Privacy Policy
Basic Terms
1.1 Definitions
1.1.1 Personal Data – any information relating to a directly or indirectly identified or identifiable individual (personal data subject), recorded on electronic, paper, and/or other tangible media..
1.1.2 User – any visitor of the Website.
1.1.3 Personal Data Processing – any action (operation) or combination of actions performed with or without the use of automation tools on Personal Data, including collection, recording, systematization, accumulation, storage, clarification (updating, supplementing, modification), retrieval, use, transfer (distribution, provision, access), anonymization, blocking, deletion, destruction of Personal Data.
1.1.4 Confidential Information – any information not publicly available and transferred by the disclosing party to the receiving party in any manner not prohibited by law, which is not subject to disclosure and which the disclosing party identifies as confidential at the time of transfer or before the transfer.
1.1.5 Website – a set of graphic and informational materials, as well as computer programs and databases ensuring their accessibility on the Internet at the address movato.cy owned by the Company.
1.1.6 Use of Personal Data – actions with personal data aimed at achieving the activity goals of the Company or third parties.
1.1.7 Storage of Personal Data – actions ensuring the integrity, confidentiality, and availability of personal data.
1.1.8 Accumulation of Personal Data – actions for the systematization of personal data by entering them into a database containing personal data.
1.1.9 Collection of Personal Data – actions aimed at obtaining personal data.
1.1.10 Destruction of Personal Data – actions that make it impossible to restore personal data.
1.1.11 Anonymization of Personal Data – actions that make it impossible to determine the association of personal data with a specific personal data subject.
1.1.12 Personal Data Subject (hereinafter referred to as the subject) – an individual to whom the personal data pertains.
1.1.13 Third Party – a person who is not the subject, owner, and/or the Company, but is connected with them by circumstances or legal relations regarding the collection, processing, and protection of personal data.
1.1.14 Authorized Body in the Field of Personal Data Protection (hereinafter referred to as the authorized body) – the supervisory authority responsible for leadership in the field of personal data protection in the Republic of Cyprus.
1.1.15 Protection of Personal Data – a set of measures, including legal, organizational, and technical measures, implemented for the purposes established by applicable law.
1.1.16 GDPR-in this Privacy Policy means the Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 and directly effective in Cypriot and EU member states’ legislation.
1.1.17- ePrivacy Directive of the European Parliament and of the Council (2002/58/EC) known as the Cookie Law has been transposed into Cyprus law with N112(I)/2004 on the Regulation of Electronic Communications and Postal Services)
1.2 Terms not defined in this section of the Policy shall be interpreted in accordance with the applicable legislation of the Republic of Cyprus and the European Union (EU).
2. Introduction
2.1 The Company is:
MOVATO CY LTD
Registration No. HE 482329
Georgiou Neofytou 23
Mesa Geitonia, 4006
Limassol, Cyprus
This Policy also applies to mobile applications and complies with GDPR, Cyprus Law 125(I)/2018 and the ePrivacy Directive.
(“the Company”, “we”, “our”, or “us”) recognizes the importance of protecting the personal data of our users and strives to maintain the highest standards of privacy and security.
MOVATO CY LTD acts as the Data Controller for the purposes of personal data processing described in this Policy.
This Privacy Policy describes how we collect, process, store, and protect user information in connection with the operation of our website movato.cy and the provision of our services, including authentication through Google and Facebook.
2.2 By accessing or using our services, you acknowledge that you have read, understood, and agree to the terms set forth in this Privacy Policy. If you do not agree with any provision of this Policy, please refrain from using our website and services.
3. General Provisions
3.1 The Privacy Policy has been developed and approved in accordance with the applicable legislation of the Republic of Cyprus Law 125(I)/2018 and the General Data Protection Regulation (EU) 2016/679 (GDPR) and the ePrivacy Directive.
3.2 This Policy is publicly accessible and must be published on the Company’s Website on the Internet.
3.3 This Policy applies only to the Website. The Company is not responsible for third-party websites that the User may access via links available on the Website.
3.4 The Company has the right to:
3.4.1 with the consent of the personal data subject, entrust the processing of his/her personal data to another party, unless otherwise provided by law, on the basis of the Company’s instruction and a contract concluded with such party;
3.4.2 provide Personal Data of subjects to third parties if this is required by the applicable legislation of the Republic of Cyprus or the European Union;
3.4.3 refuse to provide Personal Data in cases provided for by the legislation of the Republic of Cyprus or the European Union;
3.4.4 use the personal data of the subject without his/her consent in cases provided for by the legislation of the Republic of Cyprus or the European Union;
3.4.5 independently determine the scope and list of measures necessary and sufficient to ensure the fulfillment of the obligations established by the Law and the regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law.
