ISS FORENSICS
Privacy policy
Effective date: 27 September 2026.
This notice concerns visitors to iss.com.cy and initial enquiries to ISS Forensics. It is prepared under the General Data Protection Regulation (EU) 2016/679 (GDPR) and Cyprus Law 125(I)/2018, as amended. It does not replace the information and arrangements required for a particular service engagement.
1. Who is responsible
The data controller is ISS INFORMATION SECURITY SERVICES LTD, trading as ISS Forensics. Company registration: HE 358428. VAT number: CY10358428Y. Address: 47 Athinon, 7103 Aradippou, Larnaca, Cyprus. Alexis Mavros is the contact for enquiries about this notice.
2. Information we receive
If you contact us by email, telephone or WhatsApp, we receive the contact details and information you choose to provide, such as your name, organisation, contact number and a general description of your enquiry. Please provide only what is necessary. Providing enquiry details is voluntary; without sufficient information we may be unable to respond or assess the requested service.
Depending on its configuration, our hosting provider may process technical access and security records, such as IP address, request time and the requested page, to operate and protect the website.
The website has no contact or evidence-upload form, user accounts, online payments, comments, newsletter registration or advertising.
3. Why we use information
We use enquiry information to respond and, where you request steps towards a contract with us, to assess your requirements or prepare a proposal (Article 6(1)(b) GDPR). This basis applies only where the processing is necessary for those steps and you are the prospective contracting individual.
For other enquiries, including those made by representatives of an organisation, we rely on our legitimate interest in handling business communications. Necessary technical logs support the availability and security of the website. We assess necessity and balance these interests against your rights (Article 6(1)(f)).
Where a specific law requires processing, for example to deal with a data-protection request or a binding lawful demand, we rely on that obligation (Article 6(1)(c)). Necessary enquiry records may be preserved to establish, exercise or defend legal claims on the basis of our legitimate interests (Article 6(1)(f)), following a necessity and rights-balancing assessment and subject to applicable safeguards. We do not use this website for solely automated decisions or profiling that produce legal or similarly significant effects.
4. Sensitive information and case material
Do not send evidence, passwords, identity documents, health information or details of criminal allegations, offences or convictions in an initial enquiry. Contact us first to agree an appropriate transfer method and the scope of the engagement.
Case evidence is not uploaded through this website. Any later handling of case material is governed by the applicable law and the information and arrangements for that engagement. Where an engagement involves special-category or criminal-offence data, it is processed only where the legal bases and conditions of Articles 6, 9 and 10 GDPR and Cyprus law are met, as explained in the information provided for that engagement.
5. Who may receive information
Access is limited to people who need the information for the relevant purpose. Recipients may include our hosting provider, for storing and serving the website and supporting its technical security, and our email provider, for receiving, transmitting and storing correspondence. Their access is limited to information needed for the relevant service. Where a provider acts as a processor on our behalf, appropriate contractual safeguards and documented instructions are required.
Information may be disclosed to competent authorities where disclosure is legally required. WhatsApp processes communications and usage information under its own terms and privacy notice. We do not sell personal data.
6. Hosting and email within the EU
ISS's website hosting, email services and backups are provided with data stored and processed within the European Union.
WhatsApp and LinkedIn process information for their own purposes under their own privacy notices and may process it outside the European Economic Area (EEA). For more information about our providers, contact mavros@iss.com.cy.
7. How long information is kept
For enquiries that do not lead to an engagement, we keep the correspondence until the enquiry has been answered and any follow-up requested by you has been completed. If you or ISS decide not to proceed and no requested response remains outstanding, the enquiry is closed and its personal data are deleted or irreversibly anonymised, subject to the limited exceptions below.
Routine website access and security logs are kept for no more than 30 days from creation and are deleted sooner when they are no longer needed for their technical or security purpose. This is an ISS retention policy, not a statutory minimum retention period.
If particular records are needed to investigate an identified security incident or establish, exercise or defend a specific legal claim, only the relevant records are retained separately for that purpose. They are deleted when the investigation and any related proceedings or applicable appeal periods have ended, unless a specific legal obligation requires further retention. Such an obligation applies only to the records and period it actually covers.
Information that becomes part of an engagement follows the separate retention arrangements for that matter. The routine website-log period is not a retention rule for forensic evidence or case files.
8. Your rights and complaints
Subject to the conditions and exceptions in Articles 15–22 GDPR, you may request access, correction, erasure or restriction of processing. You may object to processing based on legitimate interests. Portability applies where the relevant requirements are met, including automated processing based on consent or a contract. If a particular use relies on consent, you may withdraw it without affecting earlier lawful processing.
Send a request to mavros@iss.com.cy or call +357 95 111555. Where we have reasonable doubts about your identity, we may seek only the additional information reasonably needed to confirm it. We respond without undue delay, within one month of receiving the request, unless a permitted extension applies. If a lawful extension is necessary because of complexity or the number of requests, we explain it within that month; the extension may be up to two further months.
You may complain to the Cyprus Commissioner for Personal Data Protection: Kypranoros 15, 1061 Nicosia, Cyprus; commissioner@dataprotection.gov.cy; +357 22 818456. You do not have to contact us first. You may also contact the supervisory authority in the EU Member State of your habitual residence, place of work or the alleged infringement.
9. Cookies and similar technologies
The public visitor pages do not set cookies or browser storage and contain no analytics, tracking pixels, advertising tools, embedded social widgets or externally loaded fonts or scripts. Their images, styles and scripts are served with the site. Ordinary links to external services do not embed those services in the page.
The hosting and security configuration can affect whether additional cookies or similar technologies are used. If cookies or similar technologies are introduced, information about their purpose and duration will be provided, and consent will be requested where required, before they are used.
10. Security
We apply appropriate technical and organisational measures to protect information against unauthorised access, loss or misuse, taking account of the risks and the services used. The website is not an evidence-transfer channel. No internet transmission or storage system can be guaranteed completely secure; please arrange sensitive transfers with us first.
11. External services
Selecting a WhatsApp or LinkedIn link takes you to an external service or application. Those providers process information under their own privacy notices and terms. Email and telephone links use your chosen application or service. You may use email or telephone instead of WhatsApp.
The "In the media" section contains ordinary links to media websites, which apply their own privacy policies.
12. Changes to this notice
This notice will be updated when relevant practices or legal requirements change. The effective date will be shown at the top. Where required, further information will be provided before information is used for a new purpose.