Bank of Cyprus Cultural Foundation Privacy Statement

Bank of Cyprus Cultural Foundation (BOCCF) (referred to as ‘we’, ‘us’, ‘our’) is committed to protecting your privacy and handling your data in an open and transparent manner. The personal data that we collect and process depends on the product or service requested and agreed in each case.

This privacy statement:

  • provides an overview of how BOCCF collects and processes your personal data and tells you about your rights under the local data protection law and the EU General Data Protection Regulation (‘GDPR’),
  • is directed to natural persons who are either current or potential customers of the BOCCF), or are authorised representatives/agents or beneficial owners of legal entities or of natural persons which/who are current or potential customers of the BOCCF) is directed to natural persons who had such a business relationship with the BOCCF) in the past,
  • is directed to natural persons who had such a business relationship with the BOCCF in the past,
  • contains information about when we share your personal data with other members of the Bank of Cyprus Group and other third parties (for example, our service providers or suppliers).
  • In this privacy statement, your data is sometimes called “personal data” or “personal information”. We may also sometimes collectively refer to handling, collecting, protecting and storing your personal data or any such action as “processing” such personal data.
  • For the purposes of this statement, personal data shall mean any information relating to you which identifies or may identify you and which includes, for example, your name, address, identification number.

1. Who we are

Bank of Cyprus Cultural Foundation is an institution registered in Cyprus with registration number 42 having its registered office and head offices at Faneromenis 86-90, 1011 Nicosia, PO Box 21995, 1515 Nicosia, Cyprus.

If you have any questions, or want more details about how we use your personal information, or if you want to exercise any of your rights, please contact us at

  • Tel. Nu.: 22 128157,
  • Email:,
  • or Complete the web form through our website (

We endeavour to address all of your requests promptly.

2. What personal data we process and where we collect it from

BOCCF collect and process different types of personal data which we receive from our suppliers, subscribers to our mailing lists, collaborators in organizing events and projects and customers. Additionally, we obtain personal data from the Bank to be included in the Bank of Cyprus Historical Archive. Specifically, when necessary for the reasons specified in paragraph 4, we collect the name and surname, the email address, the postal address, the fax number from the subscribers in our mailing list kept for distributing information to individuals interested in our activities, the parents of children who attend our educational programs, our suppliers and customers. We also collect the age as well as the first name of children who attend educational programs.

The Bank of Cyprus Historical Archive keeps personal data of Bank of Cyprus employees, shareholders, customers and suppliers.

3. Children’s data

We understand the importance of protecting children’s privacy. We may collect personal data in relation to children only provided that we have first obtained their parents’ or legal guardian’s consent or unless otherwise permitted under law. For the purposes of this privacy statement, “children” are individuals who are under the age of eighteen (18).

4. Whether you have an obligation to provide us with your personal data

In order that we may be in a position to proceed with a relationship with you, you must provide your personal data to us which are necessary for the required commencement and execution of a relationship and the performance of our contractual obligations. You must, therefore, provide us at least with your identity card/passport, your full name, place of birth (city and country), and your residential address so that we may comply with our statutory obligations.

Kindly note that if you do not provide us with the required data, then we will not be allowed to commence or continue our business relationship either to you as an individual or as the authorized representative/agent or beneficial owner of a legal entity.

5. Why we process your personal data and on what legal basis

As mentioned earlier we are committed to protecting your privacy and handling your data in an open and transparent manner and as such we process your personal data in accordance with the GDPR and the local data protection law for one or more of the following reasons:

  • A. For the performance of a contract BOCCF process personal data in order to perform transactions and offer services based on contracts with our customer but also to be able to complete our acceptance procedure so as to enter into a contract with prospective customers or associates. The purpose of processing personal data depends on the requirements for each product or service and the contract terms and conditions provide more details of the relevant purposes.
  • B. For compliance with a legal obligation There may be legal obligations emanating from the relevant laws to which we are subject as well as statutory requirements which impose on us necessary personal data processing activities.
  • C. For the purposes of safeguarding legitimate interests We process personal data so as to safeguard the legitimate interests pursued by us or by a third party. A legitimate interest is when we have a business or commercial reason to use your information. But even then, it must not unfairly go against what is right and best for you.
    • Examples of such processing activities include:
      • Initiating legal claims and preparing our defence in litigation procedures,
      • Setting up CCTV systems, e.g. for the prevention of crime or fraud,
      • Measures to manage business and for further developing products and services.
      • Maintaining historical data from Bank of Cyprus records for the purpose of historical and scientific research.
  • D. You have provided your consent Provided that you have given us your specific consent for processing (other than for the reasons set out hereinabove) then the lawfulness of such processing is based on that consent. You have the right to revoke consent at any time. However, any processing of personal data prior to the receipt of your revocation will not be affected.

