Privacy Notice

1. Introduction

The Company COWIN LIMITED (hereinafter referred to as the “Company”, “we”, “us”, or “our”), is committed to respecting your privacy and takes it seriously.

The Company is headquartered at Arch. Makariou III, 205, Victory House, 1st Floor, 3030 Limassol, Cyprus, and is the owner of the Website https://co-win.io/ . The Company further maintains official accounts on social media platforms, including Instagram, Facebook and LinkedIn (collectively, the “Digital Channels”).

The Company informs visitors, users, clients, and any other natural persons who interact with it (collectively referred to as the “Users”) about the type and scope of personal data it collects and processes in its capacity as a Data Controller, including when Users visit the Website, access or receive the Company’s products or services, or otherwise communicate or engage with the Company.

The Company assures Users that any processing of personal data is carried out in their best interests, adhering to the principles of lawfulness, transparency, accuracy, availability, and integrity at all stages of processing, and in compliance with the General Data Protection Regulation (EU) 2016/679 (the “GDPR”), the Cyprus Law 125(I)/2018 on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of such Data, and the relevant guidelines and/or recommendations of the Office of the Commissioner for Personal Data Protection (collectively the “Legislation”).

This Privacy Notice does not apply to the processing of personal data of employees, contractors, job applicants, or other personnel, which is governed by a separate internal privacy notice.

This Notice should be read together with our Cookie Policy and Terms of Use.

2. Data Controller

The Data Controller of your personal data is COWIN LIMITED, a company incorporated in the Republic of Cyprus under registration number ΗΕ430762 , with its registered office at Omirou 21, Minerva House Block B, Floor 3, Flat/Office 31, Agios Nikolaos, 3095 Limassol, Cyprus. Email: [email protected]

3. Collection and Use of Personal Data

When using the term “Personal Data” in this Notice, we mean data that relates to you and allows us to identify you, either directly or in combination with other data that we may hold.

The Company collects and processes personal data in accordance with the Legislation in the following instances:

• When Users utilise any of the Company’s products and/or services;
• When Users visit the Website and/or interact with the Company’s promotional or advertising activities, including participation in giveaways, competitions, or other promotional campaigns organised by the Company or its affiliates/partners;
• When Users receive the Company’s products and/or services by signing a contract or agreement with the Company, during the pre-contracting period, when cooperating with the Company, or when participating in events related to the offer of the Company’s products and services;
• When Users communicate with the Company through its digital channels, by email, by telephone, or through any other means of communication;
• When data are automatically collected through cookies, log files, analytics tools, or other tracking technologies while Users visit or interact with the Company’s Website;
• When we receive personal data from trusted third parties, affiliates, business partners, or publicly available sources;

We use your information lawfully in accordance with:

• Article 6 (1)(a) of the GDPR i.e. for purposes you have consented to;
• Article 6 (1)(b) of the GDPR i.e. as necessary to conclude or perform a contract with you;
• Article 6 (1)(c) of the GDPR i.e. to comply with obligations imposed by law (such as tax legislation);
• Article 6 (1)(f) of the GDPR, i.e., as necessary for legitimate interests we pursue as a Company, provided these are not overridden by your rights and freedoms

We process personal data for the following legitimate and specified purposes:

• Fulfilment of the Company’s contractual or pre-contractual obligations;
• Delivery of communications concerning new services, offers, or operational changes to the Website;
• Compliance with the Company’s legal obligations;
• Establishment, exercise, or defence of legal claims;
• Detection and prevention of fraud, misuse, or security incidents
• Support our internal operations such as billing, reporting and administration;

In addition, certain data are automatically collected when visiting the Website, such as:

• IP address;
• Operating system type and version;
• Browser type;
• Pages visited, timestamps and connection/traffic data to and from the Website;

Such automated collection serves to improve the Website’s technical and functional performance, ensure system security, and support aggregated statistical analysis.

We do not use automated decision-making or profiling in a way that produces legal or similarly significant effects on you.

We will not intentionally collect special categories of data from you such as personal data concerning your race, political opinions, religion, health or sexual orientation, unless you have chosen to provide that type of personal data to us. If you do for any reason, such data will be processed strictly in accordance with GDPR Article 9, with additional safeguards and only where legally permitted.

4. Data retention

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, along with applicable legal requirements.

Where processing is carried out to comply with legal obligations or for the establishment, exercise, or defence of legal claims, the relevant data are retained for the period stipulated by applicable law and/or for as long as necessary to fulfil such purposes, as appropriate to each case.

Where processing is based on consent (e.g., certain marketing), we will process your data until you withdraw your consent. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

5. Your Rights

Data subject rights are exercised within the limits provided by the legislation and may be subject to certain legal exceptions or limitations.

The Company has appointed a Data Protection Officer responsible for overseeing compliance. To exercise any of the rights outlined below, have any questions or comments with regard to this Privacy Notice, you may contact us by email at [email protected]

We will aim to respond to your request within one month of receipt. This may be extended by up to two additional months, if necessary, due to the complexity or number of requests. We may request further information to verify your identity. Requests are handled free of charge unless they are manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or refuse to act.

You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection via www.dataprotection.gov.cy, if you believe your rights have been infringed.

5.1 Right of Access

You have the right to access your personal data free of charge, except in cases where a reasonable fee may be imposed to cover administrative costs, such as where requests are manifestly unfounded, excessive or repetitive, or where additional copies of the same data are requested.

