On this page
CYPRUSLIV

Your data. No mystery.

How we handle your early-access registration, optional emails and privacy choices.

Updated: 4 October 2026

Who is responsible

Maximilian Gerhardt & Co. Ltd is responsible for this website and the processing described here. Our registered office is Arsinois 12B, 8881 Agia Marina Chrysochous, Paphos, Cyprus. Contact us at info@cyprusliv.com.

Imprint

Your registration and profile

When you submit the reviewed form, we store your first and last name, email address, language, interest, situation in Cyprus, area or “not sure”, selected starting page and any activity context. If you choose the business or expert path, we also store the selected role, field and any business name, languages, description or website you provide. We record your email choice, the notice version, submission time and request reference. Draft answers stay in the open page until you submit. Your optional profile is not published automatically. Required answers let us handle your registration; without them we cannot accept it. Profile details and the email series are optional. Please do not include sensitive personal information.

CYPRUSLIV · Launch News

I would like ongoing CYPRUSLIV Launch News by email, including launch updates, product insights and occasional early-access invitations. Optional and unsubscribe at any time. My registration and the existing four island letters remain separate.

The basis is your separate consent (GDPR Article 6(1)(a)). We record email, language, consent notice version and request, confirmation and withdrawal times. The separate confirmation link expires after 48 hours. These ongoing Launch News end when you unsubscribe; the existing four island letters are not extended. The registration and old quiz details keep their original 365-day deadline. Separately, active Launch News retain only the address, language, consent proof and necessary delivery and suppression records; after withdrawal, the 365-day policy below generally applies to remaining records unless another legal basis applies. Your newsletter choice does not authorize advertising tracking.

Why we use these details

We handle your voluntary early-access request, prepare any profile review you request and send a receipt acknowledgement. Our basis is our legitimate interest in responding to your request and organising early access, under Article 6(1)(f) GDPR. The acknowledgement is a service message, not enrolment in a marketing sequence. We also use limited technical data to protect the service from abuse and prevent duplicate submissions, based on the same provision. We use information needed to answer data-rights requests to comply with our legal obligations under Article 6(1)(c).

Verifying an early-access email address

When the form asks you to request address verification, we send one service email for that purpose. Open its link and explicitly confirm on the page; opening the link alone changes nothing. The link expires after 48 hours. This verifies your early-access email and does not subscribe you to marketing. The optional four-letter series has its own confirmation. We store the request, notice version, token hash, generation and verification time, plus a random internal event reference to prevent duplicate processing. The internal verification record stays in our registration system. With the separate browser consent and attempt conditions below, its random event reference, confirmation status and language can be used for optional measurement; the address and verification token are not exported. Requests are limited to three verification emails per address in 24 hours, at least five minutes apart. Existing registrations receive no new verification mail unless a person explicitly submits a new request. These service and abuse-prevention records use the same request-handling basis and deletion period described here; the latest explicit verification also counts as a confirmation for the 365-day limit.

Four optional island letters

If you separately choose our emails, we send a confirmation request. Your consent under Article 6(1)(a) GDPR becomes confirmed only when you actively confirm your address; the link expires after 48 hours. We then send a series of four CYPRUSLIV letters about finding your people and your way into island life, normally on days 0, 2, 5 and 9 after confirmation. Your answers and language help us choose relevant content. There is no automatic continuing newsletter after this series. You can register without it and unsubscribe at any time through the email link, without signing in, or by contacting us. Withdrawal does not affect earlier lawful processing or cancel your early-access registration. We keep the choice, wording version and confirmation/withdrawal events so we can respect and demonstrate your decision.

Hosting, storage and email providers

Vercel Inc. hosts the website and its server functions. Supabase Pte. Ltd provides our registration database in Frankfurt, Germany. Resend (Plus Five Five, Inc.) sends acknowledgement, confirmation and subscribed emails from its Ireland sending region. For delivery, Resend receives your address, necessary personalisation, the message and delivery metadata. These providers use subprocessors for their services. Resend also uses sampled messages for automated abuse prevention. We do not export your profile to advertising platforms. Email open and click tracking are disabled.

Processing outside the European Economic Area

Frankfurt database hosting and Irish email sending do not mean all processing stays in the EU. Resend stores message content, delivery logs, webhook information and account data in the United States. Vercel and Supabase also have international operations and subprocessors, including access outside the EEA. Their data-processing terms include the European Commission’s Standard Contractual Clauses for relevant transfers. An applicable adequacy decision, including the EU–US Data Privacy Framework for an actively certified recipient and covered data, may also support a transfer. You can ask us for information about the applicable safeguards and a copy. Our providers’ current terms and subprocessor lists are linked below.

How long we keep information

We delete your early-access contact, profile and permission record no later than 365 days after your latest submission or confirmation, unless you ask for deletion sooner. An unconfirmed email choice never starts the series. Delivery-job and attempt metadata remain with the contact within the same 365-day limit to prevent repeated sends; no rendered email body is stored in our database. Provider-event deduplication records are removed after 30 days and abuse-prevention address hashes after 24 hours. A deletion leaves a random request-reference record for 30 days to prevent a retry from recreating the erased entry; it contains no contact or profile details. Unsubscribing stops further series emails; the permission record remains within the same 365-day limit to respect your choice. Resend states that email and log data are retained for 30 days on its standard Free, Pro and Scale plans, with backups for 7 days; other security and legal records follow its separately stated purposes. Hosting logs and infrastructure backups have their own provider schedules and are not erased by clearing this website’s local storage. If a legal obligation or a specific dispute requires particular records, we restrict their use to that purpose and keep them only as long as necessary.

