Legal
Privacy Policy
How BLK Group Holding Ltd handles personal data collected through this website and through corporate correspondence.
Version 1.0
This policy explains what personal data BLK Group Holding Ltd collects through the website blkgroup.com and in corporate correspondence, why, who receives it, how long it is kept, and what rights you have.
In short: we are a holding company with no clients. This website has no accounts, no forms and no advertising. We hold your personal data only if you write to us, if you deal with us in a business capacity, or in the technical records every website keeps.
1. Who is responsible for your data
The controller is BLK Group Holding Ltd, a limited liability company incorporated in the Republic of Cyprus on 11 July 2024 under registration number HE 462698, with its registered office at Spyrou Kyprianou Avenue 67, 4003 Limassol, Cyprus. In this policy "we", "us" and "our" mean that company.
| Contact for data-protection matters | |
|---|---|
| info@blkgroup.com | |
| Post | BLK Group Holding Ltd, Data Protection, Spyrou Kyprianou Avenue 67, 4003 Limassol, Cyprus |
| Telephone | +357 25 820785 |
We have not appointed a data protection officer. We are not required to, because we do not carry out large-scale monitoring of individuals or large-scale processing of special categories of data.
2. What this policy covers
This policy covers:
- visits to the website blkgroup.com;
- emails, letters and calls between you and BLK Group Holding Ltd;
- business contacts of BLK Group Holding Ltd, such as people at its shareholders, advisers, suppliers, counterparties and regulators.
3. What this policy does not cover
BLK Group Holding Ltd is a holding company. It provides no services to clients, has no client relationships and holds no client funds or assets. It therefore does not collect client data.
The companies named on the website are separate legal entities and separate controllers. Each decides for itself how it uses personal data and publishes its own privacy notice. If you are a client of one of those companies, apply to become one, or use its website, that company's privacy notice applies, not this one.
We do not receive client data from those companies through this website. If you send us a request that is meant for one of them, we do not forward it. We tell you which company to contact and then delete your message in line with section 9.
4. Personal data we collect, and where it comes from
| Category | What it includes | Source |
|---|---|---|
| Correspondence | Your name, email address, telephone number, organisation and role, and the content of your message | You, when you email, write to or call us |
| Business contacts | Name, role, employer and business contact details of people at our shareholders, advisers, suppliers, counterparties, regulators and the media | You, your organisation, or public sources such as company registers, regulators' registers and your organisation's website |
| Corporate and statutory records | Identity, contact and shareholding details of our directors, officers, shareholders and beneficial owners, and of those of companies we hold or deal with, as company and anti-money-laundering law requires | The person concerned, the company concerned, and public registers |
| Technical data | IP address, date and time of each request, the page requested, the referring page, and browser and device type | Your browser, recorded automatically in server logs by our hosting provider |
| Usage statistics | Pages viewed, referring site, country or region, browser, operating system and device type, in aggregated form | Plausible Analytics, running on the website. See section 6 |
| Cookie choice | A random consent ID and your choice in the cookie banner | A cookie in your browser. See our Cookies Policy |
The website has no user accounts, no login, no contact form, no newsletter and no payment function.
We do not ask for and do not want special categories of data, such as health data, or data about criminal convictions. Please do not send them to us.
5. Why we use personal data, and our legal basis
| Purpose | Data used | Legal basis under the GDPR |
|---|---|---|
| Answering your enquiry and corresponding with you | Correspondence | Legitimate interests, Article 6(1)(f): representing the company and dealing with those who contact it |
| Managing relationships with shareholders, advisers, suppliers, counterparties and regulators | Business contacts | Legitimate interests, Article 6(1)(f): running the company. Where we have a contract with you personally, performance of that contract, Article 6(1)(b) |
| Keeping company registers and meeting company, tax, accounting and anti-money-laundering duties | Corporate and statutory records | Legal obligation, Article 6(1)(c) |
| Keeping the website secure and available, and detecting misuse | Technical data | Legitimate interests, Article 6(1)(f): the security of our systems |
| Understanding in aggregate how the website is used | Usage statistics | Legitimate interests, Article 6(1)(f): improving the website, using a method that stores nothing on your device and does not follow you across sites |
| Remembering your cookie choice | Cookie choice | Legal obligation, Article 6(1)(c), and legitimate interests, Article 6(1)(f): showing that the cookie rules are respected |
| Establishing, exercising or defending legal claims | Any of the above, as needed | Legitimate interests, Article 6(1)(f) |
Where we rely on legitimate interests, we have weighed them against your interests and rights and concluded that they are not overridden, because the data is limited, used as you would expect, and not used to make decisions about you. You may object at any time. See section 11.
Do you have to give us your data? Writing to us is voluntary. If you do not give us a way to reply, we cannot answer you. Data in corporate and statutory records is required by law.
What we do not do. We do not use personal data for advertising or direct marketing. We do not sell or rent it. We do not build profiles of visitors. We make no decisions by automated means, including profiling, that produce legal or similarly significant effects.
6. Website statistics
We measure visits with Plausible Analytics. Plausible uses no cookies and stores nothing on your device. It does not keep your IP address. To count visitors for one day, it creates an identifier from your IP address, your browser details, the website domain and a random value that is deleted every 24 hours. You therefore cannot be recognised from one day to the next, across devices or across websites. The statistics we see are totals, not records of individuals.
