This policy explains what personal data we collect when you visit this website or contact us, why we use it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and Cypriot data protection law.
1. Who we are
This website is operated by L. Soteriou Cyprus Ltd, trading as Soteriou Group. L. Soteriou Cyprus Ltd is the data controller for the personal data described in this policy. Apostille Cyprus is a service operated by L. Soteriou Cyprus Ltd.
L. Soteriou Cyprus Ltd
Company registration number HE309798
4 Iakovou Patatsou Street, Shop 1, 2000 Strovolos, Nicosia, Cyprus
Email: info@soteriou.com.cy
Phone: +357 22338888
2. What data we process, why, and on what legal basis
Enquiries via WhatsApp and Viber
When you choose to message us on WhatsApp or Viber, we receive your phone number, your profile name and the messages and files you send. We use them to answer your enquiry and, if you go ahead, to provide the product or service you asked for. Legal basis: steps taken at your request before entering into a contract, and performance of a contract (Art. 6(1)(b) GDPR). WhatsApp (Meta) and Viber (Rakuten Viber) process the conversation as independent controllers under their own privacy policies.
Phone calls
When you call us, we see your phone number and anything you tell us during the call. We use it only to deal with your enquiry. Legal basis: Art. 6(1)(b) GDPR.
Email enquiries
When you email us, we receive your name, email address and whatever you include in your message. We use them only to reply and to handle your request. Legal basis: Art. 6(1)(b) GDPR. We do not use these details for marketing.
Documents for apostille, certification and sworn translation
If you use our Apostille Cyprus service, you send us documents (for example certificates, diplomas or court documents) that may contain personal data about you or others, including identity details. We use them only to obtain the apostille, certification or sworn translation you asked for, and we pass them to sworn translators and competent authorities only as needed for that service. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with our legal obligations, such as accounting and record-keeping (Art. 6(1)(c) GDPR).
Purchases and payments
If you buy from us, we keep the details needed to deliver, invoice and support your purchase (Art. 6(1)(b)) and to meet tax and accounting obligations (Art. 6(1)(c)). Online payments are processed by Revolut on its own secure page; we never see your full card details.
Analytics and marketing cookies, only with your consent
If you allow it, we use Google Analytics 4 to understand how visitors use the site, and Google Ads and Meta Pixel to measure whether our ads lead to enquiries (for example when you tap a WhatsApp, Viber, call or email button) and to show our ads to people who have visited the site. Google Tag Manager is used to load some of these tools. These tools use cookies and similar technologies and process online identifiers, your IP address and device and browser information. We never send your name, phone number or message content to them. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via . Nothing is loaded unless you agree. See our Cookie Policy for details.
Hosting and server logs
Our website is hosted by Vercel. When you visit, Vercel's servers automatically process technical data such as your IP address, the page requested, date and time, and browser type, to deliver the site and keep it secure. Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).
3. Who receives your data
We share personal data only where needed for the purposes above, with:
- Vercel Inc.: website hosting and server logs (processor).
- Google (Google Ireland Ltd / Google LLC): Google Analytics, Google Ads and Google Tag Manager, only with your consent.
- Meta (Meta Platforms Ireland Ltd): Meta Pixel, only with your consent; and WhatsApp, when you choose to message us there.
- Rakuten Viber: when you choose to message us on Viber.
- Revolut: when you pay online.
- Sworn translators and competent authorities: when needed to provide an apostille, certification or translation you asked for.
- Our accountants, auditors, legal advisers and public authorities, where the law requires it.
We do not sell your personal data.
4. Transfers outside the EU
Some of these providers (for example Google, Meta and Vercel) may process data in the United States. Such transfers rely on the EU-US Data Privacy Framework, where the provider is certified, and/or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed.
5. How long we keep your data
- Enquiries (WhatsApp, Viber, phone, email) that don't lead to a purchase: 2 years after our last contact.
- Customer records, invoices and orders: 6 years, as required by Cypriot tax and accounting law.
- Documents sent for apostille, certification or translation: 2 years after the service is completed, unless the law requires longer.
- Analytics data: according to our Google Analytics data-retention setting (14 months).
- Cookies: see the durations in our Cookie Policy.
6. Your rights
You have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use your data;
- object to processing based on our legitimate interests;
- receive your data in a portable format (data portability);
- withdraw your consent at any time. For cookies, use Cookie settings. Withdrawing doesn't affect processing that happened before.
To exercise any of these rights, email info@soteriou.com.cy. We will reply within one month. We may need to confirm your identity first.
You also have the right to complain to the Commissioner for Personal Data Protection of Cyprus: www.dataprotection.gov.cy.
7. Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.
8. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. If we make significant changes to how we use cookies, we will ask for your consent again.