Privacy Policy
1. Introduction
1.1 This Privacy Policy sets out how Andreas Miliotis (the “Controller”, “we”, “us” or “our”) collects and processes the personal data of clients, prospective clients and visitors to the website metafrastis.com.cy (the “Website”) in connection with the provision of sworn translation, certified translation and related services (the “Services”).
1.2 This Privacy Policy is issued pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and the Protection of Natural Persons with Regard to the Processing of Personal Data and for the Free Movement of Such Data Law of 2018 (Law 125(I)/2018). The terms “personal data”, “processing”, “controller” and “processor” have the meanings given to them in the GDPR.
2. Identity and Contact Details of the Controller
2.1 The Controller is Andreas Miliotis, a sworn translator entered in the Register of Sworn Translators under the Registration and Regulation of Sworn Translators Services Law of 2019 (Law 45(I)/2019) under Register No. 149, and a graduate translator, member of PanCYUTI under membership No. M073.
2.2 Any request or enquiry concerning the processing of personal data may be addressed to the Controller by email at info@metafrastis.com.cy or by telephone at +357 97 555065 (Monday to Friday, 10:00–19:00).
3. Categories of Personal Data Processed
3.1 We process the following categories of personal data:
(a) identification and contact data, namely full name, email address and telephone number, provided when you contact us by email, telephone, WhatsApp or through the contact form on the Website;
(b) correspondence, namely the content of your communications with us, including instructions, deadlines and any information provided in connection with a quotation or order;
(c) document data, namely the documents submitted for translation and their content, which may include personal data relating to you and to third parties;
(d) record data, namely your name, email address, telephone number, translation number and invoice number, as entered in our record of translations;
(e) financial and transaction data, namely the amount and date of invoices, the method of payment and, where payment is made by bank transfer or through Revolut, the name and account details of the payer;
(f) delivery data, namely name, postal address and telephone number, where you request delivery by courier or to a parcel locker; and
(g) technical data, namely the IP address recorded when you submit the Website contact form.
3.2 Where documents submitted to us contain personal data of persons other than yourself, such as family members, we obtain such data from you. By submitting such documents, you confirm that you are entitled to disclose such data to us for the purposes of the Services.
4. Purposes and Legal Bases of Processing
4.1 We process personal data solely for the following purposes and on the following legal bases under Article 6(1) GDPR:
| Purpose of processing | Legal basis |
|---|---|
| Responding to enquiries and issuing quotations | Article 6(1)(b): steps taken at your request prior to entering into a contract |
| Performance of the Services, including the translation, certification and delivery of documents | Article 6(1)(b): performance of a contract |
| Maintenance of the record of translations required under section 12(4)(b) of Law 45(I)/2019 | Article 6(1)(c): compliance with a legal obligation |
| Issue and retention of invoices and payment receipts, as required under section 19(3) of Law 45(I)/2019 and tax legislation | Article 6(1)(c): compliance with a legal obligation |
| Notification of the competent authorities where a document is found to be forged or altered, or where an unlawful act comes to our attention, under section 12(4)(c) of Law 45(I)/2019 | Article 6(1)(c): compliance with a legal obligation |
| Communication with you concerning corrections, additional copies or enquiries relating to completed translations | Article 6(1)(f): our legitimate interest in the proper administration of client matters |
| Security of the Website and prevention of abusive form submissions | Article 6(1)(f): our legitimate interest in the security of the Website |
| Establishment, exercise or defence of legal claims | Article 6(1)(f): our legitimate interest in protecting our legal position |
4.2 The provision of the personal data referred to in paragraphs 3.1(a) to (d) is necessary for entering into and performing a contract with you. Failure to provide such data will prevent us from providing the Services.
4.3 We do not use personal data for direct marketing purposes, we do not sell personal data, and we do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.
5. Special Categories of Personal Data and Data Relating to Criminal Convictions
5.1 Documents submitted for translation may contain special categories of personal data within the meaning of Article 9(1) GDPR, such as data concerning health, or personal data relating to criminal convictions and offences within the meaning of Article 10 GDPR, such as criminal record certificates.
5.2 We process special categories of personal data solely for the purpose of translating and certifying the document concerned, on the basis of your explicit consent pursuant to Article 9(2)(a) GDPR, given upon acceptance of our quotation. You may withdraw your consent at any time. Withdrawal shall not affect the lawfulness of processing carried out prior thereto, but shall preclude us from continuing work on the document concerned.
5.3 We process personal data relating to criminal convictions and offences solely at your request and for the purpose of translating and certifying the document concerned, in our capacity as a sworn translator under Law 45(I)/2019, in accordance with Article 10 GDPR.
6. Recipients of Personal Data
6.1 We do not disclose personal data to third parties, save as set out in this Section 6 and only to the extent necessary for the purpose concerned.
6.2 The following recipients receive personal data in the ordinary course of the Services:
(a) Enartia Single Member S.A. (trading as Papaki), Greece, which provides the hosting of the Website and our email service at info@metafrastis.com.cy and acts as our processor; and
(b) our external Accounting Firm, which receives our invoices, including the name of the client stated therein, for the purposes of bookkeeping and compliance with tax legislation.
