Privacypolicy.

Who we are

Axenor Consulting is a consulting firm based in Limassol, Cyprus. We build and grow websites, client platforms and automations, and we run search, AI search, social and advertising work for our clients. For the purposes of the General Data Protection Regulation (GDPR) and the Cyprus data protection law, Axenor Consulting is the controller of the personal data described on this page.

You can reach us about anything on this page at info@axenorconsulting.com.

What this policy covers

This policy covers the website axenorconsulting.com, the messages you send us through it, and the personal data we handle while preparing a proposal for you or delivering work under an engagement. Where a client engagement involves personal data belonging to the client's own customers, we handle that data under the client's instructions and a written agreement, and the client's own privacy notice applies to it.

What we collect

Information you give us. When you send the Start a project form, what you type reaches our inbox as an email, delivered through our website's server, and is saved in our own enquiry records, held with Amazon Web Services in London: your name, your email address, your phone and company if you add them, the services you select, and the address of the page you sent it from. The same applies to anything you send us by email, phone, LinkedIn or a scheduling link.

The AI readability check. When you run the check, our server fetches the public pages of the site you enter: its homepage, robots.txt and sitemap. The domain you checked is recorded in our server logs for 30 days to prevent abuse, and the IP address of your connection is used only for a rate-limit counter that expires within hours. If you ask for the fix plan, your email address, your first name if you give it and your answer about what matters most reach our inbox together with the results and are saved in the same enquiry records, and we use them to send the plan and at most two follow-ups about it.

Information collected automatically. Like every website, ours produces server logs when a page is requested: the IP address of the requesting device, the browser and operating system, the page requested, the referring page and the time. These logs are kept by our hosting provider for security, capacity and abuse prevention, and we do not use them to identify visitors.

Fonts. The site loads its typefaces from Google Fonts, which means your browser requests font files from Google's servers and Google receives your IP address as part of that request. We are moving the fonts onto our own hosting so that this request stops.

Analytics. The site uses Google Analytics 4, provided by Google Ireland Limited, in Google's consent mode. Until you accept analytics cookies in the banner, and if you decline, Google Analytics sets no cookies and stores nothing on your device: it sends Google only cookieless signals that a page was viewed, with the time, the page, your browser and your consent choice, and no identifier that links one visit to another. Google uses these to estimate overall visitor numbers. If you accept, Google Analytics also sets first-party cookies (_ga and _ga_*, kept for up to 13 months) and records the pages you view, how you arrived, the time spent, your approximate location derived from your IP address, and your browser, device and screen size. Google Analytics 4 does not log or store IP addresses. We use this only as aggregate statistics about how the site is used, we do not combine it with anything else we hold about you, and Google signals and advertising features are off. The site sets no advertising cookies.

Why we use it and on what legal basis

To answer your enquiry and prepare a proposal, because you asked us to (steps taken at your request before entering into a contract, Article 6(1)(b) GDPR).

To deliver the services you have engaged us for, invoice them and keep the records the law requires (performance of a contract and compliance with legal obligations, Articles 6(1)(b) and 6(1)(c)).

To keep the website secure (our legitimate interest in running a safe and working site, Article 6(1)(f)).

To understand, in aggregate, how the site is used through Google Analytics. Cookie-based measurement runs only if you accept analytics cookies (your consent, Article 6(1)(a), which you can withdraw at any time through Cookie settings at the bottom of every page). The cookieless signals sent before or without consent carry no identifier and are used only for aggregate visitor counts (our legitimate interest in knowing how much the site is used, Article 6(1)(f)).

To send you information about our services after an enquiry or engagement, which you can stop at any time with one reply (legitimate interest, Article 6(1)(f), or your consent where the law requires it).

We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

How long we keep it

Enquiries that do not lead to an engagement, including fix-plan requests from the AI readability check, are kept for up to 24 months, so that we can pick the conversation up where it stopped, and then deleted.

Client records, including contracts, correspondence and the work itself, are kept for the duration of the engagement and for the retention period required by Cyprus tax and company law, which is currently six years after the end of the relevant financial year.

Server logs are kept by our hosting provider for a short rolling period, typically 30 days, unless they are needed to investigate a security incident.

Who we share it with

Service providers who process data on our behalf and under our instructions: our website hosting and content delivery provider (Amazon Web Services, which also delivers the website's forms to our inbox and holds our enquiry and client records), our email and document platform (Microsoft 365), our scheduling tool, Google (for Google Analytics), and the tools we use in client work such as analytics, search console, advertising and social media platforms in the client's own accounts.

Professional advisers such as accountants, auditors and lawyers, where necessary for our own compliance or to protect our rights.

Public authorities, where the law requires it or a lawful request is made.

We do not share personal data with anyone else, and we never give it to third parties for their own marketing.

Transfers outside the European Economic Area

Some of our providers operate from or have infrastructure in the United Kingdom and the United States. Where personal data leaves the European Economic Area, we rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified US providers) or on the Standard Contractual Clauses approved by the Commission, together with the technical measures the provider offers such as encryption in transit and at rest.

Your rights

Under the GDPR you can ask us to confirm whether we hold personal data about you and to give you a copy, to correct data that is wrong, to delete data we no longer have a reason to keep, to restrict how we use it, to receive the data you gave us in a portable format, and to object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time without affecting what was done before.

To exercise any of these rights, email info@axenorconsulting.com. We answer within one month, and we may ask you to confirm your identity first.

If you are not satisfied with our answer, you can complain to the Commissioner for Personal Data Protection of the Republic of Cyprus at dataprotection.gov.cy, or to the supervisory authority of the country where you live or work.

Cookies

Strictly necessary storage. The site keeps a few values in your browser that it needs to work, such as remembering a setting you chose on a page and remembering your cookie choice (axenor-consent, in local storage, kept until you clear it). These do not track you across sites and do not need consent.

Analytics cookies. Google Analytics sets _ga and _ga_* cookies, kept for up to 13 months, but only after you click Accept in the cookie banner. Until then, and if you click Decline, no analytics cookie is set; Google Analytics sends only the cookieless signals described above.

Changing your mind. Use Cookie settings at the bottom of any page to accept or decline again. Declining after you accepted stops collection and deletes the Google Analytics cookies from your browser. You can also clear or block cookies in your browser settings at any time; the site will keep working.

Changes to this policy

When we change how we handle personal data, we update this page and the date at the top of it. If a change is significant and we hold your contact details, we will tell you directly.