We are committed to protecting your privacy.

Deloitte Cyprus (hereinafter referred to as “Data Controller” or “we” or “us”) is committed to protect your privacy and processing your data in a clear and transparent manner.

This privacy notice is intended for the website https://www.deloitte.com/cy/en.html (“Deloitte Site” or “this Site”), whilst it does not apply to other websites that could potentially be accessed by clicking from external URLs. We encourage visitors to review the privacy notice on each of these other websites before disclosing any personal data.

Specifically, this privacy notice applies to each of the Cyprus legal entities belonging to the Deloitte network (the Deloitte network being Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), together with its member firms and their respective subsidiaries, affiliates, and other firms with which it constitutes a network called the “DTTL network”), with registered office address at 24 Spyrou Kyprianou Avenue, 1075 Nicosia, Cyprus.

Each Deloitte Cyprus entity is a separate and independent legal entity, and this privacy notice applies to each separately. None of the Deloitte Cyprus entities have any liability for the other entities’ acts or omissions.

This privacy notice describes how we process personal data about while browsing Deloitte Site, in accordance with the European General Data Protection Regulation 2016/679 (GDPR), the Cyprus local Data Protection Law 125(I)2018, all the applicable data protection laws and regulations. It provides evidence of the nature of the personal data collected by the Data Controller, the purposes of the processing and indicates your rights in relation to the data processed and who to contact for further information or to send any requests.

In particular, this privacy notice sets out how we will collect, handle, store and protect information about you when:

• Providing services to you or our clients;
• You use our website;
• Performing any other activities that form part of the operation of our business, as described in further detail below.

We may prepare a specific privacy notice that we invite you to consult, in relation to certain services or in the context of personal data collection forms (e.g., when sending applications for job positions).

Protecting the privacy of minors is extremely important for us. Please be aware, however, that this Site and our services are not directed to minors. It is not our policy to collect or retain such data.

The Data Controller is Deloitte Cyprus (incl. but not limited to Deloitte Limited, Deloitte Investment Services Limited and Deloitte Actuarial Services Limited) based in 24 Spyrou Kyprianou Avenue, 1075 Nicosia.

The Data Protection Officer can be contacted at the following e-mail address: cyprivacy@deloitte.com

We may collect personal data from users while browsing this Site or when requesting the activation of certain services through the appropriate forms / data collection forms.

The personal data collected by the Data Controller could include:

• Name, surname, age, date of birth, gender, telephone number, e-mail address, residential address;
• Job position, company / organization for which you work, professional title;
• IP address browser type and language, access time, complaint details;
• Details of how you like to interact with us, and other similar information relevant to our relationship;
• Any other personal information which you may provide to us for the purpose of receiving our services and/or using our products;

We may also acquire information about users by obtaining it from the interaction patterns carried out on the Site. For example, to improve the experience of using this Site and ensure its proper functioning, we (or our service providers) may use cookies (small text files installed in the user's browser) and a web beacon that collects personal data. Further information on how to use cookies, and how to manage them can be found in the Cookie Notice at the following link https://www.deloitte.com/cy/en/legal/Cookies.html?icid=bn_cookies

In exceptional cases, we could also process special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs). However, if this should occur, we will request the user's consent to collect and use such information.

Personal data provided to us could be used for the following purposes:

1. To enable the navigation of this Site;
2. For the performance of services requested and the management of activities instrumentally related to such services;
3. To send insights, opinions, updates, reports on topical issues or details of our products and services that we think might be of interest to you, to contact you to invite you to events, seminars, briefings, and business development purposes;
4. To send targeted advertising from third parties through profiling cookies;
5. To fulfil legal obligations, to comply with requests from Authorities, public entities, and organizations to exercise rights, including those of third parties, in court and, where applicable, in administrative proceedings or arbitration or conciliation procedures.
6. To manage our infrastructure, business operations, comply with internal policies and procedures, and enhance the security of our network and information systems.
7. To recruitment purposes

In relation to the above-mentioned purposes, please refer to paragraph 10 to find out which rights you can exercise

We will use your personal data for the purposes indicated above on the assumption of the following conditions of legitimacy (legal basis):

• With reference to the purposes (a) and (b) of par. 4, the need to perform a contract of which the user is a party or in order to take steps at the request of the user prior to entering into a contract;
• With reference to the purpose (c) of par. 4, the user's consent to receive this kind of information (with exception of existing clients to which we may send the information on basis of our legitimate interest in accordance with applicable law.
• With reference to the purpose (d) of par. 4, the user's consent to the use of these cookies;
• With reference to the purpose (e) of par. 4, the fulfillment of legal obligations to which we are subject.
• With reference to the purpose (f) of para. 4, the reliance our legitimate interests provided your interests and fundamental rights do not override such interests.
• With reference to the purpose (g) of para. 4, the reliance our legitimate interests. Note: (1) a separate privacy notice is given to job applicants. (2) We will rely on a different legal basis and a separate privacy notice in relation to the processing of personal data concerning successful job candidates (i.e. Deloitte professionals).

The communication of the user's personal data with reference to the purposes (a), (b) (contractual obligations), and (e) (legal obligations), is necessary for the use of the services requested and for the execution of legal obligations; any refusal to provide them will make it impossible for us to perform the aforementioned services.

As for the purposes (c) and (d), the communication of personal data is optional, and its refusal or objection will have no consequence on the services requested. To disable profiling cookies, please refer to the Cookie Notice of this Site.

