MINISTRY OF ENERGY, COMMERCE AND INDUSTRY
PERSONAL DATA PROTECTION POLICY
(“PRIVACY POLICY”)
This Privacy Policy governs the processing of your personal data by the Administration of the Ministry of Energy, Commerce and Industry (“the Ministry”).
The Ministry collects and processes personal data in accordance with the provisions of the EU General Data Protection Regulation (“GDPR”) and the Protection of Natural Persons Against the Processing of Personal Data and the Free Movement of such Data Law of the Republic of Cyprus (Law 125 (I)/2018).
- Purpose of personal data processing
The Ministry processes personal data for specified, explicit and legitimate purposes and no further processing is carried out in a manner incompatible with these purposes. The personal data processed are limited to the necessary purposes for which they are processed. The Ministry takes the necessary actions, so that the data is correct and, where deemed necessary, updated.
Data processing is only permitted in the following cases:
i. With the consent of the data subject in the case where the Ministry is not acting in its official capacity as a Public Authority, in which it exercises public authority, or
ii. To comply with the Ministry’s legal obligation, or
iii. To fulfill a duty performed in the public interest or in the exercise of a public authority delegated to the controller, or
iv. For the implementation of a contract to which the data subject is a party or to take measures at the request of the data subject, prior to the conclusion of a contract, at the request of the data subject.
The Administration of the Ministry collects and processes personal data in the following cases:
A. Collection, processing, and storage of personal data for the purpose of operating the PSC Cyprus portal
We inform you that the personal data provided will remain confidential, at all times, during the period for which the personal data will be stored; as long as your profile is maintained at the PSC Cyprus.
The personal data collected will be processed for:
- monitoring and maintenance of the personal profile;
- communication, when necessary, with the registered user via email, telephone or post;
- sending notifications to your personal account;
- sending our “Newsletter”;
- record keeping and statistical purposes.
B. Collection, processing, and storage of personal data for the purpose of managing applications related to the registration of domestic and foreign companies in the “Register of Foreign Interest Companies”
The processing is done for the purposes of managing requests related to the facilitation of entities – included in the strategy – in the administrative procedures of the state, primarily the facilitation of the employment of specialized personnel from third countries in the context of the national “Strategy for attracting foreign businesses and talent”.
Subjects may contact the Business Facilitation Unit in accordance with the following two decisions of the Council of Ministers (CoM):
- CoM Resolution no. : 92.018 (dated. 15/10/2021): “Action Plan for Attracting Companies to Activate and/or Expand their Activities in Cyprus”∙
- CoM Resolution no.: 92.369 (dated. 21/12/2021): “Strategy for Attracting Businesses and Talent in Cyprus – Evolution of the Fast-Track Business Activation Mechanism into a Business Facilitation Unit”.
The personal data that are normally collected from the interested parties who submit a request for inclusion in the register of the Business Facilitation Unit are identification and contact information, as well as status.
In particular, the personal data collected and processed are:
- name and passport number of the beneficial owner for identification purposes,
- e-mail address and contact telephone number of the applicant or the applicant’s representative for communication purposes, and
- the nationality of the beneficial owner for the purposes of verifying the percentage of foreign ownership and evaluating the eligibility of the company/organization, for inclusion in the government strategy in the cases where applicable.
- Transmission of personal data
Except in the above cases, the Ministry does not transmit personal data to a third country or international organization.
It is understood that the Processor has an obligation to notify the recipients of any change in personal data, pursuant to Article 19 of the General Data Protection Regulation (GDPR).
- Period of storage of personal data
The Ministry maintains the personal data it collects, based on the State Archive Law of 1991 (Law 208/1991).
- Rights of data subjects
The GDPR defines the rights of subjects in relation to their personal data as follows:
Right of access
You have the right to submit a request for access to your personal data and to be informed about its processing, as well as to request a copy of it.
Right of rectification
You have the right to request correction or completion of your personal data.
Right to be informed when consent is obtained
In cases where your consent is needed for the processing of your data, the Ministry clearly states how the personal data concerning you will be used.
Right to erasure or restriction of processing
You have the right to request the deletion of part or all of your personal data, if you no longer wish to process them and if there are no legitimate or legal reasons for the Ministry to continue to retain them.
Right to object
You have the right to object to the processing of your personal data and then their processing stops, unless there are compelling and legitimate reasons for processing them, which override your interests, rights and freedoms or the Ministry has an overriding legitimate interest.
Right to withdraw consent
In cases where the processing of your personal data is based on your consent, you have the right to withdraw it at any time.
It is understood that the withdrawal of consent may not allow the Ministry to process your request in order to provide you with specific services/grants/approvals. If this is the case, the Department will inform you before taking effect to withdraw your consent.
It is understood that the withdrawal of consent does not affect the legality of the processing that was based before its withdrawal.
- Consequences of not providing personal data
If you do not provide your personal data or if you exercise your right to erasure or to limit processing or to object to processing or to withdraw your consent, the Ministry may not be able to process your request.
- Changes to the Privacy Policy
The Ministry reserves the right to modify the content of this Privacy Policy from time to time, at its discretion. Please stay updated on the Ministry’s page for new information about our policy practices, so that you are always aware of how we process and protect your personal data.
- Right to file a complaint
In the event that you consider that your personal data is being processed unlawfully, or in the event that any request you make in relation to your personal data is not answered (on time) or you are not satisfied with the answer, you have the right to submit a complaint to the Office of the Commissioner for Personal Data Protection.
- Communication with the Personal Data Officer
The Ministry of Energy, Trade and Industry (Administration), in accordance with Regulation (EU) 2016/679, has appointed a Data Protection Officer (DPO), and data subjects may contact him, for issues related to the processing of personal data their data and by exercising their rights, in accordance with Regulation (EU) 2016/679.
Personal Data Protection Officer of the Ministry of Energy, Commerce and Industry (Administration):
Claire Kourtella, Senior Administrative Officer,
Email: ckourtella@papd.mof.gov.cy,
Telephone: +357 22 867280