6. Who receives your personal data

In the course of the performance of our contractual and statutory obligations your personal data may be provided to various departments within the Bank but also to other companies of the Bank of Cyprus Group. Various service providers and suppliers may also receive your personal data so that we may perform our obligations.

Such service providers and suppliers enter into contractual agreements with the BOCCF by which they observe confidentiality and data protection according to the data protection law and GDPR. It must be noted that we may disclose data about you for any of the reasons set out hereinabove, or if we are legally required to do so, or if we are authorized under our contractual and statutory obligations or if you have given your consent.

All data processors appointed by us to process personal data on our behalf are bound by contract to comply with the GDPR provisions.

Under the circumstances referred to above, recipients of personal data may be, for example:

  • Auditors and accountants,
  • Marketing companies and market research companies,
  • Card payment processing companies, such as JCC Payment Systems Ltd,
  • File storage companies, archiving and/or records management companies, cloud storage companies,
  • Companies who assist us with the effective provision of our services to you by offering technological expertise, solutions and support and facilitating payments,
  • Purchasing and procurement and website and advertising agencies,
  • We also note that the Bank of Cyprus Historical Archive gives data to researchers only after the passing of thirty years from the creation of the data and does not give personal data to researchers even after the passage of this period.

7. How we treat your personal data for marketing activities and whether profiling is used for such activities

We may process your personal data to tell you about products, services and offers that may be of interest to you. We can only use your personal data to promote our products and services to you if we have your explicit consent to do so or, in certain cases, if we consider that it is in our legitimate interest to do so. You have the right to object at any time to the processing of your personal data for marketing purposes by contacting us accordingly.

8. How long we keep your personal information for

We will keep your personal data for as long as we have a business relationship with you [as an individual or in respect of our dealings with a legal entity you are authorized to represent or are beneficial owner].

Once our business relationship with you has ended, we may keep your data for up to ten (10) years in accordance with the directive of the Data Protection Commissioner ( We may keep your data for longer than 10 years if we cannot delete it for legal, regulatory or technical reasons. Personal Data retained in the Bank of Cyprus Historical Archive are kept for longer periods than those stated above as these are kept for historical and scientific research purposes.

9. Your data protection rights

You have the following rights in terms of your personal data we hold about you:

  • Receive access to your personal data. This enables you to e.g. receive a copy of the personal data we hold about you and to check that we are lawfully processing it. In order to receive such a copy you can complete our web form found at
  • Request correction [rectification] of the personal data we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.
  • Request erasure of your personal information. This enables you to ask us to erase your personal data [known as the ‘right to be forgotten’] where there is no good reason for us continuing to process it.
  • Object to processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground. If you lodge an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms.

You also have the right to object where we are processing your personal data, for direct marketing purposes. This also includes profiling inasmuch as it is related to direct marketing. If you object to processing for direct marketing purposes, then we shall stop the processing of your personal data for such purposes. Request the restriction of processing of your personal data. This enables you to ask us to restrict the processing of your personal data, i.e. use it only for certain things, if:

  • it is not accurate,
  • it has been used unlawfully but you do not wish for us to delete it,
  • it is not relevant any more, but you want us to keep it for use in possible legal claims,
  • you have already asked us to stop using your personal data but you are waiting us to confirm if we have legitimate grounds to use your data.
  • Request to receive a copy of the personal data concerning you in a format that is structured and commonly used and transmit such data to other organisations. You also have the right to have your personal data transmitted directly by ourselves to other organisations you will name [known as the right to data portability].
  • Withdraw the consent that you gave us with regard to the processing of your personal data at any time. Note that any withdrawal of consent shall not affect the lawfulness of processing based on consent before it was withdrawn or revoked by you.
  • Right to lodge a complaint If you have exercised any or all of your data protection rights and still feel that your concerns about how we use your personal data have not been adequately addressed by us, you have the right to complain by completing our on line contact form ( You also have the right to complain to the Office of the Commissioner for Personal Data Protection. Find out on their website how to submit a complaint (

10. Changes to this privacy statement

We may modify or amend this privacy statement from time to time. We will notify you appropriately when we make changes to this privacy statement and we will amend the revision date at the top of this page. We do however encourage you to review this statement periodically so as to be always informed about how we are processing and protecting your personal information.

11. Cookies

Our website use small files known as cookies to make it work better in order to improve your experience. To find out more about how we use cookies please see our cookie policy.