Who is responsible
Maximilian Gerhardt & Co. Ltd is responsible for this website and the processing described here. Our registered office is Arsinois 12B, 8881 Agia Marina Chrysochous, Paphos, Cyprus. Contact us at maximiliangerhardt.com@gmail.com.
ImprintYour registration and profile
When you submit the reviewed form, we store your first and last name, email address, language, interest, situation in Cyprus, area or “not sure”, selected starting page and any activity context. If you choose the business or expert path, we also store the selected role, field and any business name, languages, description or website you provide. We record your email choice, the notice version, submission time and request reference. Draft answers stay in the open page until you submit. Your optional profile is not published automatically. Required answers let us handle your registration; without them we cannot accept it. Profile details and the email series are optional. Please do not include sensitive personal information.
Why we use these details
We handle your voluntary early-access request, prepare any profile review you request and send a receipt acknowledgement. Our basis is our legitimate interest in responding to your request and organising early access, under Article 6(1)(f) GDPR. The acknowledgement is a service message, not enrolment in a marketing sequence. We also use limited technical data to protect the service from abuse and prevent duplicate submissions, based on the same provision. We use information needed to answer data-rights requests to comply with our legal obligations under Article 6(1)(c).
Four optional island letters
If you separately choose our emails, we send a confirmation request. Your consent under Article 6(1)(a) GDPR becomes confirmed only when you actively confirm your address; the link expires after 48 hours. We then send a series of four CYPRUSLIV letters about finding your people and your way into island life, normally on days 0, 2, 5 and 9 after confirmation. Your answers and language help us choose relevant content. There is no automatic continuing newsletter after this series. You can register without it and unsubscribe at any time through the email link, without signing in, or by contacting us. Withdrawal does not affect earlier lawful processing or cancel your early-access registration. We keep the choice, wording version and confirmation/withdrawal events so we can respect and demonstrate your decision.
Hosting, storage and email providers
Vercel Inc. hosts the website and its server functions. Supabase Pte. Ltd provides our registration database in Frankfurt, Germany. Resend (Plus Five Five, Inc.) sends acknowledgement, confirmation and subscribed emails from its Ireland sending region. For delivery, Resend receives your address, necessary personalisation, the message and delivery metadata. These providers use subprocessors for their services. Resend also uses sampled messages for automated abuse prevention. We do not export your profile to advertising platforms. Google Analytics, Meta Pixel and optional advertising trackers are not active. Email open and click tracking are disabled.
Processing outside the European Economic Area
Frankfurt database hosting and Irish email sending do not mean all processing stays in the EU. Resend stores message content, delivery logs, webhook information and account data in the United States. Vercel and Supabase also have international operations and subprocessors, including access outside the EEA. Their data-processing terms include the European Commission’s Standard Contractual Clauses for relevant transfers. An applicable adequacy decision, including the EU–US Data Privacy Framework for an actively certified recipient and covered data, may also support a transfer. You can ask us for information about the applicable safeguards and a copy. Our providers’ current terms and subprocessor lists are linked below.
How long we keep information
We delete your early-access contact, profile and permission record no later than 365 days after your latest submission or confirmation, unless you ask for deletion sooner. An unconfirmed email choice never starts the series. Delivery-job and attempt metadata remain with the contact within the same 365-day limit to prevent repeated sends; no rendered email body is stored in our database. Provider-event deduplication records are removed after 30 days and abuse-prevention address hashes after 24 hours. A deletion leaves a random request-reference record for 30 days to prevent a retry from recreating the erased entry; it contains no contact or profile details. Unsubscribing stops further series emails; the permission record remains within the same 365-day limit to respect your choice. Resend states that email and log data are retained for 30 days on its standard Free, Pro and Scale plans, with backups for 7 days; other security and legal records follow its separately stated purposes. Hosting logs and infrastructure backups have their own provider schedules and are not erased by clearing this website’s local storage. If a legal obligation or a specific dispute requires particular records, we restrict their use to that purpose and keep them only as long as necessary.
Technical requests and local preferences
Serving this website requires technical requests, including an IP address, request time, path and browser information. Hosting providers process these to deliver and secure the service. Our application stores a keyed hash, rather than the raw IP address, for short-lived rate limiting. Email delivery, failure, complaint and unsubscribe events help us stop unwanted or unsuccessful messages. We do not log form bodies in the application. Closing the privacy notice can save cyprusliv:privacy-notice:v1 in local browser storage with a version, time and acknowledgement. It is ignored after 180 days and removed the next time it is read. You can reset it below or in your browser. This remembers your requested preference; it is not marketing consent. Images and fonts are served with the website; external brand links open only when you choose them.
Your choices and rights
You may request access, correction, erasure, restriction or portability where the GDPR conditions apply. You may object to processing based on legitimate interests for reasons relating to your situation, and object to direct marketing at any time. You can withdraw email consent at any time. Contact the operator using the details above; we may need proportionate information to verify your identity. We normally respond within one month, informing you if the law allows an extension. You may complain to the Cyprus Commissioner for Personal Data Protection or the competent authority where you live, work or believe an infringement occurred. We do not make solely automated decisions with legal or similarly significant effects about you.
Cyprus data protection authority Contact