Start a project

Legal · Privacy

Privacy Policy

How we collect, use and protect personal data when you visit our website, get in touch or work with us, explained in plain English under the GDPR and Cyprus law.

  • Last updated 12 October 2026
  • Controller: ADVERVE LTD

In short

  • We only collect what we need to answer you, deliver our services and run our business.
  • Analytics and advertising cookies stay off unless you say yes, and you can change your mind at any time.
  • We never sell your personal data.
  • You can ask to see, correct or delete your data by emailing info@theadverve.com.

Who we are

The controller responsible for your personal data is ADVERVE LTD (“ADVERVE”, “we”, “us” or “our”), a company registered in Cyprus.

Legal name
ADVERVE LTD
Registration number
HE 499594
Registered address
1 Anastasiou Sioukri & Olympion, Themis Tower, Office 3, 3035 Limassol, Cyprus
Website
theadverve.com

We are not required to appoint a Data Protection Officer. For anything to do with your personal data, write to info@theadverve.com and a member of our team will reply.

We handle personal data in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), Cyprus Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data, and Cyprus Law 112(I)/2004 on electronic communications, which governs cookies and similar technologies.

What this policy covers

This policy explains how we handle personal data about:

  • visitors to our website, theadverve.com;
  • people who contact us through our contact form, by email, by phone or in person; and
  • the people we deal with at our prospective and existing clients, partners and suppliers.

When we handle personal data on behalf of a client (for example, their customers’ data inside a Google Ads account, an analytics property, or an app or website we build for them), we act as that client’s processor. That work is governed by our contract and data processing agreement with the client, and the client’s own privacy policy applies to it.

Our website may link to other websites, such as social networks. We are not responsible for how those sites handle personal data, so please read their privacy policies.

Data we collect

Data you give us

  • Inquiry details. When you use our contact form: the services you are interested in, your budget range and timeline, your name, email address and company, your website (optional), your message, and your confirmation that you have read this policy.
  • Correspondence. What you send us by email, phone, video call or in meetings, and our notes of those conversations.
  • Client and billing data. For clients: the names, job titles and contact details of the people we work with, billing details, VAT number, contracts, invoices and payment records, and project communications.

The fields marked as required in our form are the ones we need to reply properly. Giving us personal data is not a legal or contractual requirement, but without it we cannot answer your inquiry. Please do not send us sensitive information, such as health data; we don’t need it.

Data collected automatically

  • Technical and log data. When you load a page, our hosting provider’s servers record standard information: your IP address, browser and device type, the page requested, the referring page, and the date and time. When you submit the contact form, we keep a one-way hash of your IP address and the times of your submissions, used only to limit spam; it contains no other data and is cleared automatically by routine server maintenance.
  • Consent Mode signals, before you choose. We use Google Consent Mode in its advanced setup, so Google’s tags load on every page even before you make a cookie choice. While consent is denied they set and read no cookies, but they send Google cookieless signals: the page viewed, the time, browser and device information, and your consent state, without cookies or advertising identifiers. Your IP address is transmitted to Google as part of any web request.
  • Cookie-based analytics data, only with your consent. If you allow analytics cookies, Google Analytics 4 records how you use the site: pages viewed, time spent, clicks and scrolls, the site that referred you, your device and browser, and your approximate location (country or city) derived from your IP address. Google Analytics 4 does not log or store IP addresses.
  • Cookie-based advertising data, only with your consent. If you allow marketing cookies, Google Ads uses cookie identifiers and ad-click identifiers (such as the gclid) to tell us whether an ad led to an inquiry, and may use them to personalise ads.
  • Your cookie choice. We store your cookie preferences, the date you made them and the policy version, so we can respect them.

Data we receive from others

Sometimes we receive your details from someone else: a colleague who introduces you, a client who adds you to a project, or a public source such as your company’s website or professional profile when we prepare for a meeting with you. We use that data only for the purposes described in this policy.

How we use it and why

We only use personal data where the law gives us a valid reason (a “legal basis”). This table sets out what we use each type of data for, our legal basis and how long we keep it.

