Privacy Policy

Last updated: 16 July 2026

We take the protection of your personal data seriously. We handle your personal data confidentially and in line with applicable data protection law (the EU General Data Protection Regulation, and the UK GDPR for visitors in the United Kingdom) and this Privacy Policy.

1. Data controller

The controller responsible for data processing on this website is:

Telephone: +44 (0) 20 4577 2223
Email:

2. Hosting

This website is hosted on Cloudflare Pages, a service of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare processes personal data on our behalf and is contractually required to apply appropriate technical and organisational measures to protect it. Transfers to the USA are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (DPF), supplemented by EU Standard Contractual Clauses as an additional safeguard.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in the reliable provision of the website).

3. Server log files

Each time you access our website, the hosting provider automatically records access data. This includes the name of the page requested, the date and time of the request, the volume of data transferred, the browser type and version, the operating system, the referrer URL, and the requesting IP address.

This information is stored for a short period for security purposes and then deleted. Data whose retention is required as evidence is exempt from deletion until the relevant incident has been resolved.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in ensuring trouble-free operation).

4. Cookies

This website does not use third-party tracking cookies. Our analytics tool (Plausible Analytics) works entirely without cookies.

We use one first-party cookie named attribution to attribute purchases to the marketing channel that first brought you to our website. It may contain campaign parameters, advertising click identifiers, the landing page, the date and time of the first visit, and an external referrer. The cookie lasts for 90 days and is available only to My Cyprus Wedding. When you start a paid-listing checkout, its attribution values are attached to the payment session at our payment provider Stripe (see section on payments) so we can attribute the purchase; beyond that, the data is not shared with third parties.

5. Spam protection (Cloudflare Turnstile)

To protect our forms from misuse and automated access, we use Cloudflare Turnstile, a service of Cloudflare, Inc. (address as above). When you use a form, your IP address, browser metadata, and interaction data are transmitted to and processed by Cloudflare. Transfers to the USA are based on the EU-US Data Privacy Framework and EU Standard Contractual Clauses. Further information is available in the Cloudflare privacy policy.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in preventing abuse and spam).

6. Web analytics (Plausible Analytics)

We use Plausible Analytics, a privacy-friendly analytics tool. Plausible collects no personal data, uses no cookies, and stores no IP addresses. Only aggregated, anonymous usage statistics are recorded (such as page views, referrer, device type, and privacy-safe events like button clicks). No data is used to identify individual visitors, and no cross-site tracking takes place.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in analysing website usage).

7. Contact and enquiry forms

We send messages generated by our forms through Resend (Resend, Inc., USA). Transfers to the USA are based on the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

Supplier enquiries. When you send an enquiry through a contact form, we collect the name, email address, and message you provide, along with any optional details you add (such as your wedding date, guest numbers, and the supplier your enquiry relates to). We use this to reply to you and, where your enquiry concerns a specific supplier, we may pass it to that supplier so they can respond. Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to a contract) and Article 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Newsletter. If you sign up for our newsletter, we collect your email address and add it to our mailing list (managed via Resend) so we can send you occasional updates. You can unsubscribe at any time using the link in every email, after which your address is removed. Legal basis: Article 6(1)(a) GDPR (consent); you may withdraw your consent at any time (Article 7(3) GDPR) without affecting the lawfulness of processing before withdrawal.

Business listings (“List your business”). If you apply to be listed, we collect the business name, contact name, email address, telephone number, website, chosen category and location, selected plan, and any notes you provide, in order to assess and set up your listing. Legal basis: Article 6(1)(b) GDPR (steps prior to a contract).

8. Payment processing (Stripe)

Where you make a payment (for example, for a business listing plan), we process it through Stripe (Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA; for customers in Europe, Stripe Payments Europe, Ltd.). When you pay, the data required for the transaction - such as your name, email address, billing address, and payment details (for example card number or IBAN) - is transmitted to and processed by Stripe. We do not store card or bank-account details ourselves. Transfers to the USA are based on the EU-US Data Privacy Framework and EU Standard Contractual Clauses. Stripe processes your data in accordance with its own privacy policy.

Transaction data is retained for as long as required by Cypriot accounting and tax law (generally six years).

Legal basis: Article 6(1)(b) GDPR (performance of a contract) and, for the retention of records, Article 6(1)(c) GDPR (compliance with a legal obligation).

9. Right of withdrawal

If you are a consumer, you have a statutory right to withdraw from a distance contract within 14 days, under the EU Consumer Rights Directive (2011/83/EU) as implemented in Cyprus. Where we provide an electronic withdrawal option and you use it, we process the details you supply - your name, the reference for your order (order number or the email address used for the purchase), and the email address to which we send confirmation - solely to handle and document your withdrawal and to send you acknowledgement on a durable medium (via Resend, see Section 7). We do not ask for a reason. Spam protection is handled by Cloudflare Turnstile (see Section 5).

The withdrawal record (name, order reference, contact email, and timestamp) is retained until the relevant withdrawal and limitation periods have expired, and is then deleted.

Legal basis: Article 6(1)(c) GDPR (compliance with a legal obligation) and Article 6(1)(f) GDPR (legitimate interest in documenting the withdrawal).

10. Business listings

Our directory publishes information about wedding businesses in Cyprus, including business names, descriptions, addresses, contact details, websites, aggregate review counts, and ratings. We process this publicly available business information to operate a useful wedding directory for couples planning in Cyprus. Legal basis: Article 6(1)(f) GDPR (legitimate interest).

Where a listing relates to a sole trader, owner-operated supplier, or named individual, it may include personal data. Listed businesses and individuals have the right to object to this processing and, where applicable, to request erasure.

If you are listed and would like your details corrected or removed, use the claim or remove a listing form or email . We honour removal requests within 14 days once we have enough detail to identify the listing.

11. Your rights

Under the GDPR you have the following rights:

• Right of access (Article 15): you can request confirmation of, and access to, the personal data we hold about you.
• Right to rectification (Article 16): you can ask us to correct inaccurate data.
• Right to erasure (Article 17): you can ask us to delete your data, unless a legal retention obligation applies.
• Right to restriction (Article 18): you can ask us to restrict processing of your data.
• Right to data portability (Article 20): you can ask us to provide your data in a structured, commonly used, machine-readable format.
• Right to lodge a complaint: you can complain to a supervisory authority. Our lead authority is the Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus. You may also contact the authority in your country of residence - for visitors in the UK this is the Information Commissioner’s Office (ICO).

12. Right to object (Article 21 GDPR)

Where we process your personal data on the basis of legitimate interests (Article 6(1)(f) GDPR), you have the right to object to that processing at any time. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests. You can send an objection informally to .

13. Provision of data

Providing personal data is neither legally nor contractually required. Using our forms is voluntary; without the details requested we cannot answer your enquiry, send you the newsletter, or set up a listing. Where you make a purchase, providing billing and payment details is necessary to perform the contract. Access data (Section 3) is collected automatically when you visit the website.

14. Automated decision-making

No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.

15. Data protection contact

For any questions about data protection, you can reach us at:

Email:
Telephone: +44 (0) 20 4577 2223

16. Changes to this policy

We may update this Privacy Policy to reflect changes to our services or legal requirements. The current version is always available on this page, with the “Last updated” date shown at the top.