Privacy Policy

Last updated: 11 September 2026

1. Who We Are

P.Panagi & Sons Ltd (“we”, “us”, “our”) is a licensed customs clearing and forwarding agent registered in Cyprus. Our registered office is at the Cyprus Ports Authority Management Building, New Port, Limassol 3045, Cyprus.

We are the data controller for the personal data we collect through this website and in the course of providing our services. We are committed to protecting your privacy and handling your data in an open and transparent manner in accordance with the General Data Protection Regulation (GDPR) and the Processing of Personal Data (Protection of Individuals) Law of 2018 (Law 125(I)/2018) of Cyprus.

2. What Data We Collect

We collect and process the following categories of personal data:

2.1 Data You Provide Directly

Contact form submissions: full name, email address, phone number, and the content of your message.
Service enquiries: information about your shipment, goods, or customs requirements that you share with us by email, telephone, or in person.
Client onboarding: passport or identity card details, VAT registration numbers, EORI numbers, company registration details, and other information required by Cyprus Customs for the purposes of customs clearance.
Online assistant tools: the text of any questions and information you type into the interactive assistant tools on our website (such as the Transfer of Residence Assistant). See section 2.3 below.

2.2 Data Collected Automatically

Website analytics: if you accept our cookie banner, we use Google Analytics 4 to understand which pages are visited, how long for, and general browser/device type. See section 8 (Cookies) for details.
Server logs: IP addresses and access timestamps retained for security purposes for a maximum of 30 days.

2.3 Online Assistant Tools

Our website provides free interactive assistant tools, including the Transfer of Residence (TOR) Assistant, the Customs AI Assistant, and the HS Code and Import Duty tools. These tools are informational only and do not create a client relationship or a binding quotation.

When you use the Transfer of Residence Assistant, a transcript of your conversation — together with your IP address and the date and time — is sent by email to our staff so that we can understand your situation and follow up if you contact us. To generate the assistant’s replies, the messages you send are also processed by our AI technology provider, Anthropic, acting on our behalf.

Please do not enter passport numbers, bank or card details, or other sensitive personal information into these tools. If you need to share such information with us, please do so by email or in person.

3. How We Use Your Data

We use your personal data for the following purposes and on the following legal bases:

Purpose	Legal Basis
Responding to your enquiries and providing quotations	Legitimate interests (Article 6(1)(f) GDPR)
Performing customs clearance and forwarding services	Performance of a contract (Article 6(1)(b) GDPR)
Complying with Cyprus Customs, VAT, and other legal obligations	Legal obligation (Article 6(1)(c) GDPR)
Sending service-related communications (e.g. shipment updates)	Performance of a contract (Article 6(1)(b) GDPR)
Reviewing and following up on enquiries made through our online assistant tools	Legitimate interests (Article 6(1)(f) GDPR)
Improving our website and services	Legitimate interests (Article 6(1)(f) GDPR)

We do not use your personal data for automated decision-making or profiling. We do not sell your data to third parties. We do not send marketing emails without your explicit consent.

4. How We Share Your Data

In the course of providing customs clearance services, we are legally required to share certain personal and commercial data with:

Cyprus Customs (Tax Department of Cyprus): customs declarations, import/export entries, and supporting documents as required by EU and Cypriot customs law.
Cyprus VAT Service: where applicable for VAT purposes.
Shipping lines, freight forwarders, and port operators: to arrange the physical movement and release of your goods.
Our IT service providers: who process data on our behalf under data processing agreements and are bound by confidentiality obligations. This includes Anthropic (our AI technology provider), which processes the messages you send to our online assistant tools solely to generate the tool’s responses; SendGrid (Twilio), which we use to deliver email; and, only if you accept the cookie banner, Google Analytics (Google Ireland Limited), used for website analytics as described in section 8.

All third parties we work with are required to handle your data securely and only for the purposes for which it was shared.

5. International Transfers

Your data is primarily processed within the European Economic Area (EEA). Where we use service providers outside the EEA (for example, cloud storage), we ensure appropriate safeguards are in place in accordance with Chapter V of the GDPR, such as Standard Contractual Clauses approved by the European Commission.

6. How Long We Keep Your Data

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, and in accordance with our legal obligations:

Customs and commercial records: a minimum of 4 years as required by Cyprus Customs legislation, and up to 7 years for VAT-related records.
Contact form enquiries (no service provided): deleted after 12 months.
Online assistant tool conversations: transcripts received by email are kept with the related enquiry and deleted after 12 months if no service follows; if you go on to become a client, the transcript is retained with your client file.
Client records (service provided): retained for 7 years from the date of the last transaction.
Server logs: deleted after 30 days.

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access: you may request a copy of the personal data we hold about you.
Right to rectification: you may ask us to correct inaccurate or incomplete data.
Right to erasure: you may ask us to delete your data where there is no legitimate reason for us to continue processing it, subject to our legal retention obligations.
Right to restrict processing: you may ask us to limit how we use your data in certain circumstances.
Right to data portability: you may request your data in a structured, machine-readable format.
Right to object: you may object to processing based on legitimate interests.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at info@ppanagi.com or in writing at our registered address. We will respond within 30 days.

You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus (Commissioner’s Office, 1 Iasonos Street, 1082 Nicosia, Cyprus; www.dataprotection.gov.cy).

8. Cookies

This website uses strictly necessary cookies required for the site to function (e.g. remembering your cookie choice). These do not require consent under the ePrivacy Directive.

With your consent, we also use Google Analytics 4 (_ga, _ga_* cookies) to understand site traffic — pages visited, time on site, approximate location (country/city level), and device/browser type. These cookies do not identify you by name and are not shared for advertising purposes. Google retains this data for 14 months by default.

Analytics cookies are never set until you accept the cookie banner shown on your first visit. If you decline, no analytics cookies are set and no data is sent to Google. You can change your choice at any time using the “Cookie Preferences” link in the site footer, which lets you withdraw consent as easily as you gave it.

We do not use advertising cookies or social media tracking cookies.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. All data transmitted to and from this website is encrypted using TLS (HTTPS). Access to client data is restricted to authorised personnel only.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The “Last updated” date at the top of this page will be revised accordingly. We encourage you to review this page periodically.

11. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

P.Panagi & Sons Ltd
Cyprus Ports Authority Management Building
New Port, Limassol 3045, Cyprus
Email: info@ppanagi.com
Tel: +357 25 560175