Purposes, legal bases and retention
CategoryPurposeLegal basisRetention
Inquiry form data and correspondence To reply to your inquiry, discuss your project, prepare a proposal and follow up. Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). Where you contact us on behalf of a company, our legitimate interest in answering business inquiries (Art. 6(1)(f)). 24 months from our last contact, unless a contract follows (then kept as client records).
Client and billing records To deliver and manage our services, invoice, keep accounts and meet our tax obligations. Performance of a contract (Art. 6(1)(b)). Legal obligation under Cyprus tax and accounting law (Art. 6(1)(c)). 7 years after the engagement ends, for tax and accounting purposes.
Technical and log data To deliver the website securely, prevent abuse and spam, and fix problems. Our legitimate interest in running a secure, working website (Art. 6(1)(f)). Spam-limiting records: short-lived; cleared by routine server maintenance. Server logs: short-term, in line with our host’s log rotation, unless needed to investigate a security incident.
Consent Mode signals before consent (page, time, browser and device information, consent state; IP address transmitted to Google) To measure overall site performance and model aggregate results, such as estimated conversions, without cookies, while respecting your consent choice. Our legitimate interest in measuring aggregate site performance without cookies (Art. 6(1)(f)). No cookies are set or read. Kept by Google under its own retention policies. We only see aggregate, modelled figures.
Analytics data (Google Analytics 4 cookies) To understand how visitors use the site so we can improve it. Your consent (Art. 6(1)(a) GDPR and Cyprus Law 112(I)/2004). 14 months (our Google Analytics 4 data-retention setting). Cookie lifetimes are listed in our Cookie Policy.
Advertising and conversion data (Google Ads cookies) To measure which ads lead to inquiries and, if you allow it, to personalise ads. Your consent (Art. 6(1)(a) GDPR and Cyprus Law 112(I)/2004). Cookie lifetimes of 90 days to 13 months (see our Cookie Policy). We only see conversion reports in aggregate.
Consent record To remember your cookie choices and show that we asked for them properly. Legal obligation to be able to demonstrate consent (Art. 6(1)(c) with Art. 7(1) GDPR). 6 months, after which we ask you again.
Legal claims and compliance To establish, exercise or defend legal claims and to respond to lawful requests from authorities. Our legitimate interest in protecting our rights (Art. 6(1)(f)). Legal obligation (Art. 6(1)(c)). As long as the claim or request requires, within the statutory limitation periods.

Where we rely on legitimate interests, we have weighed them against your rights and reasonable expectations, and concluded that our interests are not overridden. You can object to this processing at any time (see Your rights).

We do not sell or rent your personal data, and we do not add you to newsletters or marketing lists without your consent.

Cookies and analytics

Our website uses a small number of cookies. The one strictly necessary cookie, which remembers your consent choice, is always on. Analytics cookies (Google Analytics 4) and marketing cookies (Google Ads) are set only if you agree.

We use Google Consent Mode v2 in its advanced setup. Google’s tags load on every page, but until you consent they run in a restricted mode: they set and read no cookies and send only cookieless signals (such as the page viewed, the time, browser and device information, and your consent state) without cookies or advertising identifiers. Your IP address is transmitted as part of any web request. We rely on our legitimate interest in measuring aggregate site performance for these signals; you can object to them (see Your rights) or block them with a browser content blocker. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a refusal of marketing cookies.

Every cookie we use, and exactly what it does, is listed in our Cookie Policy. You can at any time, or use the “Cookie settings” link in the footer of every page.

Who we share it with

We share personal data only with organisations that help us run our business, and only as much as they need:

  • Hostinger International Ltd hosts our website and email and processes contact form submissions on our behalf, as our processor.
  • Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and its parent company Google LLC (USA) provide Google Analytics and Google Ads. For Google Analytics, Google acts as our processor. For advertising measurement and personalisation, Google may act as an independent controller under its own terms; see how Google uses information from sites that use its services. Google receives cookie-based data only if you consent. Before you consent, it receives only the cookieless Consent Mode signals described above and in our Cookie Policy, including your IP address as part of the web request.
  • Business software providers: reputable providers of the email, file storage, video calling, accounting and project management tools we use, acting as our processors under data processing terms.
  • Professional advisers: our accountants, auditors, lawyers and insurers, who are bound by duties of confidentiality.
  • Subcontractors: trusted specialists (for example, a developer or a film crew) who help us deliver a client project, under written contracts that include confidentiality and data protection terms.
  • Authorities: tax authorities, courts, regulators or law enforcement, where the law requires it.
  • A buyer or successor: if our business is reorganised, merged or sold, under the same protections described here.

