Q1 · MotivationWho is responsible for this data, and in what role?
D.E.O.N. INVESTMENT LTD (“Deon”, “we”, “us”), whose address is LUMIEL BUILDING, Floor 4, 61 Lordou Vyronos, Larnaca, Larnaca 6023, Cyprus, designs and builds mobile apps and AI features. We decide why and how personal data is used — and so act as its controller — in four situations: when you visit deon-investment.com; when you write to us; when you are a contact person at one of our clients or suppliers; and when you use an app that we publish under our own name on Apple’s App Store or on Google Play.
Much of our work is building software for other companies. When a client’s app or system holds data about the client’s own users and we handle that data while building or supporting it, the client decides what happens to it. In that role we are the client’s processor: we follow its written instructions, and the client’s privacy notice is the one that tells those users about their data.
An app we publish can carry extra details — on its store page (“App Privacy” on the App Store, “Data safety” on Google Play), on a screen inside the app, or in a privacy policy of its own. Those details add to this datasheet, and where they are more specific, they take precedence for that app.
Because we are established in Cyprus, the rules that bind us are the EU General Data Protection Regulation 2016/679 (“GDPR”) and the Cypriot law that supplements it, Law 125(I)/2018. Article numbers in this datasheet refer to the GDPR.
Q2 · CompositionWhat personal data is in the set?
| Where it comes from | What it contains | What we use it for | Legal ground | How long it stays |
|---|---|---|---|---|
| Visits to this website | IP address, date and time, the page requested, the referring page, the browser’s user-agent string and the response code — one log line per request | Delivering pages, keeping the site secure, tracing errors and abuse | Legitimate interests — GDPR Art. 6(1)(f) | 14 days; older log files are deleted automatically |
| E-mails you send us | Your address, your name if you give it, the text, any attachments and the technical headers of the message | Answering you; preparing and running a project you ask about | Steps you request before a contract, or the contract itself — Art. 6(1)(b); otherwise legitimate interests | Up to 24 months after the conversation ends, unless it becomes part of a contract record |
| Clients and suppliers | Names, work e-mail addresses and phone numbers, job titles, meeting notes, invoices and payment records | Running the business relationship, billing and being paid | Contract — Art. 6(1)(b); legal duties for accounting records — Art. 6(1)(c) | For the relationship, then for as long as accounting and tax law requires |
| Apps we publish | Depends on the app — set out in its store listing and inside the app | Making the app’s features work | Stated for each app | Stated for each app |
The website itself sets no cookies and runs no analytics, advertising or tracking code. Its fonts, images and scripts are served from our own server, so opening a page does not tell any other company that you were here — apart from the delivery network described in Q5.
We do not ask for special categories of data (such as health, religion or biometrics). Please do not send them to us unless a project genuinely requires it and we have agreed how they will be protected.
Q3 · CollectionHow does the data reach us?
- From you, directly — in e-mails, in documents you share with us and in conversations.
- From your browser, automatically — each time it asks our server for a page.
- From your organisation — when your employer names you as a contact for a project or an invoice.
- From the app stores — Apple and Google send us reports about our apps: downloads, sales, ratings, crashes and performance. These reports are aggregated or otherwise do not reveal who you are, and we never receive your payment card details.
Q4 · UsesWhat is done with it — and does any of it train AI?
We use personal data only for the purposes in the table in Q2, or for a purpose compatible with them (for example, defending a legal claim about a project).
Training. We do not use the content of your messages, the documents you send or data from client projects to train or fine-tune machine-learning models, and we do not allow our suppliers to do so. The single exception is a project in which a client asks us to train a model on that client’s own data; the client then decides, in writing, which data may be used and for how long it may be kept.
Outside services. If an outside service handles personal data for us — an AI service included — it acts as our processor under a written agreement, may use the data only to provide that service to us, and we will tell you which service it is if you ask.
Automated decisions. We do not take decisions about you based solely on automated processing that have legal or similarly significant effects on you.
No sale, no advertising. We do not sell personal data and do not share it for advertising.
Q5 · DistributionWho else receives it?
- Hetzner Online GmbH (Germany) hosts this website; the server stands in Helsinki, Finland.
- Cloudflare, Inc. (United States) carries traffic to the website through its network and filters attacks. To do that it sees the same request data as our server, including your IP address.
- Google hosts our e-mail through Google Workspace, so messages to and from us pass through its systems.
- Apple and Google as app stores distribute our apps and take payment for them under their own privacy policies.
- Providers chosen for a client project — cloud hosting or AI model providers — only with the client’s agreement and under data processing terms.
- Advisers and authorities — accountants, auditors and lawyers bound by confidentiality, and public authorities when the law obliges us to disclose.
- A successor — if our business, or part of it, is sold or merged, the data connected to it passes to the new owner, which remains bound by this datasheet.
Q6 · TransfersDoes the data leave Europe?
Our web server is in the European Union. Cloudflare and Google are US companies, and their services can involve processing in the United States and in other countries where they operate. Where data protection law requires safeguards for such transfers, we rely on the EU–US Data Privacy Framework for recipients certified under it, and otherwise on the standard contractual clauses approved by the European Commission, with the UK addendum where UK law applies. You can ask us for a copy of the relevant safeguard.
Q7 · MaintenanceHow is the data kept safe, and when is it deleted?
Retention periods are listed in Q2. When a period ends, we delete the data or anonymise it so that it no longer identifies anyone. Backups that still hold deleted data are overwritten on their normal cycle.
We protect personal data with measures that fit the risk: encrypted connections (HTTPS) for the whole website, servers that accept administrative logins only with cryptographic keys, access limited to the people who need the data for their work, and the return or deletion of client data at the end of a project in the way the contract sets out. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the supervisory authority as the law requires.
Q8 · Your controlsWhat can you ask us to do?
Under the GDPR and similar laws, you can ask us:
- to confirm whether we hold data about you and give you a copy;
- to correct data that is wrong or incomplete;
- to delete data, or to restrict how we use it;
- to hand over data you gave us in a machine-readable format, or send it to someone else;
- to stop using data on the ground of legitimate interests — we will then stop unless we have compelling reasons that override yours, or need it for a legal claim;
- to withdraw consent at any time, where consent is what we rely on.
Write to support [at] deon-investment.com. We answer within one month; for complex requests the law lets us extend this by two further months, and we will tell you if we need to. We may ask for something that confirms your identity first. If your request concerns data we hold for a client, we will pass it to that client and help it respond.
You may also complain to a data protection supervisory authority. Ours is the Commissioner for Personal Data Protection of the Republic of Cyprus; you can equally turn to the authority of the EU country where you live or work, or where you believe the problem arose. We would appreciate the chance to fix things first.
Q9 · VersionsHow will changes be announced?
Each revision of this datasheet gets a new version number and date at the top of this page. If a change affects how we use data you have already given us, we will tell the people we are in contact with by e-mail before it takes effect. Previous versions are available on request.