Your information, handled with care.

Who is responsible for your data?

Onboard Cyprus with VP is a trading name. The service is operated by an individual sole trader based in Larnaca, Cyprus, who is the data controller for personal information collected through this website. There is no company: the controller is a natural person.

Contact: info@onboardcyprus.com. The controller’s full name is available on request to any individual whose data we hold, and to the Office of the Commissioner for Personal Data Protection. This page will be updated if the business is later incorporated.

The client case portal

If you are a client, you may be given access to a page showing your case. We hold your name, email address, telephone number, nationality, your address in Cyprus and the date you arrived — the last two because most deadlines are counted from them. Alongside that: what you have asked us to do, a checklist of the documents your procedure needs, any messages we have sent you, your appointment times and whether a fee has been paid.

Documents you upload are stored, and they are encrypted before they are written to disk. Each file has its own key, and that key is itself encrypted with a master key that is not in our source code and not in our backups. Files are held outside the part of the server the website can reach, so no web address leads to one — every download passes through a check that you are the person whose case it belongs to. Uploading and downloading are both recorded.

There are no passwords. You ask for a link, we email it to the address we already hold for you, and it works once and expires after twenty minutes. A session ends after an hour without activity and when you close the browser. Every sign-in and every view of a case is recorded, with the visitor's address stored only as a one-way hash.

You may remove anything you have uploaded, at any time, from the case page. Removing it overwrites the file before deleting it, so it is not merely unlinked. Documents are destroyed the same way when a case is deleted.

A closed case is deleted two years after it closes, and the access log after six months. When nothing of yours remains, your client record is deleted with it. You may ask us at any time to close and delete a case sooner.

What we collect and why

When you ask for a quote, we collect the information you provide: name, email address, selected service and message. The form has no telephone field and we do not ask for one. We use it only to assess and respond to your request, provide the service you ask for, communicate about your case, and meet applicable legal obligations.

Please do not send passport, ID-card, birth-certificate or other sensitive document copies through the website form. If documents are needed for a case, we will explain the appropriate secure method after initial contact.

The confirmation email

When you submit the form we send a short confirmation to the address you entered, so you know the enquiry arrived. It repeats only your name and the service you selected — it does not quote your message back, because anyone can type someone else's address into a public form and we will not make this site a way to send text to a person who did not ask for it.

To prevent the form being used to send mail repeatedly, we count submissions per hour by network address and by email address. Those counters store a one-way hash, never the address itself, and entries are discarded after an hour.

Legal basis and consent

We process enquiry information to take steps at your request before entering a service agreement, and where you explicitly consent through the form checkbox. You may withdraw consent at any time by contacting us. Withdrawing consent does not affect processing already carried out lawfully.

Who receives your information?

We do not sell your data. We share it only when necessary to provide a requested service or comply with law — for example, with approved translators, couriers, professional advisers, authorities or embassy services — and only with the information needed for that purpose.

Retention and security

We keep enquiry information only as long as needed to respond and manage a potential or active client relationship, or for statutory record-keeping. We use reasonable organisational and technical safeguards and limit access to people who need it. No internet service can guarantee absolute security; please avoid sending sensitive identity documents through ordinary email or web forms.

Your rights

Subject to applicable law, you may ask for access, correction, deletion, restriction or portability of your personal data, or object to processing. Contact us first at the address above. You may also lodge a complaint with the Cyprus Commissioner for Personal Data Protection.

Cookies

This website sets one cookie, csrftoken, which exists solely to protect the enquiry form against cross-site request forgery. It is strictly necessary for the form to work and carries no information about you. Your language is determined by the address you are visiting, not stored on your device.

There are no advertising cookies, no third-party scripts and no profiling. If you dismissed the small notice at the bottom of the page, that preference is remembered in your browser’s own local storage so we do not show it again; it is not a cookie and it is never sent to us.

Analytics

We measure how the site is used with Umami, an open-source analytics tool that runs on our own server. Nothing is sent to Google, to an advertising network, or to any other company: the measurement request goes to this same domain and no further.

It records the page visited, the site or search engine you arrived from, an approximate country, and whether you are on a phone or a computer. It sets no cookies, stores nothing on your device, does not follow you to other websites, and builds no profile of you. It also honours your browser’s Do Not Track setting: if you have that on, nothing about your visit is recorded at all.

Because it places no information on your device and identifies no individual, it does not require your consent under the ePrivacy rules — which is why you are told about it rather than asked. We use it for one purpose: to see which guides people actually read, so we know what to write next.

Important service boundary

Onboard Cyprus with VP provides document assistance, preparation, logistics and appointment guidance. We are not a government agency. Where a law requires an applicant to attend personally — including biometric capture for a passport or ID card — the applicant must attend. We can prepare the file and guide the process, but cannot issue a government document or complete biometric capture on the client’s behalf.