Andoia Advisory
Discuss your matter

Legal

Privacy

This Privacy Notice explains how Andoia Advisory Ltd processes personal data when you use this website, contact the firm or arrange a meeting.

1. Who is responsible for your personal data

The controller responsible for the processing of personal data is:

Company
Andoia Advisory Ltd
Registered country
Cyprus
Registration no.
HE 483685
Registered office
Chysonera Rosemarine 37 Office 15, 8574 Kissonerga, Cyprus

2. When you contact Andoia

If you contact Andoia through the website contact form or by email, personal data provided as part of your enquiry may be processed. This may include your name, company, email address, telephone number where provided, and the information contained in your message.

The information is processed in order to respond to your enquiry, understand the matter you wish to discuss and manage subsequent communications.

Where your enquiry concerns a potential engagement, the processing is based on Article 6(1)(b) GDPR because it is necessary to take steps at your request before entering into a contract.

For other business enquiries, processing may be based on Article 6(1)(f) GDPR. Andoia’s legitimate interest is to respond to enquiries addressed to the firm and to manage its professional communications.

Please do not include controlled technical data or other sensitive information in an initial enquiry.

3. Booking a meeting

If you use the booking link provided on this website, personal data required to arrange and manage the meeting will be processed.

Where the meeting relates to a potential engagement, processing is based on Article 6(1)(b) GDPR. In other cases, it may be based on Andoia’s legitimate interest under Article 6(1)(f) GDPR in arranging and managing requested business meetings.

The booking function is provided through Microsoft Bookings, an external appointment scheduling service operated by Microsoft. That service may process personal data in connection with the booking in accordance with the applicable contractual and data protection arrangements.

4. Website operation

When you visit this website, limited technical information may be processed automatically where this is necessary for the reliable and secure operation of the website. This may include information such as an IP address, the time of access and technical information transmitted by your browser.

Where such processing takes place, it is based on Article 6(1)(f) GDPR. Andoia’s legitimate interest is the secure and reliable operation of its website.

This website is hosted by Alfahosting GmbH, Edmund-von-Lippmann-Straße 13-15, 06112 Halle (Saale), Germany, which processes this information as a processor on behalf of Andoia.

Information about cookies and similar technologies is provided in the Cookies Notice.

5. Recipients of personal data

Personal data may be processed by service providers that support Andoia with website operation, business communications and appointment scheduling.

Personal data may also be disclosed where this is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

Andoia does not disclose personal data to third parties for their own advertising purposes.

6. International transfers

The website, including the WordPress installation, is hosted in Germany. Email and the appointment booking function are provided through Microsoft 365 under a contract with Microsoft Ireland Operations Ltd, and personal data processed through these services are stored within the European Union.

Access from outside the European Economic Area cannot be ruled out entirely, for example in the context of technical support. Where such a transfer takes place, it is based on the European Commission’s standard contractual clauses and, where applicable, on Microsoft’s certification under the EU-US Data Privacy Framework.

No other transfers to countries outside the European Economic Area take place.

7. How long personal data are kept

Personal data are kept only for as long as necessary for the purpose for which they were collected.

Information relating to an enquiry is normally retained while the enquiry is being handled and for as long thereafter as reasonably necessary in connection with the resulting business relationship, applicable legal obligations or the establishment, exercise or defence of legal claims.

Where an engagement results from an enquiry, information may be retained as part of the relevant client or business records for the applicable retention period.

8. Your rights

Subject to the conditions set out in the GDPR, you may have the right to:

  • obtain access to your personal data;
  • request correction of inaccurate or incomplete personal data;
  • request erasure of personal data;
  • request restriction of processing;
  • object to processing based on legitimate interests;
  • receive certain personal data in a portable format; and
  • withdraw consent at any time where processing is based on consent.

You can exercise your rights by contacting info@andoia.com.

Where processing is based on legitimate interests, you have the right to object on grounds relating to your particular situation.

9. Complaints

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

Andoia is established in Cyprus. The competent supervisory authority is the Office of the Commissioner for Personal Data Protection, Cyprus.

Further information about submitting a complaint is available from the Commissioner’s official website.

10. Changes to this Privacy Notice

This Privacy Notice may be updated where Andoia’s processing activities, website functionality or applicable legal requirements change.

Last updated: September 2026