Privacy Policy
Version 1.2026 · Last updated 13 August 2026
This policy explains what personal data we collect through the BrokLicense website, why we hold it, how long we keep it, and what rights you have over it. It is written to meet Regulation (EU) 2016/679 (the GDPR) and the Cyprus Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data, Law 125(I)/2018.
1. Who we are
BROKTRADING LTD is the data controller. It is a private limited liability company incorporated in the Republic of Cyprus under registration number HE 342927, with registered office at Orfeos Street 2B, Office 201, 1070 Nicosia, Cyprus, VAT number CY10342927L. BrokLicense is a brand and trading name of Broktrading Ltd and is not a separate legal person.
For anything in this policy, contact info@broklicense.com, or write to the registered office above marked for the attention of the Data Protection contact. We have not appointed a Data Protection Officer, as we are not required to.
2. What this policy covers
This policy covers the website. If you go on to engage us, the personal data we handle for that engagement — including information about directors, shareholders and beneficial owners that regulators require for a licence application — is governed by the engagement documentation we provide at the time, not by this policy.
3. The contact form
Our contact form has six fields. Four are required, because without them we cannot identify you or answer you. Two are optional, and the form submits without them.
| Field | Required | What we do with it |
|---|---|---|
| Name | Yes | To know who is writing and to address you properly in our reply. |
| Surname | Yes | |
| Email address | Yes | To reply to you. This is the address we will use. |
| Message | Yes | To understand what you need, so we can answer usefully. |
| Company | Optional | To understand who is asking and to prepare for the conversation. |
| Telephone number | Optional | Only so we can call you if that is quicker than writing. Leave it blank and we will reply by email. |
We ask for the four required fields because each is needed to answer an enquiry, and we do not ask for anything beyond them. Giving us the two optional fields is entirely your choice and makes no difference to whether or how we reply.
Please keep it brief and general. The message box is for telling us what you are trying to do. It is not a secure channel and it is not the place for identity documents, passport or company registration numbers, financial detail, or anything about a person’s criminal record or regulatory history. If an engagement begins we will tell you how to send that material securely.
Our legal basis for handling what you send is Article 6(1)(b) of the GDPR, taking steps at your request before entering into a contract, together with Article 6(1)(f), our legitimate interest in responding to business enquiries. Submitting the form does not sign you up to marketing; we will use your details to answer you and to carry the conversation forward, and nothing else, unless you ask us to.
Submitting the form does not create a client relationship and does not oblige either of us to do anything. See our Website Terms of Use.
4. What else we collect
| Data | What it is | Why we hold it, and our legal basis |
|---|---|---|
| Email enquiries | Anything you send if you email us directly rather than using the form. | To answer you and discuss a possible engagement. Article 6(1)(b) and Article 6(1)(f), as above. |
| Technical data | IP address, browser and device type, pages requested and timestamps, recorded in standard server logs. | To keep the site available and secure and to diagnose faults. Article 6(1)(f), our legitimate interest in the security and availability of our own website. |
That is the whole of it. Beyond the contact form this site has no account system, no newsletter sign-up, no analytics and no advertising or tracking technology, so there is nothing else for us to collect. We do not use your data to make automated decisions about you, and we do not profile you.
This site is aimed at businesses. We do not knowingly collect data about anyone under 18.
5. Cookies
This website does not set cookies. It uses no analytics, no advertising technology and no third-party tracking, and the contact form does not place anything on your device either. There is nothing for you to consent to and no cookie banner. Our Cookie Policy sets this out in full and will be updated, with consent obtained first where consent is required, if that ever changes.
6. Who we share it with
We do not sell personal data and we do not share it for anyone else’s marketing. We disclose it only to:
- our website hosting and email providers, who process it on our instructions under a written contract meeting Article 28 GDPR — a form submission reaches us as an email, so those providers carry it;
- our professional advisers — lawyers, accountants and auditors — where they need it to advise us;
- public authorities, where we are required by law to disclose, or where disclosure is necessary to establish, exercise or defend legal claims; and
- a buyer or successor, if the business or part of it is sold or reorganised, on the same protections.
Those providers are Vercel Inc. (website hosting and server logs), Supabase, Inc. (receipt and delivery of contact form submissions) and Microsoft (the corporate mailbox that receives the enquiry), each acting on our instructions under a written contract meeting Article 28 GDPR.
7. Transfers outside the EEA
We prefer providers that process data inside the European Economic Area. Where a provider processes data outside it, we transfer data only under a lawful transfer mechanism — either a European Commission adequacy decision under Article 45, or the European Commission’s Standard Contractual Clauses under Article 46 with any supplementary measures our assessment shows to be necessary. Write to us if you would like details of the safeguards in place.
8. How long we keep it
| Data | Retention |
|---|---|
| Form submissions and email enquiries that do not lead to an engagement | 24 months from our last contact with you, then deleted. |
| Enquiries that do lead to an engagement | Kept with the engagement file and governed by the engagement documentation. |
| Server logs | 12 months. |
| A record that you asked us not to contact you | Kept indefinitely, so that we do not contact you again. |
9. How we protect it
We apply technical and organisational measures appropriate to the risk, including encryption in transit, access limited to those who need it, and due diligence on our providers. No system is perfectly secure, and ordinary email is not a confidential medium. If a breach occurs that is likely to result in a risk to your rights, we will report it to the Office of the Commissioner for Personal Data Protection within 72 hours as Article 33 requires, and tell you directly where Article 34 requires it.
10. Your rights
Subject to the conditions in the GDPR, you have the right to obtain a copy of the data we hold about you (Article 15); to have inaccurate data corrected (Article 16); to have data erased (Article 17); to have processing restricted (Article 18); to receive data you gave us in a portable format (Article 20); to object to processing we carry out on the basis of our legitimate interests (Article 21); to object at any time to direct marketing; and to withdraw any consent you have given, without affecting processing carried out before you withdrew it.
To exercise any of these, write to info@broklicense.com. We respond within one month, and will tell you if a complex request needs longer. There is no fee unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity first.
If you are unhappy with how we have handled your data you may complain to the Office of the Commissioner for Personal Data Protection, 15 Kypranoros Street, 1061 Nicosia, Cyprus (commissioner@dataprotection.gov.cy, www.dataprotection.gov.cy), or to the supervisory authority in the EU country where you live or work. We would prefer the chance to put it right first.
11. Changes to this policy
We may update this policy. The version number and date at the top show when it last changed, and where a change materially affects your rights we will take reasonable steps to bring it to your attention. Earlier versions are available on request.