Privacy notice
This notice explains what we do with personal data. It is written to meet Articles 13 and 14 of Regulation (EU) 2016/679 (the GDPR) and the Cyprus Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data of 2018 (125(I)/2018).
Two different roles
Read this first, because the rest of the notice depends on it.
- We are the controller for people who visit this website, message us about our own services, or become our clients. That is the data described below.
- We are a processor for the personal data inside a system we run for a client — the enquiries and bookings made by that client’s customers. The client is the controller of it, decides what happens to it, and publishes their own privacy notice about it. We only act on their instructions, under a written data processing agreement. If you messaged a business that uses Ownerdeck, ask that business, and we will assist them in answering you.
Controller and contact
- Service
- Ownerdeck
- Operated by
- Mark Saade
- Legal form
- Sole trader
- Registered address
- Livadia, Larnaca, Cyprus
- Country
- Republic of Cyprus
- mark@ownerdeck.com
- Privacy contact
- privacy@ownerdeck.com
- Message us
- VAT
- Not registered for VAT. No VAT is charged on any fee.
We are not required to appoint a Data Protection Officer and have not appointed one. Privacy questions go to the address above.
What we collect, why, and on what basis
When you message us
Your name, phone number or email address, and the contents of your message. We use it to answer you and, if you become a client, to run the service. Legal basis: Article 6(1)(b), steps taken at your request before entering a contract, and performance of the contract afterwards.
When you use this website
Our hosting and security providers record your IP address, the pages requested, timestamps, and your browser and device type in their server logs. We use this to keep the site available and to defend it against abuse. Legal basis: Article 6(1)(f), our legitimate interest in a working, secure website. We do not run analytics, advertising or tracking of any kind on this site.
Your theme and language choice
Stored in your own browser, never sent to us. See the cookies and storage notice.
When you are a client
Business contact details, the facts about your business that the system runs on, billing records and our correspondence. Legal basis: Article 6(1)(b) for the contract, and Article 6(1)(c) for keeping accounting records as Cyprus tax law requires.
Who else processes it
We keep this list short on purpose. Each of these is a processor acting under contract, or an independent controller where noted.
- Vercel Inc. — hosting and delivery of this website. Server logs.
- Cloudflare, Inc. — DNS, caching and protection against attacks. Traffic metadata.
- Anthropic PBC — the AI model that generates assistant replies. Message content is sent for processing and is not used to train models.
- Meta Platforms Ireland Ltd. — WhatsApp Business and Instagram messaging, where a client uses those channels. Meta is an independent controller for the messaging platform itself under its own terms.
- Google Ireland Ltd. — Google Business Profile, for clients on the Reach card, and the fonts this site loads. Independent controller.
- Web3Forms — delivery of any contact form submission.
- Stripe Payments Europe Ltd. — the holding deposit, if you choose to pay one. Your card details go straight to Stripe’s own hosted checkout page and never reach this site. Stripe acts as an independent controller for the payment itself, under its own terms and privacy policy.
- Our accountant and, where legally compelled, public authorities.
We do not sell personal data, and we do not share it for anyone else’s marketing.
Data processing agreements
Because we handle conversations belonging to our clients’ customers, every client engagement is covered by a written data processing agreement under Article 28 of the GDPR before the service goes live. It records what we process, for how long, on whose instructions, which sub-processors are approved, and what happens to the data when the contract ends. Clients also need their own privacy notice covering what their customers’ messages are used for — we will tell you what our part of it says, but publishing yours is your obligation, not ours.
Transfers outside the EEA
Some of the providers above are established in, or process data in, the United States. Those transfers rely on the European Commission’s Standard Contractual Clauses, on the EU–US Data Privacy Framework where the provider is certified, and on the supplementary measures set out in each provider’s data processing terms. You can ask us for a copy of the relevant safeguards.
How long we keep it
- Enquiries that do not become clients: 12 months.
- Client records and correspondence: for the length of the contract and 6 years after, which is the period Cyprus tax law requires for accounting records.
- Server and security logs: as retained by the providers above, typically under 30 days.
- Data inside a client’s own system: for as long as that client instructs, and deleted or exported on request when their service ends.
Automated decisions
The assistant composes replies automatically, which is automated processing. It does not make decisions that produce a legal effect for you or similarly significantly affect you within the meaning of Article 22 — it answers questions and offers to hold a booking, and a person can take over at any moment.
Your rights
Under the GDPR you can ask us to:
- confirm what we hold and give you a copy of it (Article 15);
- correct anything inaccurate (Article 16);
- delete it, where we have no overriding reason to keep it (Article 17);
- restrict what we do with it while a question is resolved (Article 18);
- hand it over in a portable format (Article 20);
- stop processing based on legitimate interests, including any direct marketing, which we will stop on request without exception (Article 21).
Where we rely on consent, you can withdraw it at any time without affecting anything done before you withdrew it. Email privacy@ownerdeck.com. We answer within one month and we do not charge for it.
Complaining
If you think we have handled your data badly, tell us first — it is usually a misunderstanding we can fix the same day. You also have the right to complain to the supervisory authority:
Office of the Commissioner for Personal Data Protection, Republic of Cyprus — www.dataprotection.gov.cy. If you live in another EU country, you may complain to your own national authority instead.
Changes
If we change this notice we update the date at the top, and we tell clients directly if the change matters to them.