5.2 Right to Rectification

You have the right to request the rectification of your personal data if they are inaccurate or incomplete.

5.3 Right to Erasure

You have the right to request the erasure of your personal data when they are no longer necessary for the purposes for which they were collected or there is no legal basis for continuing their processing.

This right is not absolute and may be limited where a legal obligation or other lawful basis exists for retaining the data.

5.4 Right to Restriction of Processing

In specific cases, you may request the restriction or suspension of processing. Where processing is restricted, your data will only be stored and not otherwise processed, except as permitted by law

5.5 Right to Object

You may object, at any time and for reasons relating to your particular situation, to the processing of your personal data, unless the Company demonstrates compelling and legitimate grounds for such processing.

5.6 Right to Data Portability

You may request to receive the data you have provided in a structured, commonly used, and machine-readable format or request that it be transmitted to another controller.

5.7 Right to Withdraw Consent

You may withdraw your consent at any time, where processing is based on consent. The withdrawal shall not affect the lawfulness of processing carried out prior to such withdrawal.

6. Disclosure of Personal Data to Third Parties

The Company may transfer or disclose personal data to:

• Third parties delegated and/or appointed by us for the performance of activities or part of the activities related to the provision of the services requested or to the navigation of the Website;
• Payment service providers
• Cloud hosting providers(such as Amazon Web Services)
• Our affiliated companies or business partners, for internal management, billing, services, and products, and for the overall delivery of our services to you.
• Agencies and authorities, if required by law. We may reveal your personal data to any law enforcement agency, court, regulator, government authority, or in connection with any legal action if we are required to do so to meet a legal or regulatory obligation, where the request is proportionate, or otherwise to protect our rights or the rights of anyone else (for example, in response to a valid and properly served legal process such as subpoena or warrant). If we have your contact details, we will take reasonable steps to attempt to notify you prior to disclosing your data unless (i) prohibited by applicable law from doing so, or (ii) there are clear indications of unlawful conduct in connection with your use of our services(iii) is impracticable or unreasonable under the circumstances.
• Sponsors and Partners, for the purposes of selecting and notifying winners when you participate in any of our competitions and giveaways. We may also share your data with entities offering any prize you have won in order for that entity to contact you about such a prize.
• Service providers, consultants, potential transaction counterparties, or other third parties, in connection with the negotiation, evaluation, or completion of any transaction in which we are involved, including mergers, acquisitions, liquidations, or business transfers.
• the extent this is necessary to fulfil any other purpose not mentioned above for which you provided personal information and, if applicable, your consent separately from this Privacy Notice.

We do not disclose, sell, rent, or otherwise share your Personal Data with third parties or unaffiliated entities for their own independent use, unless expressly provided for in this Notice or with your prior consent. We may share data that does not reasonably identify you, to the extent permitted by applicable law.

7. Third-Party Interactions

Our Website may include content, banners, or links directing you to third-party Websites, platforms, or materials. Please note that this Notice does not apply to, and we are not responsible for the privacy, security, or data processing practices of such third parties, including any tracking technologies they may use. Accessing or using such third-party content is at your own risk. We encourage you to review the relevant privacy policies, terms of use, and security practices of those entities before engaging with their content or services.

8. Data Security

We implement appropriate technical and organisational security measures to protect personal data from loss, unauthorised access, alteration, or misuse. These include:

• Access control systems
• Encryption and anonymisation where required
• Secure storage and transfer protocols
• Restricted access to authorised personnel
• Staff training on data protection
• Incident response mechanisms
• Regular testing and review of security measures to ensure ongoing effectiveness

In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know.

Despite our efforts, we bring to your attention that no information system can be entirely secure, therefore, we cannot guarantee the absolute security of your information, nor can we be held responsible for the security of any information transmitted to us via networks beyond our control.

9. International Transfers of your Personal Data

Due to the global nature of the Internet and the services we provide, the collection and processing of your personal data in accordance with this Privacy Notice may involve the transfer of such data to countries in which we, our service providers, or our strategic partners are located. Where personal data is transferred to a country or territory outside the European Union (EU) or European Economic Area (EEA) whose laws may provide a different level of protection for personal data than that afforded under Cyprus Law 125(I)/2018 and the General Data Protection Regulation, we ensure that such transfers are carried out in compliance with the legislation. In particular, we implement appropriate safeguards, including entering into contractual arrangements such as the European Commission’s Standard Contractual Clauses (“SCCs”) or other mechanisms recognised under Chapter V of the GDPR, to ensure that your personal data is processed to a standard that is at least equivalent to that required under the legislation.

10. Minors

The Company does not knowingly process personal data relating to children or minors under the age of 14, unless such processing is lawful and only to the extent that consent is provided or authorised by the holder of parental responsibility. We will make reasonable efforts, taking into account available technology, to verify that such consent is indeed given or authorised by the holder of parental responsibility.

11. Changes to this Notice

The Company reserves the right to amend, revise, or update this Notice from time to time in order to reflect changes in legal, regulatory, or operational requirements. Any such amendment, revision, or update shall take effect immediately upon its publication on the Website. The “Last Updated” date appearing at the beginning of this Notice shall be deemed to indicate the date on which the most recent version entered into effect.

Users are advised to review this Notice periodically to remain informed of its current terms and any updates.