Privacy & data protection.

Nomikos & Partners LLC, Limassol, Cyprus, is the data controller for personal data processed in connection with our services. Privacy questions can be sent to privacy@nomikos.cy.

• Identity data — full name, date of birth, nationality, government identifiers, photo ID.
• Contact data — address, email, phone, residence country.
• KYC / source-of-funds — proof of address, employment, bank references and supporting documents.
• Engagement data — onboarding forms, agreements, messages and documents you upload to the portal.
• Technical data — IP address, device, session cookies needed to operate the portal securely.
• Engagement-letter acceptance records — when you accept or decline an engagement letter we record the exact version accepted (SHA-256 fingerprint), the timestamp, the IP address and the browser user-agent, as evidence of electronic acceptance.
• Notification records — application events that trigger email notifications, including delivery metadata (recipient, template, sent time, provider status).
• Payment metadata — payment request references, amounts, currencies and card-payment status returned by our payment processor. We do not store card numbers.

• Contract — to deliver the legal and corporate services you engage us for (Art. 6(1)(b) GDPR).
• Legal obligation — to meet AML/KYC, tax and regulatory duties (Art. 6(1)(c) GDPR).
• Legitimate interests — to secure the portal, prevent fraud and improve our service (Art. 6(1)(f) GDPR).
• Consent — for optional communications you opt into; you can withdraw at any time.

• TLS 1.3 encryption in transit; AES-256 encryption at rest.
• Row-level access controls — only your case team sees your file.
• Multi-factor authentication available on every account.
• Regular backups, audit logging and least-privilege admin access.
• Vendor due diligence and data-processing agreements with every sub-processor.

We share personal data only with: (i) competent regulators and registries where the law requires it, (ii) banks and EMIs to which you instruct us to introduce you, (iii) vetted IT sub-processors operating under written data-processing agreements. We never sell personal data.

Data is stored in EU regions. Where a transfer outside the EEA is unavoidable we rely on the European Commission's Standard Contractual Clauses and apply additional technical safeguards.

[DRAFT — pending firm approval] KYC and engagement records are kept for the duration of the relationship and for a further five years after the end of the engagement, where Cyprus AML law requires retention. Marketing data is kept only while you remain subscribed.

Under the GDPR you can request access, rectification, erasure, restriction, portability or objection in respect of your personal data. Requests can be sent to [CONTACT_EMAIL] and are fulfilled within 30 days of receipt. Some rights are limited where we are obliged to keep records by law: in particular, KYC records and engagement records (including engagement-letter acceptance evidence) are retained for the statutory AML retention period — [DRAFT — pending firm approval: five years post-engagement] — even where erasure is requested.

You also have the right to complain to the Office of the Commissioner for Personal Data Protection of Cyprus.

This site uses strictly necessary cookies and browser storage only: authentication session tokens (our backend provider) and the anti-bot challenge (Cloudflare Turnstile) that protects sign-in and sign-up. We do not use analytics cookies, advertising cookies or cross-site tracking. Because only strictly-necessary storage is used, no cookie-consent banner is required.