Privacy Policy
Data Controller
Effective date: 14 April 2026 This Privacy Policy describes how Buhl Consulting Ltd. (Registration No. HE 329258) collects, uses, stores, and protects your personal data when you use the Pundo platform at https://pundo.cy. Data Controller: Buhl Consulting Ltd. Kimonos 1, Apt 104, 7040 Oroklini, Larnaka, Cyprus Email: info@pundo.cy
Personal Data We Collect
Data you provide directly: • Account information (name, email address, password, preferred language) • Communications with us (emails, contact forms, feedback) • User content (product photos, reviews, ratings) • Shop Partner data (business name, contact person, address, email, phone, tax ID, banking details) Data collected automatically: • Usage data (pages visited, search queries, products viewed, interaction patterns) • Device information (device type, operating system, browser type and version) • Location data (approximate location from IP address, or precise location with your explicit consent) • Log data (IP address, access timestamps, error reports)
How We Use Your Data
We process your personal data for the following purposes: • Providing and maintaining the Service — performance of contract • Creating and managing your account — performance of contract • Personalising your experience — legitimate interest • Communicating with you about the Service — performance of contract / legitimate interest • Sending marketing communications (with your consent) — consent • Analysing usage patterns and improving the Service — legitimate interest • Ensuring security and preventing fraud — legitimate interest • Complying with legal obligations — legal obligation
Cookies and Analytics
Strictly necessary cookies are required for the Service to function (session management, language preferences, security) and cannot be disabled. Analytics: We use Plausible Analytics, a privacy-focused, self-hosted tool. Plausible does not use cookies, does not collect personal data, and is fully GDPR-compliant without requiring cookie consent. Our Plausible instance runs on our own infrastructure at plausible.pundo.cy — your analytics data never leaves our servers. Functional cookies remember your preferences (e.g. preferred language, location).
Data Sharing
We do not sell, rent, or trade your personal data to third parties. We may share your data with trusted service providers: • Hosting: Hetzner Online GmbH, Germany • Email service providers (transactional communications) • Payment processors (for Shop Partner transactions) • Translation services (for multilingual content) All service providers are contractually required to process your data only on our instructions and in accordance with applicable data protection law. We may disclose your data if required by law or to protect our rights, prevent fraud, or protect user safety.
International Data Transfers
Your data may be transferred to and processed in countries outside the EEA. Where such transfers occur, we ensure appropriate safeguards are in place (adequacy decisions, Standard Contractual Clauses). Our primary hosting infrastructure is located within the EU (Hetzner, Germany).
Data Retention
We retain your personal data only as long as necessary: • Account data: for the duration of your account and 24 months after deletion • Analytics data: aggregated and anonymised, may be retained indefinitely • Communication data: 36 months after your last communication • Shop Partner data: duration of contract plus 6–8 years (Cyprus tax and commercial law) • Log data: up to 12 months
Your Rights (GDPR)
Under GDPR you have the following rights: • Right of access (Art. 15) — request a copy of your personal data • Right to rectification (Art. 16) — correct inaccurate data • Right to erasure (Art. 17) — request deletion of your data • Right to restriction (Art. 18) — restrict processing in certain circumstances • Right to data portability (Art. 20) — receive your data in machine-readable format • Right to object (Art. 21) — object to processing based on legitimate interests • Right to withdraw consent (Art. 7(3)) — withdraw consent at any time To exercise your rights, contact us at info@pundo.cy. We will respond within 30 days. You may also lodge a complaint with the Office of the Commissioner for Personal Data Protection, Republic of Cyprus: Iasonos 1, 1082 Nicosia, Cyprus Phone: +357 22 818 456 Website: www.dataprotection.gov.cy
Children's Privacy
The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we may have collected such data, please contact us at info@pundo.cy.
Security
We implement appropriate technical and organisational security measures: • Encryption of data in transit (TLS/SSL) • Hashed and salted password storage • Access controls and authentication • Regular security assessments • Data minimisation practices No method of internet transmission is completely secure. We cannot guarantee absolute security.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date, post the revised Policy on the Platform, and notify registered users by email for significant changes.
Contact
Buhl Consulting Ltd. Kimonos 1, Apt 104 7040 Oroklini, Larnaka, Cyprus Email: info@pundo.cy Website: https://pundo.cy