Download this Privacy Statement as a PDF
1. Introduction
This Privacy Statement applies to personal data held by ITEX – INNOVATION TECHNOLOGY EXPERTS LTD (“ITEx”, “we”) as data controller who will determine how personal data collected from you is processed. This means that we are responsible for deciding how such personal information is held and used. Personal data is information that, on its own or when combined with other details that we have or which is available to us, can be used to identify you. We may use personal data that you provide to us for any of the purposes described in this Privacy Statement or as otherwise stated at the point of collection. We will process personal data in line with the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Cyprus Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data.
If you have any questions regarding this Privacy Statement or how and why we process your personal data, please contact us at:
ITEX – INNOVATION TECHNOLOGY EXPERTS LTD, Reg. No. HE 470509,
45 Evangelistrias Str., Strovolos 2057, Nicosia, Cyprus
Email: info@itex.consulting
2. What data we collect
We collect only the data we need to run our business and deliver our services:
- Personal details (e.g. name, gender, country of residence).
- Contact details (e.g. job title, organisation, email address, telephone and postal address of clients, partners, suppliers and their staff).
- Business records (e.g. contracts, proposals, invoices, payment records).
- Project data (e.g. personal data contained in documents or datasets shared with us for a project, such as names of stakeholders or survey participants).
- Professional data (e.g. CVs and qualifications of consultants, experts and job applicants).
- Website data: limited technical data when you visit https://itex.consulting or email us.
We do not knowingly collect special categories of personal data (e.g. health data) or data about children. Most data comes directly from you; some comes from your employer, our project partners or public sources such as company registers and professional websites.
3. Why we use it and our legal basis
Each use of personal data relies on a legal basis under Article 6 GDPR:
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Delivering our professional services | Performance of a contract (6(1)(b)) |
| Preparing proposals, tenders and funding bids, incl. consortium CVs | Steps before a contract (6(1)(b)); legitimate interests (6(1)(f)) |
| Invoicing, bookkeeping, tax and audit | Legal obligation (6(1)(c)) |
| Managing business relationships and replying to enquiries or complaints | Legitimate interests (6(1)(f)) |
| Recruitment of applicants | Legitimate interests (6(1)(f)) (to manage our recruitment process) |
| Providing information about us and our services or undertaking marketing activities in order to keep our contacts up to date with market developments and our services and events | Consent (6(1)(a)), which you can withdraw at any time |
| Complying with any requirement of law, regulation or a professional body of which we are a member | Legal obligation (6(1)(c)) or legitimate interests (6(1)(f)) |
We do not sell personal data and do not use it for automated decision-making or profiling.
4. Sharing, transfers, retention and security
Sharing. We share personal data with other parties only when legally allowed to do so. We do not share personal data with third parties except as necessary for our legitimate professional and business needs, for the purpose of executing your instructions or requests, as required or permitted by applicable laws, regulations and/or professional standards applicable to us or by any agreement between us. When we share personal data with others, we set contractual arrangements in place to protect the personal data and to comply with our data protection obligations.
Personal data held by us may be transferred to the following categories of persons:
- Third party organisations that provide functionality/ applications, data processing or IT services or cloud services to us. We use third parties to help us provide our services and to run and manage our internal IT systems. These include providers of information technology, cloud-based software-as-a-service, identity management, website hosting and management, data analysis, data back-up and security. The servers behind this cloud infrastructure are located in secure data centres in the European Union, and personal data may be stored in any of them. Details of these providers are listed below.
| Provider | Service |
|---|---|
| Microsoft Ireland Operations Limited | Microsoft 365: email, documents, calendar, Teams, cloud storage and identity management |
| GoDaddy | Website hosting, domain and website management |
- Third party organisations that assist us in providing our services. On certain client engagements, we may engage other providers to assist us in providing our professional services to clients.
- Law enforcement, governmental or regulatory authorities, or to other third parties as required by and in accordance with applicable law or regulation. We may need to disclose personal data to respond to requests of governmental authorities or of the courts, or where it is required for compliance with applicable law, regulations, or for establishing, exercising or defending legal rights.
International transfers. Some of our providers or clients may be outside the European Union (EU). In that case we will take steps to ensure that all personal data is provided with adequate protection and that all transfers outside the EU are done lawfully. Where we transfer personal data outside the EU to a country not covered by an EU adequacy decision, the transfers will be under an agreement covering the EU requirements for the transfer of personal data outside the EU, such as the European Commission’s Standard Contractual Clauses, or another safeguard permitted under the GDPR.
Data retention. We keep personal data only as long as necessary for the purpose for which it was collected. Personal data may be held for longer periods when extended retention periods are required by law or regulation, or in order to exercise or defend our legal rights.
Security. We use technical and organisational measures relating to technology and operational security to protect personal data and information from loss, misuse, alteration or destruction (such as access controls and confidentiality obligations).
5. Individuals’ rights and how to exercise them
Individuals have the following rights over their personal data, and data controllers are responsible for fulfilling them:
- Access to personal data held by the data controller. We aim to reply to requests for information promptly and in any event within the legally required time limits. Depending on the nature of the request, a charge may be imposed if permitted by applicable law.
- Amending personal data. When practically possible, once we are informed that the personal data we hold is no longer accurate, we will make corrections as appropriate based on the updated information.
- Withdrawal of consent. Where we process personal data based on your consent, you have the right to withdraw your consent at any time. We will provide relevant instructions on the relevant communications.
Additional rights: Right to request erasure of your personal data, right to restrict processing, right to data portability, right to object, in line with the applicable Data Protection legislation.
6. Complaints and exercise of rights
If you have any questions or complaints about this Privacy Statement (including the manner in which we process your personal data or you would like to exercise any of your rights under the GDPR), please contact us at info@itex.consulting.
You have the right to lodge a complaint with the Cyprus supervisory authority: Office of the Commissioner for Personal Data Protection, 1 Iasonos Str., 1082 Nicosia, Cyprus · +357 22 818456 · commissioner@dataprotection.gov.cy · www.dataprotection.gov.cy. We would welcome the chance to address your concern first.
Cookies. More information will be available on our website on how we may use cookies.
Changes to this Privacy Statement. We may update this Privacy Statement. This Privacy Statement has been last updated on 17th October 2026.