1. Who is responsible
The controller for the website and enquiries addressed to Mplato is Platorum invest Ltd, HE 415042, Arch. Makariou III, 233B, Faethon House, Flat 1027, Kanika, Cyprus. Email: [email protected]. You may contact us by email or at our registered office about this notice and your rights.
2. Information we process
When you browse, hosting and security systems may process your IP address, request time, requested page, browser or device information and technical error records. If you email us or submit an inquiry, we receive your name, email, message, selected area of interest and any optional company, telephone and country details. Email may also contain attachments. We record the inquiry date, language, handling status and the version of the privacy notice acknowledged. The inquiry form does not constitute an investment application or accept payments. Staff have a separate, restricted administration area. Please do not send identification documents, bank details or sensitive personal data in an initial enquiry.
3. Purposes and legal bases
We also retain short-lived hashed rate-limit keys and attempt counts to prevent form abuse and password guessing. Staff credentials are stored as salted password hashes and authenticated sessions are stored server-side. We use technical data to deliver and secure the website and diagnose faults, relying on our legitimate interests in maintaining a reliable service (GDPR Article 6(1)(f)). We handle ordinary business enquiries on the same basis, namely our interest in communicating with prospective partners and responding to requests. Where your request concerns steps towards a contract with you, Article 6(1)(b) may apply. We process information required by an applicable legal obligation under Article 6(1)(c). Where consent is the appropriate basis, we request it separately; you may withdraw it without affecting prior lawful processing. Merely visiting the website does not constitute consent to marketing.
4. Sharing and international transfers
Access is limited to people who need the information for the stated purpose. Relevant recipients may include hosting, IT security and email service providers, professional advisers and public authorities where disclosure is required by law. We do not sell enquiry data or use it for advertising profiles. If processing involves a transfer outside the European Economic Area, the transfer must have an applicable GDPR Chapter V basis, such as an adequacy decision or appropriate contractual safeguards, with additional measures where necessary. Contact us for information about recipients, transfer arrangements and a copy of applicable safeguards.
5. How long information is retained
Technical records are kept only for the period needed to operate the service, investigate faults and resolve security incidents. Enquiry correspondence is retained while handling your request and any resulting business discussions. When those purposes end, information is deleted or anonymised unless an applicable legal obligation or a necessary legal claim requires further retention. The relevant criteria are the enquiry’s status, the continuing business relationship, applicable statutory duties and limitation periods, and any active dispute. Retention must be reviewed against those criteria.
6. Your choices and rights
Subject to the GDPR’s conditions, you can request access, correction, erasure, restriction and portability of your data. You may object to processing based on legitimate interests, including on grounds relating to your particular situation, and may always object to direct marketing. You may withdraw consent where processing relies on it. Contact us at [email protected]; proportionate identity checks may be needed. Requests are normally answered within one month; if a lawful extension is needed, we will explain it within that first month. Submitting an inquiry is voluntary. Name, email and message are required to handle it; other contact fields are optional. The privacy checkbox records acknowledgement of this notice, not consent to marketing. We may be unable to answer without sufficient information. The website does not use automated decision-making producing legal or similarly significant effects.
7. Complaints and security
You can complain to the Cyprus Commissioner for Personal Data Protection or another competent supervisory authority, including in the EU/EEA country where you live or work. You do not have to contact us first. We use access restrictions and appropriate technical and organisational measures; no online system can guarantee absolute security. The website is not directed at children and does not solicit their information.
8. Changes and scope
The date above identifies this version. Material changes to processing will be reflected in this notice and communicated as required. The Cookie Policy explains browser storage; third-party websites reached through external links have their own notices.