Privacy notice

Who is responsible

The controller is CEREBROX LTD (registration number HE 487945), Aristeidi Tziamali 32, 8300 Konia, Paphos, Cyprus, trading as Cyprus Chef and Pafos Chef. You can reach us about anything in this notice at chef@pafoschef.com.

What we collect

Partner-chef interest form: your name, email, phone number if you give one, the city you chose, your current situation, your message, and the time you gave consent.

Launch waitlist form: your email, the city, and the time you gave consent.

With every submission we also record the time, which site and page the form was on, your browser identifier (user agent), and a salted one-way hash of your IP address. We do not store the IP address itself; the hash only lets us limit abuse of the form.

Server logs at our hosting provider may record your IP address and request details for a short period for security and reliability.

Why, and on what legal basis

To contact you about running a Cyprus Chef city, prepare an introductory call, and keep a record of who has expressed interest in which city. Legal basis: your consent (GDPR Article 6(1)(a)), given by ticking the box on the form, and steps taken at your request before entering into a contract (Article 6(1)(b)).

To tell you when the city you chose has a launch date. Legal basis: your consent (Article 6(1)(a)). You can withdraw it at any time by writing to us; every launch email we send will also say how to opt out.

To keep the forms working and free of abuse (rate limiting, spam checks) and to keep the sites secure. Legal basis: our legitimate interest in running the sites safely (Article 6(1)(f)).

We show partner chefs how many people are waiting in a city as a number only, never as a list of addresses. We do not sell or rent personal data, and we make no automated decisions with legal or similarly significant effects.

Who processes it for us

Cloudflare, Inc. hosts the sites, runs the form service and stores submissions in a database located in the European Union. Cloudflare Turnstile, when enabled, checks that a submission comes from a person.

Resend, Inc. delivers the email that notifies us of a new submission; the email contains the details you entered.

Telegram sends us a message with the details you entered so we can respond quickly.

PostHog, if analytics is enabled on a site, runs in cookieless mode on servers in the European Union and stores no identifier on your device.

These providers act on our instructions under data-processing agreements. Some of them are based in, or may transfer data to, the United States. Where that happens the transfer is covered by the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

Cookies and tracking

The sites set no cookies of their own and use no advertising trackers. Fonts are loaded from Google Fonts, which receives your IP address to serve the font files. If Cloudflare Turnstile is enabled on a form, it may set a functional cookie strictly needed to complete the check. Optional analytics, if enabled, run without cookies or device identifiers. Because nothing here is used to track you, no cookie banner is shown.

How long we keep it

Form submissions are kept for 24 months from the date you sent them, then deleted. If you ask us to delete your details earlier, we do so within 30 days. Notification emails and messages are deleted from our inboxes within the same period. Server logs are kept for no more than 30 days.

Your rights

Under the GDPR you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to processing based on our legitimate interests, receive the data you gave us in a portable format, and withdraw consent at any time without affecting what was done before. Write to us at the address above and we will reply within one month.

If you believe we have handled your data unlawfully you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy) or to the supervisory authority in the country where you live.

Children

The sites and forms are meant for adults. We do not knowingly collect data from anyone under 18. If you think a minor has sent us a form, tell us and we will delete it.

Security

All traffic is encrypted with HTTPS. Submissions are stored in an access-controlled database, exports require a secret token, and IP addresses are hashed before storage. No system is perfectly secure; if we learn of a breach affecting you we will tell you and the authority as the GDPR requires.

Changes

When we change this notice we update the date at the top. Material changes to how we use data you have already given us will be sent to the email you gave.