7. Who receives personal data
We share personal data only where there is a reason to, and only with the following.
| Recipient | Role | Location |
|---|---|---|
| Website hosting provider | Processor. Hosts the website and keeps server logs | |
| Email and office-software provider | Processor. Carries and stores our correspondence | |
| Plausible Insights OÜ | Processor. Website statistics, as described in section 6 | Estonia. Data is stored in the European Union |
| Cookie banner software (CookieYes) | Runs on our own server and sends no data to its supplier | |
| Lawyers, auditors, accountants and other professional advisers | Independent controllers bound by professional confidentiality | Cyprus and, where relevant, the country of the adviser |
| Companies in the BLK group | Only for corporate governance of the group, never for client matters | The country of the company concerned |
| Courts, the Registrar of Companies, tax authorities, regulators and law-enforcement bodies | Where the law requires disclosure | Cyprus and, where relevant, other countries |
Every processor acts only on our written instructions under a contract that meets Article 28 of the GDPR. If the company is reorganised, merged or sold, personal data may pass to the successor, which must continue to honour this policy.
8. Transfers outside the European Economic Area
We keep personal data within the European Economic Area where we can. Where a recipient is outside it, we transfer personal data only if one of the following applies:
- the European Commission has decided that the country gives adequate protection, as it has for the United Kingdom, Switzerland and Canada (commercial organisations);
- the recipient has signed the European Commission's standard contractual clauses, with additional measures where needed;
- another safeguard or exception in Articles 46 to 49 of the GDPR applies.
You can ask us which safeguard applies to a particular transfer and for a copy of it, using the contact details in section 1.
9. How long we keep personal data
| Data | Retention period |
|---|---|
| Correspondence and enquiries | 24 months after the last contact |
| Messages meant for a group company | 30 days after we have redirected you |
| Business contacts | For as long as the business relationship lasts, and 24 months afterwards |
| Corporate and statutory records | For the period the law requires, which for accounting and tax records is at least six years |
| Server logs | Up to 12 months |
| Usage statistics | Kept in aggregated form that does not identify you |
| Cookie choice | 12 months, or until you change it or delete the cookie |
We keep data longer only where the law requires it or where it is needed for a legal claim that has been made or is reasonably expected. When a period ends, the data is deleted or irreversibly anonymised.
10. Your rights
| Right | What it means |
|---|---|
| Access | To know whether we hold personal data about you and to receive a copy of it |
| Rectification | To have inaccurate data corrected and incomplete data completed |
| Erasure | To have data deleted where it is no longer needed, where you object and we have no overriding reason, or where it was processed unlawfully |
| Restriction | To have us store the data without using it while a dispute about accuracy or an objection is resolved, or where you need it for a legal claim |
| Objection | To object to processing based on legitimate interests. See section 11 |
| Portability | To receive data you gave us in a structured, machine-readable format, where we process it by automated means on the basis of consent or a contract |
| Withdrawal of consent | Where processing is based on consent, to withdraw it at any time. This does not affect what was done before |
| Complaint | To complain to a supervisory authority. See section 12 |
How to use your rights. Write to info@blkgroup.com or to our registered office and say which right you want to use. We may ask for information needed to confirm your identity.
When we answer. Within one month of receiving your request. For complex or numerous requests this can be extended by up to two further months, and we will tell you within the first month if so.
Cost. Using your rights is free. We may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, and we will explain why.
These rights are subject to the conditions and exceptions set by the GDPR and Cyprus law. If we cannot do what you ask, we will tell you the reason.
11. Your right to object
You may object at any time, on grounds relating to your particular situation, to our processing of your personal data based on legitimate interests. We will then stop, unless we show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.
We do not use personal data for direct marketing. If that ever changed, you could object to it at any time and we would stop without exception.
12. Complaints
Please contact us first, so that we can try to put things right. You also have the right to complain at any time to the supervisory authority in Cyprus:
| Office of the Commissioner for Personal Data Protection | |
|---|---|
| Address | 15 Kypranoros Street, 1061 Nicosia, Cyprus |
| Postal address | P.O. Box 23378, 1682 Nicosia, Cyprus |
| Telephone | +357 22 818 456 |
| commissioner@dataprotection.gov.cy | |
| Website | www.dataprotection.gov.cy |
You may instead complain to the supervisory authority of the EU or EEA country where you live or work, or where you believe the infringement took place.
13. How we protect personal data
We apply technical and organisational measures suited to the limited data we hold. They include encrypted connections to the website, access limited to the people who need it, written contracts with our processors, and deletion at the end of the retention periods in section 9.
If a personal data breach is likely to result in a risk to people's rights and freedoms, we notify the Commissioner within 72 hours of becoming aware of it. Where the risk is high, we also inform the people affected without undue delay.
14. Children
The website is intended for business and professional readers. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.
15. Other websites
The website links to the websites of group companies and of third parties. Those websites are operated by other controllers under their own privacy notices. We are not responsible for how they handle personal data.
16. Changes to this policy
We review this policy at least once a year and whenever our processing changes. The current version is always on this page with its effective date. If a change materially affects how we use your data, we will publish a notice on the website at least 30 days before it takes effect.
| Version | Summary of changes |
|---|---|
| 1.0 | First version in the name of BLK Group Holding Ltd. Replaces the earlier group-wide policy |