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, which apply if the adequacy decision ceases to be available.

We verify the currency of Cloudflare’s certification on the official Data Privacy Framework list and retain dated evidence of that verification. You may request a copy of the applicable safeguard, subject to lawful redactions.

No other transfer takes place. In particular, we do not use analytics, advertising, content-delivery, font or embedded-content services located outside the EEA.

If this position changes, we will update this Policy and Annex 1 before the transfer begins.

12. Security

We use risk-based technical and organisational measures designed to protect personal data, including HTTPS for all connections, access controls, least-privilege practices, system hardening and patching, a web application firewall, activity logging, backups, confidentiality obligations and incident-response procedures, as appropriate to the risk.

Backups. Complete backups of the Website, comprising both files and the database, are taken each day automatically and are overwritten on a rolling cycle, so that no automatic backup is older than approximately two weeks. Additional backups are taken manually at selected points and are retained for six months. Backups are held separately from the live Website files, within the European Economic Area, at our hosting provider’s facilities in Germany, and are subject to the same access controls and confidentiality obligations. No backup is transferred outside the European Economic Area. Where we erase personal data at your request, the data may persist in a backup until that backup is overwritten or expires in the ordinary course; during that period it is not used for any purpose other than restoring the Website after a failure.

We maintain procedures for detecting, investigating and reporting personal data breaches, including notification to the Commissioner for Personal Data Protection under Article 33 GDPR and, where the breach is likely to result in a high risk to your rights and freedoms, notification to you under Article 34 GDPR.

No internet transmission or storage system can be guaranteed to be completely secure.

13. Your rights

Subject to the conditions and limitations in the GDPR, you may have the right to:

• obtain confirmation whether we process your personal data and request access to it, including the identities of the recipients to whom it has been or will be disclosed;
• request correction of inaccurate or incomplete personal data;
• request erasure of personal data;
• request restriction of processing;
• receive personal data you provided in a structured, commonly used and machine-readable format and transmit it to another controller, where the right to data portability applies;
• object to processing based on legitimate interests;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• lodge a complaint with a supervisory authority, in particular in the EEA country of your habitual residence, place of work or the place of the alleged infringement; and
• seek an effective judicial remedy under Articles 78 and 79 GDPR.

Right to object. Where processing is based on our legitimate interests, you may object on grounds relating to your particular situation; we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing is needed for the establishment, exercise or defence of legal claims. On request, we will provide a summary of the balancing assessment we carried out. You have an unconditional right to object to processing for direct marketing purposes; we do not currently carry out any such processing.

To exercise a right, contact office@investud.io. We may request information reasonably necessary to verify your identity and to clarify your request.

We normally respond within one month. That period may be extended by up to two further months where the request is complex or where we have received many requests from you; we will inform you of any extension and the reasons for it within one month.

Requests are free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee or refuse to act, and we will explain our reasons and your right to complain.

14. Complaint to the Cyprus supervisory authority

You may complain to the Office of the Commissioner for Personal Data Protection:

• Office address: Kypranoros 15, 1061 Nicosia, Cyprus
• Postal address: P.O. Box 23378, 1682 Nicosia, Cyprus
• Email: commissioner@dataprotection.gov.cy
• Telephone: +357 22 818456
• Website: www.dataprotection.gov.cy

You may contact us first so that we can try to resolve the issue, but doing so is not a condition of lodging a complaint.

15. Automated decision-making and artificial intelligence

The public Website does not make decisions about visitors based solely on automated processing that produces legal effects concerning them or similarly significantly affects them within the meaning of Article 22 GDPR.

The audience measurement described in section 6 records aggregate page-level information only and is not used to make decisions about individuals.

16. Children

The Website and the services promoted through it are directed to adults. We do not knowingly solicit personal data from persons under 18 through the Website.

Where Article 8 GDPR applies to an information society service offered directly to a child based on consent, the age below which parental authorisation is required in Cyprus is 14 years, in accordance with section 11 of Law 125(I)/2018.

If we become aware that we hold personal data of a person below the applicable age without a valid legal basis or the required authorisation, we will delete or restrict that data without undue delay.

17. Third-party links

The Website links to third-party websites, including our profiles on professional and social networks. These are ordinary hyperlinks: nothing is loaded from those services while you are on our pages, and no data is sent to them unless you choose to follow the link.

Once you follow a link, the third party processes your personal data as an independent controller under its own notice. A link does not extend this Policy to the third party.

18. Changes to this Policy and version history

We may update this Policy to reflect legal, technical or business changes. The updated version will show a new version number and effective date.

Where a change is material, we will provide appropriate additional notice and, where required, obtain fresh consent before the changed processing begins.

Previous versions are available on request from office@investud.io.

Annex 1 — Recipients and international transfers

As at 01/09/2026. This Annex forms part of this Policy and is reviewed at least every 6 months and after any material change to the Website.

Not used. The Website does not use: third-party analytics services; advertising, retargeting or conversion-measurement services; externally hosted web fonts; embedded video, map or social-media content; social-media plug-ins or pixels; third-party consent-management services; third-party form-processing services; or third-party email marketing services.

Documentation retained. For Cloudflare: a dated copy of the Data Privacy Framework register entry, and the Cloudflare Customer Data Processing Addendum. The certification is re-verified at least annually and before the next certification due date shown above.

Software used. The consent banner and the audience measurement described in section 6 are provided by software installed on our own server. That software does not transmit personal data of Website visitors to its developers or to any other party.