Privacy Policy
How we handle personal data on this website
This policy explains what personal information the Karaiskakio Research Institute collects when you use this website, what we do with it, who it is shared with, and the choices and rights you have under the EU General Data Protection Regulation.
Last updated: 21 September 2026
Draft — for review before publishing
This text has been prepared for the institute to review. Items marked in square brackets still need the client's own details, and the wording should be checked by the institute's legal adviser or data protection officer before the page goes live.
01Who we are
The Karaiskakio Research Institute (KRI) is the research and translational research arm of the Karaiskakio Foundation in Nicosia, Cyprus. For the purposes of data protection law, the data controller for information submitted through this website is [COMPANY LEGAL NAME], [REGISTRATION NUMBER], of [REGISTERED ADDRESS].
The institute can be reached at Nicandrou Papamina Avenue, 15, Strovolos, Nicosia, 2032, Cyprus, on +357 22 772 700, or by email at info@cshm.ac.cy.
We have not appointed a Data Protection Officer. Privacy questions are handled by [PRIVACY CONTACT NAME / ROLE] at [PRIVACY CONTACT EMAIL].
This website is currently served from a temporary hosting address (cshm.lovable.app) while the institute's final domain is being arranged. The same policy applies whichever address you reach us on.
02Contacting us about privacy
If you have any question about how we handle your personal data, want to exercise one of your rights, or would like this policy in another format, write to [PRIVACY CONTACT EMAIL] or post to us at the address above marked "Data Protection Request". We aim to reply within one month, as the GDPR requires.
03What we collect
We collect only what we need for the purpose you have asked for. Nothing on this website tracks you across other sites, and we do not run advertising.
Website enquiry form
When you submit the enquiry form on the Contact page we receive the information you type into it: the type of enquiry, your name, email address, organisation, telephone number, subject and message. Your message is delivered by email to the institute's enquiries team; it is not written to a website database.
The form also carries a hidden field that visitors should never fill in, used only to discard automated submissions, and a record of the time your enquiry arrived. Technical information (such as your IP address) is used briefly to stop a single connection from flooding the form with repeated submissions.
Browsing this website
The hosting platform keeps standard technical logs so the site can be delivered and kept secure — typically the page requested, a timestamp, a browser identifier and an IP address. These logs are not used to build a profile of you and are not combined with anything you submit through the form.
What we do not collect
We do not ask for, and you should not send, special category data (health, genetic, biometric, religious or similar information) through this website. The enquiry form is not a channel for patient or research-subject data, and the footer "Research news & opportunities" field is not yet connected to a mailing system — anything typed there is neither stored nor sent anywhere.
04How we use it and our lawful basis
We use the information above for the following purposes:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Answering an enquiry and, where relevant, opening or maintaining a research, collaboration or recruitment conversation | Enquiry form content | Art. 6(1)(a) — your consent; and Art. 6(1)(b) — steps at your request before entering an agreement |
| Keeping the enquiry form working and free from automated abuse | Technical request data | Art. 6(1)(f) — legitimate interest in secure operation |
| Delivering and securing the website itself | Hosting technical logs | Art. 6(1)(f) — legitimate interest in secure operation |
Consent for the enquiry form is given through the unticked checkbox before submission and can be withdrawn at any time by writing to us — although withdrawing consent does not affect processing that has already taken place.
06Transfers outside the EU
We aim to keep processing inside the European Economic Area. Some providers operate outside it — for example email delivery and parts of the hosting platform — and where they do, transfers rely on the European Commission's adequacy decisions or Standard Contractual Clauses. [CONFIRM THE CURRENT PROCESSORS AND THEIR TRANSFER MECHANISMS] before publishing.
07How long we keep it
Enquiries are kept in the mailboxes of the team handling them for as long as needed to answer and to follow up, and then deleted along with the mailbox backups. Our current target is [e.g. 24 months] from the last meaningful contact; the final figure should be confirmed by the institute. Hosting technical logs are held for [e.g. 30 days]. Your cookie choice stays on your own device for six months and is simply forgotten afterwards, so we ask again.
08How we protect it
- The site is served over HTTPS, so traffic is encrypted in transit.
- Secrets and service credentials are held in an encrypted secret store on the server and are never placed in website code.
- Every database table is protected by row-level security and is not publicly writable; the enquiry form writes no rows at all.
- Submissions are validated on the server, rate-limited per connection and screened with a hidden field to reduce spam and automated abuse.
- The database is backed up daily and backups are access-restricted.
No method of transmission or storage is completely secure. If you have reason to believe your interaction with us is no longer secure, tell us using the contact details above.
09Your rights
Where the GDPR applies, you can ask us for any of the following, free of charge:
- Access — a copy of the personal data we hold about you.
- Rectification — correction of anything inaccurate.
- Erasure — deletion of your data where we have no overriding reason to keep it.
- Restriction — pausing our use of your data in defined circumstances.
- Objection — asking us to stop processing based on our legitimate interests.
- Portability — your data in a structured, machine-readable format where processing is automated and based on consent or a contract.
- Withdrawal of consent — at any time, without affecting what has already happened.
We may need to confirm your identity before acting on a request, and we will tell you if an exemption applies.
10Making a complaint
If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Cyprus data protection authority, the Commissioner for Protection of Private Data (https://www.dataprotection.gov.cy), or to the authority in your country of residence.
11Children
This website is written for a professional and academic audience and is not directed at children. We do not knowingly collect personal data from anyone under 16; if you believe a child has sent us information, write to us and we will delete it.
12Changes to this policy
We may update this page as the institute's systems or obligations change. The date at the top of the page shows when it was last revised; material changes will be highlighted where it makes sense to do so.