Skip to content
ExamPass CY
Sign in

Privacy Policy

Last updated: October 2026

1. Who we are

ExamPass CY is operated by an individual based in the European Union. For all privacy and data-related enquiries, contact us at: support@exampasscy.com

This policy will be updated once a legal entity is formally registered.

2. What data we collect and why

Account data

When you create an account, we collect your email address. This is required to provide access to purchased products and to send transactional emails (order confirmation, password reset). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Product update emails

If you are a customer, or you asked to be notified through a form on this site, we occasionally email you about new features and improvements to ExamPass CY. Legal basis: our legitimate interest in keeping customers informed about the service they use (Art. 6(1)(f) GDPR) or, for sign-up forms, your consent (Art. 6(1)(a) GDPR). Every such email has an unsubscribe link, and you can opt out at any time by writing to support@exampasscy.com.

Regulatory Brief emails

If you subscribe to the ExamPass CY Regulatory Brief, we email you short summaries of new regulatory publications: an email for each new update and a weekly digest on Mondays. We first send you a confirmation email and add you to the list only after you confirm. Our email provider, Resend, keeps your choice if you turn either part off. We process your email address, the option you signed up for and a record of your consent: the version of the sign-up wording you agreed to, the page where you signed up, the date and time of your sign-up, confirmation and any unsubscribe, and the IP address and browser user agent of those requests. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 106(1) of Cyprus Law 112(I)/2004). The consent record is kept to show that we had your consent (Art. 7(1) GDPR).

You can withdraw your consent at any time, free of charge, with the link in every email (turn off either part, or both) or by writing to support@exampasscy.com; we stop sending straight away. Withdrawing consent does not affect emails sent before. We do not track whether you open these emails or click their links.

Payment data

Payments are processed by Stripe, Inc. We do not store your card details. Stripe may process personal data in accordance with their own privacy policy. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Usage data (analytics)

With your consent, we use Google Analytics 4 to collect anonymised information about how visitors use this site (pages visited, session duration, country). This data does not identify you personally. Legal basis: consent (Art. 6(1)(a) GDPR). You may withdraw consent at any time via the cookie settings banner.

Technical data

Our hosting provider (Vercel) automatically processes IP addresses and request logs for security and performance purposes. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

3. Cookies

We use the following types of cookies:

  • Essential cookies — required for authentication and secure checkout (Supabase session, Stripe).
  • Analytics cookies — Google Analytics 4, only set with your consent.

You can accept or reject non-essential cookies via the banner shown on your first visit. You may change your preference at any time by clearing your browser cookies and revisiting the site.

4. Data processors

We share your data with the following third-party processors:

  • Supabase — database and authentication hosting (EU region where available)
  • Stripe, Inc. — payment processing
  • Vercel, Inc. — website hosting
  • Resend (Plus Five Five, Inc.) — email delivery (account, order and product update emails, and the Regulatory Brief: subscriber contacts, mailing lists and sending)
  • Upstash, Inc. — rate limiting to protect the service from abuse (IP addresses, EU region)
  • Google LLC — analytics (only with consent)

All processors are subject to data processing agreements and, where applicable, Standard Contractual Clauses for transfers outside the EEA.

5. How long we keep your data

  • Account data — for as long as your account is active, plus 2 years
  • Payment records — 7 years (legal obligation)
  • Analytics data — 14 months (Google Analytics default retention)
  • Regulatory Brief — your subscription details while you are subscribed; after you unsubscribe, the consent record for 3 years and your email address on a do-not-email list for as long as we run the Regulatory Brief, so that you are not added again by mistake. Sign-ups that are never confirmed are deleted within 3 months.

6. Your rights

Under GDPR, you have the right to:

  • Access — request a copy of your personal data
  • Rectification — correct inaccurate data
  • Erasure — request deletion of your data
  • Portability — receive your data in a portable format
  • Objection — object to processing based on legitimate interest and, at any time, to direct marketing, including product update emails and the Regulatory Brief (Art. 21(2)–(3) GDPR)
  • Withdraw consent — at any time, for consent-based processing

To exercise any of these rights, contact us at support@exampasscy.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Cyprus data protection authority: Office of the Commissioner for Personal Data Protection (ODPC).

7. Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Continued use of the site after changes constitutes acceptance of the updated policy.

8. Contact

For any privacy-related questions: support@exampasscy.com