6.3 You are free to choose the channel through which you communicate with us, the method by which you pay and the method by which documents are delivered to you. Where you choose one of the channels or methods listed below, the personal data concerned are necessarily disclosed to its provider. Where you do not choose it, no personal data are disclosed to that provider:
(a) Microsoft, where you choose to communicate with us or to send documents to our Outlook.com address (andreasmiliotis@outlook.com), in which case Microsoft processes such data in accordance with its own terms and privacy statement;
(b) WhatsApp, where you choose to communicate with us or to send documents through WhatsApp, in which case WhatsApp processes such data in accordance with its own terms and privacy policy;
(c) Bank of Cyprus, Eurobank or Revolut, where you choose to pay by bank transfer or through Revolut, in which case the bank or payment institution concerned receives the payment details. Payments in cash involve no such disclosure; and
(d) ACS Courier, Box Now, Akis Express, DHL, Cyprus Post, and/or any other Courier/Delivery Service where you choose delivery of documents by courier or to a parcel locker, in which case the service provider concerned receives your name, delivery address and telephone number.
6.4 Personal data may further be disclosed where required by law, namely:
(a) to the Council of Registration of Sworn Translators, in the context of quality controls or complaints under sections 16 and 22 of Law 45(I)/2019;
(b) to the police, the courts or other competent public authorities, where required under section 12(4)(c) of Law 45(I)/2019 or any other applicable law; and
(c) to the Tax Department, upon request, in accordance with tax legislation.
7. Transfers of Personal Data outside the European Economic Area
7.1 Documents, translations and records are stored exclusively on our own devices in the Republic of Cyprus. The hosting of the Website and our email service at info@metafrastis.com.cy are provided from data centres within the European Union.
7.2 Where you choose to communicate with us through Outlook.com or WhatsApp, Microsoft and WhatsApp may process personal data outside the European Economic Area, including in the United States of America. Any such transfer is carried out either on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU–US Data Privacy Framework, in respect of certified organisations, pursuant to Article 45 GDPR, or subject to the standard contractual clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR. Further information on these safeguards may be obtained from us upon request.
8. Retention of Personal Data
8.1 In accordance with Article 5(1)(e) GDPR, we retain personal data only for as long as is necessary for the purposes for which they are processed or as required by law, as follows:
| Category of data | Retention period | Ground |
|---|---|---|
| Record of translations | For the duration of our practice as a sworn translator | Section 12(4)(b) of Law 45(I)/2019, which prescribes no time limit |
| Invoices, payment receipts and accounting records | Six (6) years from the end of the tax year to which they relate | Tax legislation |
| Copies of documents, translations and related correspondence | Six (6) years from delivery of the translation | Limitation period for contractual claims under the Limitation of Actions Law of 2012 (Law 66(I)/2012) |
| Website contact form submissions, attached files and IP addresses | Two (2) months from submission, after which they are automatically deleted from the Website server | Data minimisation; any documents forwarded to us are thereafter retained as set out above |
| Enquiries not resulting in an order | Twelve (12) months from our last communication | Handling of follow-up enquiries |
8.2 We do not retain original documents. Original documents are returned to you in all cases.
8.3 Personal data which we are required by law to retain shall not be erased before the expiry of the applicable retention period, including upon request (Article 17(3)(b) GDPR). Upon expiry of the applicable retention period, personal data are securely deleted.
9. Security of Processing and Professional Secrecy
9.1 As a sworn translator, the Controller is bound by a statutory duty to treat in the strictest confidence all information received in the exercise of the profession (section 13 of Law 45(I)/2019).
9.2 We implement appropriate technical and organisational measures pursuant to Article 32 GDPR, including the following:
(a) documents, translations and records are stored exclusively on our own encrypted, password-protected devices. Save for our email services, we do not use cloud storage services;
(b) access to documents, translations and records is restricted exclusively to the Controller; and
(c) we do not process your documents or personal data entrusted to us by means of machine translation, computer-assisted translation software or artificial intelligence tools.
10. Rights of the Data Subject
10.1 Subject to the conditions and limitations laid down in the GDPR, you have the right:
(a) to obtain confirmation as to whether we process personal data concerning you and, where that is the case, access to such data (Article 15 GDPR);
(b) to obtain the rectification of inaccurate personal data (Article 16 GDPR);
(c) to obtain the erasure of personal data, save where their retention is required by law or for the establishment, exercise or defence of legal claims (Article 17 GDPR);
(d) to obtain the restriction of processing (Article 18 GDPR);
(e) to receive the personal data you have provided to us in a structured, commonly used and machine-readable format (Article 20 GDPR);
(f) to object to processing based on our legitimate interests (Article 21 GDPR); and
(g) to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3) GDPR).
10.2 Requests may be submitted by email to info@metafrastis.com.cy and shall be dealt with free of charge. We shall respond without undue delay and in any event within one (1) month of receipt of the request. That period may be extended by two (2) further months where necessary, taking into account the complexity and number of requests, in which case we shall inform you of the extension (Article 12(3) GDPR). We may request information necessary to confirm your identity.
11. Right to Lodge a Complaint
11.1 You have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection, 15 Kypranoros Street, 1061 Nicosia (P.O. Box 23378, 1682 Nicosia), tel. +357 22 818 456, www.dataprotection.gov.cy, or with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR).
12. Cookies
12.1 This Website does not use any cookies.
13. Amendments to this Privacy Policy
13.1 We may amend this Privacy Policy from time to time to reflect changes in the law or in our practices. The amended Privacy Policy shall be published on the Website and shall apply from the date indicated at the top of this Privacy Policy.