Your personal data will not be published, exposed, or made available and / or consulted by indeterminate subjects.

In connection with one or more of the purposes set out in the paragraph 4, we may disclose information about you to:

• Companies belonging to the Deloitte Network for the performance of internal administration activities;
• Third parties delegated and/or appointed by us for the performance of activities or part of the activities related to the provision of the services requested or to the navigation of this Site (e.g., companies that provide IT services, management, and maintenance of this Site);
• Competent authorities (including courts), for the performance of their institutional functions within the limits established by laws or regulations;
• Third parties for the installation of cookies as required by the Cookie Notice of this Site.

Your data will be communicated to these third parties after being appointed as Data Processors or recognized as autonomous Data Controllers and will be processed by collaborators and/or employees of Deloitte in the context of their respective functions and in accordance with the instructions given by Deloitte itself.

If necessary for the purposes stated above, the data collected may be transmitted or made accessible to other companies in the Deloitte       Network, to entities that provide services to us and/or the Deloitte Network (e.g., vendors, suppliers), to competent authorities (e.g., courts, tax authorities, regulatory authorities) including those based in other countries, which may include countries outside Switzerland or outside the European Economic Area (EEA). Third parties to whom your personal data are transferred, are bound by specific agreement and are required to keep your data securely.

In such cases, we guarantee that the transfer will take place in accordance with the provisions of Chapter V of the GDPR through the adoption of appropriate safeguards that ensure a level of data protection in accordance with the obligations to which it is legally bound, such as, Standard Contractual Clauses, Binding Corporate Rules, other applicable legal basis or based on a statutory exemption (e.g. if you have given your consent to the transfer, if the transfer is directly connected with the conclusion or performance of a contract with you or if the transfer is necessary for the establishment, exercise or enforcement of legal claims before a foreign authority).

If you have any questions about this, please contact us at cyprivacy@deloitte.com

The information systems and computer programs used by us are configured in such a way as to minimize the use of personal data.

We will retain personal data on the basis of the following criteria:

• With reference to the purposes (a) and (b) of par. 4 for the period necessary to allow navigation of this Site and the performance of the requested service;
• With reference to purpose (c) and (d) of par. 4 until the consent (where applicable) is withdrawn or according to the timing provided in the Cookie Notice;
• With reference to the purpose (e) of par. 4, for the duration established by legal provisions, including those provided for the protection of our rights or third parties in the event of litigation or defensive investigations;
• With reference to the purpose (f) and (g) of par. 4, the period necessary to fulfill and satisfy the legitimate interests that we pursue.

We will process your data with the utmost care and respect.

Your personal data are processed with the aid of electronic tools, ensuring the use of appropriate measures for the security of the processed data and guaranteeing their confidentiality, in accordance with the principles applicable to the processing of personal data pursuant to Article 5 of the GDPR, such as lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality.

These measures can include:

• The training and updating activities of its staff ensuring that they are informed about privacy obligations if they have access to and process personal data;
• Administrative, organisational and technical controls in order to limit access only to personal data that need to be known in relation to the purposes of the processing;
• Technical security measures (e.g., firewalls, cryptography, antivirus software);
• Physical security measures.

In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any possible data breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. Third parties will only process your personal data where they have agreed to treat the data confidentially and to keep it secure in compliance with the applicable law.

In relation to the processing of your personal data, you have specific rights under GDPR:

• Access: you can ask for confirmation as to whether or not a certain processing of data concerning you is in place, as well as further clarifications about the information referred to in this privacy notice;
• Rectification: you can ask to rectify or supplement the data you have provided to us, if inaccurate;
• Erasure: you can request that your data be deleted, if they are no longer necessary for our purposes, in case of withdrawal of consent or your opposition to the processing, in case of unlawful processing, or there is a legal obligation to erase them;
• Restriction: you can request that your data be processed only for the purpose of storage, with the exclusion of other processing activities, for the period necessary for the correction of your data, in case of unlawful processing for which you oppose the cancellation, if you have to exercise your rights in court and the data stored by us may be useful to you and, finally, in the event of opposition to the processing and a review is in progress on the prevalence of our legitimate reasons over yours;
• Object: you can object at any time to the processing of your data, unless there are our legitimate reasons to proceed with the processing that prevail over yours, for example for the exercise or our defence in court;
• Withdrawal: you may revoke your consent at any time, in all cases where consent is the legal basis for processing. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.
• Portability: you can ask to receive your data, or to have them transmitted to another Data Controller indicated by you, in a structured format, commonly used and readable by automatic device.

Processing activities are carefully evaluated to ensure a fair balance between your rights, which are assessed on a case-by-case basis (e.g., by considering the respective legal basis in each case and the purposes of the processing) and our interests. To exercise these rights, you can contact us at cyprivacy@deloitte.com

The time limit for Deloitte Cyprus to address your request is 1 month, which may be extended up to 2 further months in cases of particular complexity.

We also inform you that you have the right to lodge a complaint with the Supervisory Authority for the protection of personal data: the Office of the Commissioner for Personal Data Protection in Cyprus.

We may modify or amend this Privacy Notice from time to time at our discretion. When we make changes to this notice, we will amend the revision date at the top of this page, and such modified or amended Privacy Notice will be effective from that revision date. We therefore invite you to regularly consult our Privacy Policy in order to stay up to date with any changes made since your last consultation.