Our processors may only use your data on our documented instructions, and they must keep it secure.

International transfers

We aim to keep personal data within the European Economic Area (EEA). Some of our providers, notably Google LLC, may process data in the United States or other countries outside the EEA. When that happens, we rely on:

  • the EU–US Data Privacy Framework, under the European Commission’s adequacy decision of 10 July 2023, for US companies certified under it (Google LLC is certified);
  • the European Commission’s Standard Contractual Clauses (SCCs), with additional safeguards where needed, for transfers not covered by an adequacy decision; and
  • adequacy decisions for other countries the European Commission recognises as protecting personal data to an adequate standard.

You can ask us for more information about these safeguards, or for a copy of the relevant clauses, by emailing info@theadverve.com.

How long we keep it

We keep personal data only for as long as we need it for the purposes above:

  • Inquiries: 24 months from our last contact, unless we go on to work together.
  • Client records (contracts, invoices and accounting records): 7 years after the engagement ends, to meet tax and accounting requirements.
  • Analytics data: 14 months, the retention period we have set in Google Analytics 4.
  • Consent record: 6 months, after which our cookie banner asks you again.
  • Spam-limiting records: short-lived; cleared automatically by routine server maintenance.

When a retention period ends, we delete the data or anonymise it so that it can no longer identify you. We may keep data for longer only if we need it to deal with a legal claim or the law requires us to.

Your rights

Under the GDPR, you have the right to:

  • Access: get a copy of the personal data we hold about you and information about how we use it (Art. 15).
  • Rectification: have inaccurate or incomplete data corrected (Art. 16).
  • Erasure: ask us to delete your data, for example when we no longer need it (Art. 17).
  • Restriction: ask us to pause using your data while a concern is resolved (Art. 18).
  • Portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another organisation, where we process it by automated means on the basis of consent or a contract (Art. 20).
  • Objection: object to processing based on our legitimate interests (Art. 21). You can always object to direct marketing, and we will stop.
  • Withdraw consent: at any time, as easily as you gave it (Art. 7(3)). For cookies, use the . Withdrawing consent does not affect processing that took place before you withdrew it.

How to exercise your rights

Email info@theadverve.com, ideally from the address we know you by, or write to us at our registered address. We will reply within one month. If your request is complex, or we receive a large number of requests, we may extend this by up to two further months; we will tell you if we do, and why.

Exercising your rights is free, unless a request is clearly unfounded or excessive. To protect your data, we may ask you to confirm your identity before we act on a request. Some rights have limits; for example, we must keep invoices for tax purposes even if you ask us to delete them. If we cannot fully meet a request, we will explain why.

Complaints

If you are unhappy with how we handle your data, please tell us first at info@theadverve.com and we will do our best to put it right. You also have the right to lodge a complaint with the data protection supervisory authority in Cyprus:

Authority
Commissioner for Personal Data Protection
Address
Iasonos 1, 1082 Nicosia, Cyprus
Postal address
P.O. Box 23378, 1682 Nicosia, Cyprus

If you live or work in another EU or EEA country, you can also complain to the data protection authority there.

Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Art. 22 GDPR). If you allow marketing cookies, Google may use them to tailor the ads you see. That does not have legal or similarly significant effects, and you can switch it off at any time.

Children

Our website and services are aimed at businesses. They are not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, please contact us and we will delete it.

Security

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including:

  • encrypted connections (HTTPS) across the whole website;
  • spam and abuse protection on our contact form; submissions are emailed straight to our mailbox rather than stored on the web server;
  • access controls, such as strong passwords and two-factor authentication where available, with access limited to the people who need it; and
  • confidentiality commitments from our team, subcontractors and processors.

No method of transmission or storage is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the Commissioner within 72 hours of becoming aware of it and, where the law requires, tell you without undue delay.

Changes to this policy

We may update this policy when our services, the law or the tools we use change. The “Last updated” date at the top of this page shows when it last changed. If we make significant changes, such as adding a new type of cookie or a new purpose, we will highlight them on our website and, where your consent is needed, ask you again.

Contact us

Questions about this policy or your personal data? Contact ADVERVE LTD:

Post
ADVERVE LTD, 1 Anastasiou Sioukri & Olympion, Themis Tower, Office 3, 3035 Limassol, Cyprus

See also our Cookie Policy and Terms & Conditions.