Privacy Policy

PALEO HOLDINGS LTD, registration number HE 448604, incorporated in the Republic of Cyprus, registered office Filippou 11, Agios Dometios, 2363 Nicosia, Cyprus, trading as Visionmost, decides why and how the personal data described in this policy is processed.

Privacy correspondence goes to app@visionmost.com and is handled by a partner of the firm.

Where you write to us, apply to work with us, or are a contact at a client company, we are the controller and this policy applies.

Where our engineers work inside a client’s platform and encounter personal data belonging to that client’s users, we act only as a processor, under a written agreement made under Article 28 GDPR. In that role we follow the client’s documented instructions, we do not use their data for any purpose of our own, and the applicable privacy notice is the client’s, not this one. Our standard practice is to work against anonymised or synthetic datasets wherever the task allows it.

• Enquiries. Your name, email address, the organisation you write on behalf of, and the contents of your message.
• Engagement administration. Names and business contact details of client personnel, meeting notes, agreements, invoices and payment records.
• Applications. Where you apply for a role, the CV and materials you send and our notes from any interview.
• Server logs. IP address, user agent, request path and timestamp, generated automatically when a page is served.

This site carries no advertising pixels, no session-recording script, no cross-site identifiers and no third-party analytics that profile visitors. We do not buy or enrich contact data, we do not operate a marketing list you have not asked to join, and we do not request special category data at any point in an enquiry or an engagement.

• Answering enquiries and preparing proposals — legitimate interests (Article 6(1)(f)); the interest is running a professional services firm, and the processing is limited to ordinary business correspondence.
• Delivering agreed work and invoicing for it — performance of a contract (Article 6(1)(b)).
• Keeping statutory books and tax records — legal obligation (Article 6(1)(c)) under Cyprus company and tax legislation.
• Recruitment — steps taken at your request prior to entering a contract, and legitimate interests in keeping a short record of the decision.
• Site availability and abuse investigation — legitimate interests in keeping our infrastructure secure.

We use a deliberately short list of suppliers: a European cloud region for hosting, a business email and document suite, an accounting platform, and a payment institution for transfers. Each is bound by a data processing agreement, and none is permitted to use data we pass to them for their own purposes. A current list is available on request to app@visionmost.com, and clients under an Article 28 agreement are notified before a subprocessor changes.

Data stays in the European Economic Area by default. Where a supplier processes data outside the EEA, the transfer is covered by the European Commission’s Standard Contractual Clauses together with a transfer assessment we keep on file and review annually.

• Enquiries that do not lead to an engagement — 12 months.
• Engagement records and correspondence — 3 years from the end of the engagement.
• Statutory accounting records — 6 years.
• Unsuccessful applications — 6 months, or longer only if you ask us to keep them.
• Server logs — 60 days.

At the end of a retention period data is deleted from live systems, and from backups as those backups rotate out.

You have the right of access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. Write to app@visionmost.com from the address the data concerns, or tell us how else to verify the request. We respond within one month and free of charge.

If our response does not resolve the matter, you may complain to the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, or to the supervisory authority in your country of residence. Where we act as a processor, direct the request to the client that engaged us — we will forward it to them without delay if it reaches us first.

visionmost.com sets no cookies. Page requests are counted from server logs in aggregate, without a persistent identifier, which is why you are not asked to dismiss a consent banner here. If we ever introduce a cookie beyond the strictly necessary, consent will be requested first and this section will be rewritten before that happens.

Access to enquiry and engagement data requires multi-factor authentication and is granted per engagement rather than firm-wide. Access is reviewed quarterly and on every joiner or leaver. If a personal data breach occurs that is likely to result in a risk to individuals, we notify the Commissioner within 72 hours of becoming aware of it and inform affected people directly where Article 34 requires it. Where we are a processor, we notify the client without undue delay and support their own notification.

This page is the authoritative version. When it changes, anyone in active correspondence with us is told by email if the change affects them materially.