This notice explains how Rose Retiree Companions ("we") uses personal information. We are based in Paphos district, Cyprus, and the EU General Data Protection Regulation (GDPR) and Cyprus law apply. You can contact us about privacy at hello@roseretiree.com.

What we collect

When you join the waiting list or contact us: your name, email, phone (optional), your relationship to the person we'll visit, their first name and village, and anything you choose to tell us.
Card details: entered on Stripe's secure page. We never see or store your full card number; we only see the card type and last four digits.
For clients: name, address, family contacts, emergency contact, GP, allergies and preferences, visit notes and receipts. We never store ID numbers, bank cards, PINs or door codes.
Website visits: anonymous statistics (pages viewed, time on page, where the visit came from, country and device type). We don't use cookies for this and we don't store anything on your device. A daily-changing code lets us count a visit without knowing who you are; the key to that code is deleted every day.

Why we use it, and our legal basis

To reply to you and run the waiting list (steps before a contract, and our legitimate interest in replying).
To provide the service and bill for it (contract).
Wellbeing notes and photos: only with explicit written consent, which can be withdrawn at any time.
To keep accounts and tax records (legal obligation).
Anonymous website statistics to improve the site (legitimate interest). If your browser sends a Global Privacy Control signal, we don't record your visit at all.

Who we share it with

Only the family contacts named on the signed client form receive visit updates. We use a small number of service providers to run the business:

Stripe: card payments.
Cloudflare: website hosting and our database (EU and worldwide data centres).
Migadu: email (Switzerland).
WhatsApp: messages and photo updates to family, if you choose it.

Where providers handle data outside the EU, they use the safeguards the GDPR requires, such as Standard Contractual Clauses. We never sell personal information or use it for advertising.

How long we keep it

Waiting-list and client details are deleted 12 months after you leave or withdraw, except invoices, which we keep as long as tax law requires. Anonymous website statistics are kept for up to 25 months.

Your rights

You can ask to see, correct, move or delete your information, object to how we use it, or withdraw consent. Email us and we'll reply within a month. You can also complain to the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy) or, in the UK, the ICO.

Cookies

We only use one cookie, and only if you sign in to your account: it keeps you signed in. It is strictly necessary, so we don't need to ask for consent. We also remember your text-size choice on your device if you change it.