3.5 The Company is obligated to:
3.5.1 take the measures necessary and sufficient to ensure the fulfillment of the obligations established by the Law on Personal Data and the regulatory legal acts adopted in accordance with it;
3.5.2 notify the authorized body for the protection of the rights of personal data subjects, upon request of such body, of the necessary information within 30 (thirty) days from the date of receipt of such request;
3.5.3 publish or otherwise ensure unrestricted access to this Policy;
3.5.4 take legal, organizational, and technical measures to protect Personal Data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution of Personal Data, as well as from other illegal actions in relation to Personal Data;
3.5.5 cease the transfer (provision, access) of Personal Data, stop processing, and destroy Personal Data in the manner and cases provided for by the applicable legislation;
3.5.6 fulfill other obligations provided for by the Law on Personal Data.
3.6 Personal data subjects are obligated to:
3.6.1 provide the Company with accurate information about themselves;
3.6.2 inform the Company about the clarification (updating, modification) of their Personal Data.
3.7 Personal data subjects have the right to: These rights are exercised in accordance with Articles 12–22 GDPR concerning Rights of the data subject.
3.7.1 access their Personal Data, including the right to obtain a copy of any record containing their Personal Data, except in cases provided for by the legislation of the Republic of Cyprus; These rights are exercised in accordance with Articles 12–22 GDPR.
3.7.2 request that the Company clarify their Personal Data, block or destroy it if the Personal Data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing; These rights are exercised in accordance with Articles 12–22 GDPR.
Requests for rectification, erasure, restriction or any other right under Articles 12-22 GDPR may be submitted in writing to [email protected]. The Company will respond without undue delay and in any event within one (1) calendar month from receipt, in line with Article 12(3) GDPR.
3.7.3 withdraw their consent to the Processing of Personal Data; These rights are exercised in accordance with Articles 12–22 GDPR.
3.7.4 take measures provided for by the legislation of the Republic of Cyprus to protect their rights; These rights are exercised in accordance with Articles 12–22 GDPR.
3.7.5 appeal to the authorized body for the protection of the rights of personal data subjects or to a court regarding unlawful actions or inaction during the processing and protection of their Personal Data; These rights are exercised in accordance with Articles 12–22 GDPR.
3.7.6 exercise other rights provided for by the legislation of the Republic of Cyprus and the European Union. These rights are exercised in accordance with Articles 12–22 GDPR.
4. Information Collected by the Company
In the course of providing our services, we collect and process certain categories of personal data, as described below.
4.1 Personal information provided by users
When you authenticate through Google or Facebook, we may receive the following data from your linked account:
4.1.1 Full name.
4.1.2 Email address.
This data is used exclusively for the purposes of user authentication, account management, and service provision.
4.2 Information collected automatically
To improve the performance of our platform and enhance the user experience, we may collect anonymous technical data, including but not limited to:
4.2.1 Anonymous user IP address.
4.2.2 Browser type and version.
4.2.3 Device type, operating system, and screen resolution.
4.2.4 Pages visited, session duration, and user interactions.
4.2.5 Referrers and traffic sources.
Such data helps us optimize service delivery and analyze aggregated user behavior patterns.
4.3 Customs Clearance Data
In connection with the provision of logistics, parcel forwarding and customs clearance services, the Company collects and processes the following categories of personal data of users and recipients:
4.3.1 Full name of the consignee/recipient.
4.3.2 Delivery address in Cyprus.
4.3.3 Contact details (telephone, e-mail) of the consignee/recipient.
4.3.4 Identification data (passport or national identification number) where required by the applicable customs entry type.
4.3.5 Shipment data (description of goods, declared value, country of origin, invoice and tracking references).
4.3.6 Supporting documentation provided by the user or recipient for customs purposes.
This data is processed for the purposes of customs clearance, declaration to the Department of Customs and Excise of the Republic of Cyprus, assessment of duties and VAT, and the safe delivery of parcels.
4.3.7 Audit Trail. The Company maintains an audit trail of all entries and amendments to customer data, including timestamp and identity of the person making the change, for the purposes of accountability under Article 5(2) GDPR. The audit trail is retained for seven (7) years.