Technical requests and local preferences

Serving this website requires technical requests, including an IP address, request time, path and browser information. Hosting providers process these to deliver and secure the service. Our application stores a keyed hash, rather than the raw IP address, for short-lived rate limiting. Email delivery, failure, complaint and unsubscribe events help us stop unwanted or unsuccessful messages. We do not log form bodies in the application. When you choose Accept all, Necessary only or Save choices, cyprusliv:consent:v1 stores the version and configuration, a random decision reference, save and expiry times, and separate choices for analytics, Google advertising and Meta advertising in local browser storage. This remembers your requested privacy settings; it contains no name, email or quiz answers. Choices expire after 180 days. Expired, invalid or differently configured records are not used. A new choice replaces the record; records from another configuration are not always deleted immediately, so an older open tab cannot erase a newer choice. There is no remote deletion while your device is offline. Reopen Privacy settings below to change your choice, or delete this website’s stored data in your browser. If saving fails, no optional service starts. These choices do not subscribe you to emails. Images and fonts are served with the website; external brand links open only when you choose them.

Optional analytics and advertising

The purposes listed below are available only at https://cyprusliv.com, and only after you save consent for each purpose. Before that, their provider scripts are not loaded. Necessary only leaves them off. Consent is voluntary under Article 6(1)(a) GDPR and covers the associated access to browser storage; refusing does not prevent registration or email verification. Availability does not mean that you have consented.

Google Analytics 4

With analytics consent, Google receives page views and deliberate quiz starts so we can understand which pages and languages help visitors. Our events include the page type, a permitted page path, page language, registration language when known, and visitor, pending or confirmed status. They may support reporting groups based on that status. The configured event and user retention is two months, with no reset on new activity; standard aggregated reports are outside that setting. The configured audience membership is 30 days. Google may use first-party _ga cookies to distinguish browsers and sessions. Its published default expiry is two years; browser limits and tag settings can shorten or change it. This is separate from our 180-day privacy choice.

Meta advertising

With Meta advertising consent, Meta Pixel receives page views, deliberate quiz starts and eligible registration events for advertising measurement and audiences. A Meta click identifier (fbclid), if present, may be made available with the cleaned page address. Meta can use browser identifiers and cookies, including _fbp and _fbc. Automatic matching with form contact details is disabled. Meta’s linked privacy and cookie information explains its own processing, storage periods and controls.

What optional measurement contains

Our event payloads contain the limited page, language and status information described above and random event references for deduplication. We do not send names, email addresses, telephone numbers, quiz answers, profile text, email-verification tokens or the stored consent decision as event fields. The confirmation token is removed from the visible address before optional scripts can start. The referring address supplied to Google is reduced to its origin, without a path or query. Provider scripts also receive technical connection and device information, such as an IP address and browser details, and can associate cookie or advertising identifiers with their own data. These data are pseudonymous, not anonymous. Depending on the provider and its applicable terms, processing can take place outside the EEA, including the United States; the linked provider information describes its safeguards and controls. When this form requests address verification, an accepted submission can send a pending event to Google Analytics 4 and Meta Pixel, with the corresponding consent. Receipt of the request is not a confirmed lead. A valid service-confirmation link can send a confirmed early-access event only after successful explicit verification, using its random event reference. The relevant consent must already exist when that confirmation attempt begins and still apply when its result arrives. A later consent choice does not backfill the event. The script-free alternative still verifies the address and sends no optional measurement. Confirming the separate island-letter subscription is not this lead event.

Measurement stored in this browser

With a saved optional choice, cyprusliv:measurement:v1 stores a random consent-decision reference, expiry, visitor/pending/confirmed status, registration language when known and up to 100 event-deduplication entries. It contains no form answers or email address. It is valid only with the corresponding consent and no longer than that choice’s remaining 180-day period. Expired or mismatched data are not used. A changed choice resets the applicable measurement state; browser data can also be cleared directly. Clearing local data does not erase data already held by a provider.

Changing or withdrawing consent

Open Privacy settings here or in the footer and select Necessary only or save individual choices. Withdrawal stops further optional measurement for the withdrawn purpose; the page reloads to discard already loaded scripts. We also remove recognised provider cookies that this site can access. This cannot remove every cookie on another domain or erase processing already performed by a provider. Withdrawal does not affect the lawfulness of earlier consent-based processing. You may contact us about your rights and use the provider controls linked below. The registration and optional email-series choices remain separate.

Your choices and rights

You may request access, correction, erasure, restriction or portability where the GDPR conditions apply. You may object to processing based on legitimate interests for reasons relating to your situation, and object to direct marketing at any time. You can withdraw email consent at any time. Contact the operator using the details above; we may need proportionate information to verify your identity. We normally respond within one month, informing you if the law allows an extension. You may complain to the Cyprus Commissioner for Personal Data Protection or the competent authority where you live, work or believe an infringement occurred. We do not make solely automated decisions with legal or similarly significant effects about you.

Cyprus data protection authority Contact