Privacy Policy & GDPR Compliance

1. Who We Are

MyCyPay is operated by DTS Services Ltd, a company registered in Cyprus (HE ______), with its registered office at 4 Naxou Street, 1st Floor, Office 101, Nicosia 1070, Cyprus.

For all data-protection enquiries contact our Data Protection Officer at [email protected] or by post to the address above.

2. Scope of This Policy

This Privacy Policy explains how MyCyPay collects, uses, discloses, and safeguards personal data when you:

Visit www.mycypay.com (the "Website");
Register for and use the MyCyPay cloud payroll platform (the "Service");
Contact us via phone, email, or the Website contact form.

3. Legal Basis (GDPR)

We process personal data under the following lawful bases as defined by the EU General Data Protection Regulation (GDPR) (Regulation 2016/679), as adopted into Cyprus law:

Contract (Art. 6(1)(b)) — to provide the payroll Service you subscribed to.
Legal obligation (Art. 6(1)(c)) — to comply with Cyprus tax and labour laws (e.g. retaining payroll records).
Legitimate interests (Art. 6(1)(f)) — to improve our Service, detect fraud, and ensure security.
Consent (Art. 6(1)(a)) — for marketing communications, where we ask for explicit consent.

4. Personal Data We Collect

4.1 Account & Registration Data

When you register a company account we collect: company name, registration number, registered address, director name and email, contact person name and email, and system administrator credentials.

4.2 Employee Payroll Data

As a data processor on behalf of our customers (data controllers), we store employee data entered by the employer, including: full name, national identity / Social Insurance number, salary and deduction data, bank account details (IBAN), tax residency information, and leave records. This data is used solely to provide the payroll Service.

4.3 Usage & Technical Data

We automatically collect: IP address, browser type, pages visited, session duration, and error logs. This data is processed in aggregate and is not used to identify individuals beyond security and fraud prevention purposes.

4.4 Contact Form Data

When you submit the Website contact form we collect your name, email address, and message content.

5. How We Use Your Data

Provide, operate, and maintain the MyCyPay Service;
Process and run payroll calculations, generate IR forms and SEPA files;
Send account credentials, subscription confirmations, and service notifications;
Respond to support requests and contact form enquiries;
Comply with Cyprus Social Insurance, GESY, and Tax Department reporting requirements;
Detect, prevent, and investigate security incidents or fraudulent activity;
Improve the Service through anonymised analytics.

We do not sell personal data to third parties. We do not use payroll data for advertising purposes.

6. Data Processors & Third Parties

We share data only with trusted processors who are contractually bound to GDPR-compliant data processing agreements (DPAs):

Hosting provider — servers located in the European Union;
Email delivery provider — used to send transactional emails only;
Cyprus Tax Department / Social Insurance Office — statutory submissions as required by law.

No data is transferred outside the European Economic Area (EEA) without appropriate safeguards (Standard Contractual Clauses or adequacy decision).

7. Data Retention

Payroll & tax records — retained for a minimum of 7 years as required by Cyprus tax law.
Account data — retained for the duration of the subscription plus 2 years, then deleted.
Contact form submissions — retained for 12 months, then deleted.
Server logs — retained for 90 days.

8. Your Rights Under GDPR

If you are located in the EU/EEA or Cyprus, you have the following rights:

Right of access — request a copy of your personal data;
Right to rectification — correct inaccurate data;
Right to erasure ("right to be forgotten") — subject to our legal retention obligations;
Right to restriction of processing;
Right to data portability — receive your data in a structured, machine-readable format;
Right to object — to processing based on legitimate interests;
Right to withdraw consent — at any time, without affecting prior processing.

To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus (dataprotection.gov.cy).

9. Security

We implement industry-standard technical and organisational measures to protect personal data, including:

TLS/HTTPS encryption for all data in transit;
AES encryption for stored credentials;
Role-based access controls and audit logging;
Regular security reviews and penetration testing;
EU-based servers with physical access controls.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the competent supervisory authority within 72 hours as required by GDPR Art. 33–34.

10. Cookies

MyCyPay uses strictly necessary session cookies required for authentication and CSRF protection. We do not use third-party advertising or tracking cookies. Analytics, if used, are anonymised (no personal identifiers stored in analytics data).

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. We will notify registered users by email at least 14 days before material changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact

For any questions about this Privacy Policy or your personal data:

Email: [email protected]
Post: DTS Services Ltd, 4 Naxou Street, 1st Floor, Office 101, Nicosia 1070, Cyprus
Phone: +357 22 768555