5. Cookies
5.1 Cookies are small text files that are stored on your device (computer, tablet, smartphone) when you visit websites.
5.2 The Company uses cookies for the following purposes:
5.2.1 ensuring the operation of the Website and Application;
5.2.2 maintaining security and functionality of User accounts;
5.2.3 analyzing traffic and User behavior;
5.2.4 measuring advertising effectiveness.
5.3 A cookie consent banner is displayed upon first visit allowing users to accept, reject, or customise cookie preferences in compliance with GDPR and Cyprus ePrivacy law. No non-essential cookies are placed without prior consent.
5.4 Users may withdraw or modify their consent at any time through the "Cookie Settings" option.
5.5 If the User disables cookies, certain Website features may not function properly. For mobile applications, tracking technologies and device identifiers are used only with user permission in accordance with platform requirements (e.g. iOS ATT).
6. Purposes and Legal Basis for the Collection and Processing of Personal Data
6.1 The purpose of processing the User’s Personal Data includes:
6.1.1 establishing feedback with the User;
6.1.2 sending notifications related to services;
6.1.3 processing requests and applications;
6.1.4 sending service results and products;
6.1.5 sending newsletters and service announcements;
6.1.6 conducting surveys and market research;
6.1.7 improving service quality.
6.2 Anonymized data collected through analytics services is used to improve the Website.
6.3 Legal bases for processing personal data include: These legal bases correspond to Article 6 GDPR.
6.3.1 performance of a contract; These legal bases correspond to Article 6 GDPR.
6.3.2 compliance with legal obligations; These legal bases correspond to Article 6 GDPR.
6.3.3 legitimate interests of the Company; These legal bases correspond to Article 6 GDPR.
6.3.4 user consent where required by law. These legal bases correspond to Article 6 GDPR.
6.4 Data is retained only for the purposes set out in this Policy and not longer than necessary.
Typical retention periods include:
• account data — until account deletion;
• order and transaction data — up to 6 years;
• support communications — up to 3 years;
• marketing consent — until withdrawal.
7. Principles of Personal Data Processing
7.1 The Processing of Personal Data is carried out in accordance with the following principles:
7.1.1 lawfulness, fairness, and transparency;
7.1.2 purpose limitation;
7.1.3 data minimization;
7.1.4 accuracy;
7.1.5 storage limitation;
7.1.6 integrity and confidentiality.
8. Procedure for Collecting, Storing, Transferring, and Processing
8.1 Personal data is processed with appropriate legal basis.
8.2 Processing may include collection, recording, storage, use, transfer, anonymization, blocking, deletion, and destruction.
8.3 The confidentiality of Personal Data shall be maintained at all times.
8.4 The Company may verify user data where required by law.
8.5 Personal data may be transferred to third parties only where necessary for service provision or legal compliance. All third-party processors are bound by data processing agreements in accordance with Article 28 GDPR.
Categories of recipients include: (i) the Company's cooperating customs agent (Eurofreight Logistics Limited, HE 100410); (ii) the Department of Customs and Excise of the Republic of Cyprus and other competent customs authorities; (iii) transportation and courier partners; (iv) banks and payment service providers; (v) cloud infrastructure providers (Amazon Web Services); (vi) legal, accounting and audit advisers where required. All third-party processors are bound by data processing agreements in accordance with Article 28 GDPR.
8.6 Users may modify their Personal Data.
8.7 Users may withdraw consent to data processing.
8.8 Complaints may be lodged with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.
9. International Data Transfer
9.1 The Company uses cloud service providers including Amazon Web Services (AWS).
9.2 Personal data is primarily stored in European Union data centers.
9.3 If data transfers outside the EU occur, appropriate safeguards such as Standard Contractual Clauses (SCC) are applied. Transfers are safeguarded using Standard Contractual Clauses (SCCs) or adequacy decisions in accordance with Chapter V of the GDPR.
10. Data Breach Notification
10.1 In the event of a personal data breach affecting user rights, the Company shall notify the competent supervisory authority within 72 hours in accordance with Article 33 of GDPR. Where required, affected data subjects will also be notified in accordance with Article 34 GDPR.
11. Updates and Changes to the Policy
11.1 The Company reserves the right to modify this Privacy Policy.
11.2 Updated versions will be published on the Website.
11.3 Continued use of the Website constitutes acceptance of the updated policy.
12. Contact Information
For any questions regarding this Privacy Policy or personal data, please contact:
MOVATO CY LTD
Email: [email protected]
Website: movato.cy
Users may lodge complaints with:
Office of the Commissioner for Personal Data Protection (Cyprus).
Website: https://www.dataprotection.gov.cy
Last updated: 25 May 2026
