Privacy policy

LAST UPDATED 25 OCTOBER 2026

The short version

  • Most of the site sets no cookies.
  • We use contact details to answer you, and email only if you opt in.
  • You can ask to access, correct or delete your data at any time.

Who we are

The controller of your personal data is George Agathangelou Consulting Services Ltd (trading as Agathangelou Consulting), a private limited company registered in Cyprus under registration number HE 423108, with its registered office at Trooditissis 11, Flat/Office 301, Aglantzia 2113, Nicosia, Cyprus. VAT: 10423108C. Telephone: +357 99 759 660. Email: george@agathangelou-consulting.com. For any privacy question, or to exercise your rights, contact us at george@agathangelou-consulting.com or through the contact form.

What we collect

Most of the site is static content and sets no cookies. We collect personal data in three situations: (1) when you use the contact form or email us — the name, email address and message you provide; (2) when you subscribe to the Fee Snapshot / Radar Digest — your email address and, optionally, your name; and (3) when you join the Pro list — your name (optional), work email address and the view you are interested in. We do not currently run third-party analytics (see “Cookies and analytics” below). To protect the forms from automated abuse we use Cloudflare Turnstile, a privacy-preserving challenge; where a submission is processed we also store a one-way hash of your IP address (not the IP itself) as an abuse-prevention and consent-audit signal.

Why we process it

We process contact-form data to respond to your enquiry, relying on our legitimate interest in receiving and answering business enquiries. We process subscription data to send you the Fee Snapshot and Radar Digest, relying on your consent (collected by double opt-in). We process Pro list data to tell you when access opens, relying on your consent, which you give when you submit the Pro list form. We do not currently process analytics data. If we enable Cloudflare Web Analytics, it is cookieless and does not identify you; we would rely on legitimate interest for that aggregate measurement.

Who receives it

  • Website hosting, DNS, security, the bot-challenge (Turnstile) and the subscriber database (Cloudflare D1) are provided by Cloudflare, Inc.
  • Transactional email (contact replies, confirmation, welcome and administrative notices) is sent via Cloudflare Email Service.
  • Recurring publications (the Fee Snapshot and Radar Digest, once operational) will be sent using a suitable campaign-email provider; this policy will be updated with that provider's details before any such mailing begins.

How long we keep it

Contact correspondence is retained for up to 24 months from the last contact, then deleted, unless an engagement follows or the law requires longer. Subscriber records are kept while your subscription is active; when you unsubscribe, your status is set to “unsubscribed” and a minimal suppression record (email plus unsubscribe timestamp) is retained so we do not email you again, then removed on request. Consent-audit records (event, timestamp, source, hashed IP) are kept for the life of the subscription and up to 24 months after, to evidence lawful consent. Pro list records are kept for up to 24 months from the last contact, or until you ask us to remove them.

Your rights

Under the General Data Protection Regulation you may request access to, rectification of, or erasure of your personal data, restriction of or objection to its processing, and data portability. To exercise these rights, please contact us via the contact form. You may lodge a complaint with the Office of the Commissioner for Personal Data Protection, Cyprus.

International transfers

Cloudflare, Inc. processes personal data on our behalf as our processor. Depending on the service (for example email delivery, security, and the subscriber database), that processing can take place inside and outside the EEA. Where personal data is transferred outside the EEA it is subject to appropriate safeguards, such as the European Commission’s standard contractual clauses. We use no other processor today; before any campaign email begins, this policy will name the provider.

Automated decisions and withdrawing consent

We do not carry out automated decision-making that produces legal or similarly significant effects, and we do not profile you. The anti-abuse checks on the forms (a Turnstile challenge, a hidden field, a timing check and a rate limit) only decide whether a single submission is accepted. Where we rely on your consent (the Fee Snapshot / Radar Digest), you can withdraw it at any time using the one-click unsubscribe link in every email or by emailing us; withdrawal does not affect processing carried out before it.

Cookies and analytics

We set no marketing or cross-site tracking cookies. We do not currently run third-party analytics. If we enable Cloudflare Web Analytics, it is cookieless: it measures aggregate page views and performance without cookies, without fingerprinting, and without building a profile of you or tracking you across sites. Cloudflare Turnstile, used only on the contact and subscription forms, may set a short-lived token needed to run the challenge; it is not used for advertising or cross-site tracking. No third-party advertising or social-media trackers are loaded. Apart from that short-lived Turnstile token, the only thing this site stores in your browser is your dark/light theme choice, kept in your browser’s local storage; it stays on your device and is never sent to us.

CONTACT FORM & NEWSLETTER

Contact form

If you use the website contact form, we process the name, email address, and message you provide solely to respond to your enquiry. Submissions are delivered to our mailbox via Cloudflare Email Service. Enquiry correspondence is retained for up to 24 months, as above. The form is protected by Cloudflare Turnstile (a privacy-preserving bot challenge), an invisible anti-spam field and a submission-timing check; we also evaluate a one-way keyed hash of your IP for rate-limiting (the raw IP is not stored). Contact submissions are not added to any mailing list and are not stored in the subscriber database.

Fee Snapshot & Radar Digest (newsletter)

If you subscribe on the Fee Snapshot page, we process your email address (and name, if given) to send you the MiCA CASP Fee Snapshot and the Radar Digest. Legal basis: your consent, collected by double opt-in — you receive a confirmation link and are only added to the list once you click it; the confirmation is our record of consent. Your subscription and consent records are stored in a Cloudflare D1 database, holding your email, name (if given), status, source, timestamps, and a one-way keyed hash of your IP — never your raw IP. Transactional confirmation and welcome emails are sent via Cloudflare Email Service; the recurring Fee Snapshot and Radar Digest will be sent via a dedicated campaign-email workflow once operational (this policy will be updated with its details first). Every email includes a one-click unsubscribe link (and supports mailbox “Unsubscribe” buttons via RFC 8058); you can also email us. On unsubscribe your status is set to “unsubscribed” and you stop receiving emails. Subscription data is never shared with or sold to third parties.