What happens to what you send us?
We receive what the site's forms send and what you write in an email. Cloudflare, which serves the pages, also processes your visit, including your IP address. The pages set no cookies and run no analytics. This page says who receives what you send, where it goes, how long it is kept and how to have it deleted.
Who is responsible for your data, and how do you reach them?
The controller of the personal data described here is Maximilian Berentzen (“we”, “us”).
For anything about your data, write to hello@taxesincyprus.com.
What do we collect?
What the forms send and what you write in an email. And, through the host that serves the pages, your visit. Each form also sends a few fields you do not see, and all of them are listed here.
The form at the end of a page
- Your situation, as you chose it in the list.
- Your planned move, or on the capital gains tax page when you plan to sell, as you wrote it.
- What you wrote about your situation.
- Your email address.
The form under the calculator
- What you wrote about your situation.
- Your email address.
- The salary in the calculator: the worked example's salary if you did not change it.
- The exemption you chose in the calculator, or none.
The form under the checker
- What you wrote about your situation.
- Your email address.
- The month your job started, or that it started earlier, if you answered that.
- The yearly pay you entered, if any.
- The checker's result for each exemption.
- Your other answers in the checker are not sent.
The form under the short answer on the non-dom, company tax, crypto tax, inheritance tax and tax number pages, and under the opening on the tax residency and capital gains tax pages, sends what you wrote about your situation, and your email address.
Every form also sends the address of the page it is on, which form it is, the site's name and a subject line for the email we receive. It carries one more field, hidden and left empty: a form that arrives with it filled in is treated as spam and ignored.
An email to hello@taxesincyprus.com carries whatever you write in it, and your address.
Beyond that, the site's pages set no cookies, run no analytics, carry no tracking pixels and embed no content from other sites.
How does a form reach us?
Through Formspree, a service that receives form submissions and emails them on. Only your browser's JavaScript can send a form.
With JavaScript on, your browser sends the form from the page you are on straight to Formspree, and the result appears in the form itself: you stay on this site. If sending fails, the form says so and does not send it another way.
With JavaScript off, or if it fails, nothing is sent: the form stays switched off and says so, with hello@taxesincyprus.com as the way to reach us instead.
Formspree runs every submission through its own spam filter.
Who handles it for us, and in which countries?
Three providers handle what you send for us. Formspree and Cloudflare process data in the United States, outside the EU, and each names its own legal safeguard for that.
Formspree
Run by Formspree, Inc., it receives every form you send and emails it on to our mailbox; what its spam filter marks as spam is kept out of that mailbox. Its terms call the sites that use it “separate and independent data controllers”; its notice for California residents calls it generally a service provider to those sites. It keeps log files of its own, under its own policy.
Outside the EU: it is hosted with Amazon Web Services in the United States. It says it relies on standard contractual clauses as a data processor. It was not on the EU–US Data Privacy Framework list on 4 October 2026. It uses further providers, all but one in the United States: Formspree's list.
Cloudflare
Cloudflare hosts and serves the site, and its Email Routing forwards email sent to hello@taxesincyprus.com to our mailbox at Proton. Serving a page means processing your visit, including your IP address. Cloudflare acts as our processor for the logs it shows us, and as a controller for what it keeps for its own purposes. It says its email forwarding stores and reads no message content. It logs whether each message was delivered.
Outside the EU: it stores data mainly in the United States and the EEA. For transfers to the United States it relies on its EU–US Data Privacy Framework certification, listed as “Active – Re-certification under Review” on 4 October 2026, and on standard contractual clauses should that lapse. Its data processing addendum is part of its terms for our account.
Proton
Our mailbox is with Proton: what you send to hello@taxesincyprus.com, and Formspree's notifications of your forms, arrive there. Proton is run by Proton AG, of Geneva, Switzerland, under Swiss law. Proton Mail stores data in encrypted form, on servers only in Switzerland, Germany or Norway.
Outside the EU: the European Commission recognises Switzerland as giving adequate protection, so data goes there as it would within the EU. Germany is an EU member state. Norway belongs to the area the Commission names alongside the EU for these transfers.
Does anyone else see it?
A request to be introduced to an adviser, by form or by email, may be passed to that adviser.
The founder reads an enquiry and passes it on only to a licensed adviser. What you wrote about your situation goes with it. From then on the adviser handles it under their own terms.
What you send is never sold or rented to anyone. The only party it is ever passed to is the single adviser you asked to be introduced to, and only when you asked.
On what basis do we use it, and for how long?
An enquiry is kept twelve months after the last message in the exchange, then deleted; the exceptions are below.
Why we may use it
- A request to be introduced to an adviser, by form or by email: we use it to take a step you asked for before any contract (GDPR Art. 6(1)(b)). Every form on the site is such a request.
- Any other email to hello@taxesincyprus.com: our legitimate interest in answering you (Art. 6(1)(f)).
- The host's request logs: our legitimate interest in running the site securely (Art. 6(1)(f)).
How long we keep it
- Enquiries, by form or by email: twelve months after the last message in the exchange, then deleted from our mailbox and from Formspree.
- Cloudflare's request logs: as its own policy sets. That policy gives the criteria it uses, not a fixed period.
- Cloudflare's log of email deliveries to hello@taxesincyprus.com: likewise, as its own policy sets.
- Formspree's own log files: as its own policy sets.
- An enquiry passed to an adviser: from then on, under the adviser's own terms.
What can you ask us to do?
Write to hello@taxesincyprus.com with any of these. Which rights apply depends on what you asked us for. Data Cloudflare holds about your visit counts too: Cloudflare directs such requests to the site.
A request for an introduction, by form or by email
- Access: ask whether we hold data about you, and have access to it.
- Rectification: have data about you corrected if it is wrong.
- Erasure: have it deleted, on the grounds the GDPR sets out.
- Restriction: have its use limited, for instance while you contest whether it is accurate.
- Portability: receive what you gave us in a structured, machine-readable form and pass it to someone else. The GDPR grants this where processing rests on consent or on a contract and is carried out by automated means; such a request meets both, because it rests on Art. 6(1)(b) and is handled electronically.
Any other email, and the host's request logs
- Access: ask whether we hold data about you, and have access to it.
- Rectification: have data about you corrected if it is wrong.
- Erasure: have it deleted, on the grounds the GDPR sets out.
- Restriction: have its use limited, for instance while you contest whether it is accurate.
- Objection: object, on grounds of your own situation, to processing that rests on our legitimate interest.
Portability does not apply here: it does not cover processing based on legitimate interest.
If we passed your enquiry to an adviser, we tell them of a correction, deletion or restriction too.
Where can you complain?
In Cyprus, to the Office of the Commissioner for Personal Data Protection. You may write to us first, but you do not have to.
Office of the Commissioner for Personal Data Protection
Kypranoros 15, 1061 Nicosia
P.O. Box 23378, 1682
commissioner@dataprotection.gov.cy
You can also complain to the data protection authority of the EU country where you live or work, or where you think the breach took place.
Is there anything else you should know?
Giving us your data is voluntary. Without an email address we cannot reply to you.
Whether you get an answer, and whether your enquiry is passed to an adviser, is decided by the founder, not by a program. Spam filters do sort out what looks like spam: Formspree's for the forms, and Cloudflare's for email to hello@taxesincyprus.com.
Last changed: 4 October 2026.