Privacy notice

Ship From Cyprus is the controller of the personal data described here. We operate from Limassol, Cyprus. For anything in this notice, email hello@shipfromcyprus.com.

We hold only what the service needs to work:

• Account details — your name, email address, telephone number and country, and the suite number we issue you.
• Delivery addresses — recipient name, address and phone number for each place you ship to. Carriers will not accept an international shipment without a phone number.
• Parcel records — the retailer, inbound tracking number, weight, dimensions, declared value, condition notes, and photographs taken at intake.
• Contents declarations — descriptions, quantities, values and where given, HS codes, used to complete customs paperwork.
• Shipment and billing records — quotes, invoices, payment references and tracking numbers.
• Freight enquiries — the contact details, commodity, dimensions and weights you submit on the freight form.
• An identity document — only if you choose to upload one. See section 4.

We do not run advertising or analytics trackers, and we do not build profiles of you for marketing.

• To operate your suite and forward your parcels — performance of our contract with you.
• To complete customs declarations — compliance with a legal obligation, and performance of our contract.
• To take payment and keep accounting records — performance of our contract, and legal obligation under Cyprus tax law.
• To answer support requests and handle claims — our legitimate interest in running the service and defending claims.
• To prevent misuse of the service — our legitimate interest in security, and compliance where the law requires it.

We do not send marketing email unless you ask for it, and you can withdraw that at any time without affecting the service.

An identity document is not required to open an account or to ship. Some destinations and higher-value exports ask for identity evidence on the customs paperwork; where that applies we will ask, and you may upload a document in advance to save a round trip.

If you do upload one it is stored in a private, access-controlled bucket, is never shared with retailers or other customers, and is disclosed only to a customs authority where a specific shipment requires it. You can ask us to delete it at any time, and we will unless a shipment then in progress depends on it.

• Carriers — FedEx, Cyprus Post and any carrier you choose receive the recipient’s name, address and phone number and the contents declaration, because they cannot deliver without them.
• Customs authorities — in Cyprus and at the destination, the declaration and supporting documents.
• Our service providers, acting on our instructions under contract: Supabase for the database, file storage, authentication and sign-in emails; Vercel for hosting; Stripe for card payments.
• Professional advisers and authorities where we are legally required to disclose.

Card details go directly to Stripe and never reach our servers. We do not sell personal data, and we do not share it for anyone else’s marketing.

Our database and file storage are hosted in the EU. Some providers and most carriers necessarily process data outside the EEA — a shipment to Australia cannot be delivered without sending the address to Australia.

Where a provider processes personal data outside the EEA we rely on an adequacy decision where one covers the country, or on the European Commission’s standard contractual clauses. Transfers to carriers and customs authorities to perform your shipment are necessary for the contract you have asked us to carry out.

• Account details — while your account is open, then two years, so we can answer a later query.
• Parcel photographs and condition notes — two years from shipment, the practical window for a carrier or retailer claim.
• Customs declarations, invoices and accounting records — for the period Cyprus tax and customs law requires, currently six years.
• Identity documents — deleted once the shipment that needed them has cleared, or on request, unless a legal obligation requires us to keep them for longer.

Under the GDPR you may ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate;
• delete it, where we no longer need it and no legal obligation requires us to keep it;
• restrict or object to how we use it;
• provide it in a portable format, or send it to another provider, where it was given to us and is processed by automated means.

Email hello@shipfromcyprus.com and we will respond within one month. We may ask you to confirm who you are first. Exercising these rights is free.

We use strictly necessary cookies only — the session cookie that keeps you signed in, and the short-lived cookie used during sign-in. There are no advertising, analytics or third-party tracking cookies on this site, which is why you are not being asked to accept any.

Blocking the session cookie in your browser will prevent you from signing in, but the public pages will still work.

Data is encrypted in transit and at rest. Access to customer records is restricted to staff who need it, parcel photographs and identity documents sit in private storage reachable only through short-lived signed links, and our database enforces per-customer access rules so one account cannot read another’s records.

If a breach occurs that is likely to present a risk to you, we will notify the Office of the Commissioner for Personal Data Protection and, where the risk is high, tell you directly.

Tell us first and we will try to put it right. You also have the right to complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the supervisory authority where you live.

The current version of this notice is always on this page with its revision date. Where a change materially affects you we will tell you by email.

Questions about this notice, or about what we hold on you, go to hello@shipfromcyprus.com. Our terms of service explain the service itself.