Cyprus website privacy and cookies: prepare a real data map

Follow each piece of information

List forms, account creation, purchases, newsletter signups and support conversations. For each, note the information requested, the reason for collecting it, the system receiving it and who has access. Test the live website rather than describing only the intended design.

The European Commission’s data-protection framework is the regulatory background. Your operational map supplies the facts needed for a meaningful review of notices, lawful bases and responsibilities.

Official background: European Commission: EU data-protection framework.

Check what loads before a visitor acts

Inventory analytics, advertising pixels, embedded media and third-party scripts. Record the provider and purpose of each technology and the choices the visitor sees. A banner label is insufficient if the underlying behaviour does not match it.

Give the reviewer screenshots and a current technical inventory. Ask which implementation tasks remain with the developer, which legal text is included and how changes will be verified. Do not promise that a document package audits the whole technology stack.

Identify suppliers, retention and transfers

Describe hosting, email, customer-support, payment and AI tools, including the data each receives. Explain retention practice and how deletion requests are handled. If your business cannot answer those questions yet, mark them as decisions to resolve rather than filling the policy with invented periods.

Provider agreements, security controls and international-transfer questions can require work beyond a website notice pack. A small website can still process sensitive information; scope should follow the actual use, not merely the number of pages.

Keep the text connected to the product

After review, implement the required settings and publish consistent notices at the relevant collection points. Schedule a recheck when you add a form, integration or advertising tool. Maintain one record of the approved wording and configuration.

Bring the developer into questions about functionality, and give the lawyer the business purpose behind the settings. That collaboration reduces the risk of a polished policy describing a website that behaves differently.

Follow one visitor journey from the page to the back office

Choose a realistic journey, such as requesting a quote, booking a call or buying a product, and follow every step. Identify the fields collected, the receiving inbox, the CRM record, the booking provider and any later marketing list. Include information captured automatically by logs or embedded tools. Record who can access the information and whether it moves into another system through an integration. A privacy notice drafted from only the visible form can miss most of the actual operation.

Repeat the exercise for other meaningful journeys: a job applicant, an existing customer using support or a person subscribing to updates. Keep them separate when purposes and recipients differ. Ask your developer or agency to identify installed scripts and third-party services rather than guessing from the visual design. The result should be a practical map that the lawyer can use to assess the relevant legal basis, information duties and supplier arrangements. It also reveals unnecessary collection that the business may choose to remove.

• Record data fields, purposes, systems and recipients for each journey.
• Include form plugins, booking calendars, payment providers and automated connections.
• Distinguish answering an enquiry from adding someone to future marketing.

Choose a purpose for each use instead of one broad permission

For every item in the map, explain why the business needs it and what decision or service it supports. A phone number used to arrange a consultation is a different purpose from using that number for promotional messages. An email address may pass through several workflows, each needing assessment. Avoid a catch-all checkbox that appears to approve anything the company might later decide to do. Present the lawyer with specific uses so the legal basis can be considered on the actual facts.

Test whether a field is necessary for the first interaction. Does a quote form need a home address, date of birth or detailed documents at that stage? Could the business ask for more information only after the relevant service is identified? A shorter form can improve conversion while reducing unnecessary information handling. Where more sensitive material is genuinely needed, discuss the appropriate channel, access and safeguards rather than placing a large document-upload request on every public form. The design decision and legal assessment should support the same workflow.

Classify cookies and embedded services before designing the banner

Prepare an inventory of cookies and similar tools, describing the provider, purpose and observed behaviour. Separate the functions used to deliver the service requested by the visitor from advertising, measurement or other optional functions. Your Europe’s official guidance explains that some cookies require consent before use and distinguishes strictly necessary functions. Ask the lawyer to assess your particular setup and the relevant Cyprus implementation instead of declaring every installed tool essential because it is useful to the marketing team.

The developer should test what happens before a choice, after acceptance, after refusal and after a later withdrawal. An attractive banner does not prove the scripts follow the visitor’s decision. Check embedded videos, maps, calendars and social tools as well as obvious analytics. Explain the intended purposes in language a visitor can understand, and assess how settings remain accessible. If the business adds a new advertising platform later, make a fresh technical and legal check rather than assuming the original banner automatically covers it.

Give privacy information at the moment it helps someone decide

Draft the notice from the approved map, including the operator’s identity, relevant purposes, recipients, retention approach, rights and contact route as assessed by the lawyer. Make the language fit the audience and the real service. A Cyprus property enquiry form and a business-software signup should not carry identical descriptions if they handle different information. Use a short contextual explanation near a form with access to the fuller notice, rather than hiding every meaningful point in a long footer document.

Review the journey as a visitor. Can they understand which organisation receives the enquiry, whether an appointment tool is a separate provider and what happens next? Does a consent request clearly identify the optional use? Keep the wording consistent with the thank-you screen, confirmation email and team instructions. A sales page can remain elegant and persuasive while making the information flow understandable. Do not promise instant deletion, complete anonymity or a retention period that the business cannot actually implement.

Assess suppliers, international processing and automated connections

List the hosting provider, CRM, email service, form tool, booking platform, payment service and any agency with access. Locate their current terms, relevant privacy information and settings. Identify which role each performs in the specific workflow rather than assuming every external business has the same role. Ask the lawyer whether contractual documentation, an international-transfer assessment or another review is required for the actual providers and locations. A familiar brand name is not a substitute for that analysis.

Pay attention to connections added for convenience. A lead may be copied from a form into a spreadsheet, sent to a messaging channel and enriched by another tool without the public-facing team realising it. Identify the people who can add integrations and create a change-approval process. If accounting automation or API bookkeeping is relevant, coordinate the factual data flow with Sumly under its separate service scope. Legal review of the information handling and the provider’s operational implementation should use the same map and agreed instructions.

Create retention, rights-request and incident procedures people can follow

Group information by purpose and ask how long it needs to remain available. An unanswered sales lead, an active client file and an accounting record may need different treatment. Explain any other obligations or dispute concerns to the lawyer before choosing deletion rules. Then check where the information exists, including exports, inboxes, backups and agency systems. A retention statement is only useful when someone knows which records it applies to and how the agreed process will be implemented.

Choose a contact route for requests and identify who receives, verifies, escalates and records them. Discuss the applicable deadlines and exceptions with the lawyer for the situation; do not rely on a made-up universal answer. Prepare a simple incident escalation list containing the technical contact, responsible manager and legal adviser, with instructions to preserve the relevant facts promptly. Routine privacy-document work is different from responding to an actual incident. If a complaint or possible breach already exists, flag it before accepting a standard policy-drafting stage.

Include AI tools in the map rather than treating them as invisible assistants

Identify whether staff or website features send personal information to an AI service, what data is sent and whether it includes client documents or confidential conversations. Record the provider, account configuration, access, stated retention and any available processing terms. Ask which uses the business authorises and whether a lower-data approach could meet the same purpose. A public chatbot, an internal drafting tool and an automated lead-scoring workflow can raise different questions that a generic privacy paragraph does not answer.

For a website assistant, test the handoff to a human and explain what the system collects in a way that matches the feature. Avoid inviting visitors to disclose unnecessary sensitive detail just to obtain a basic service suggestion. For staff tools, agree which material can be submitted and how outputs are checked before being relied on or sent to customers. Ask the lawyer to assess the specific arrangement; neither a provider’s marketing description nor the fact that a tool saves time establishes the legal position.

Separate legal drafting, developer implementation and verification

Prepare the data map, supplier list, current notices, banner screenshots and planned changes before requesting the service. Tell the adviser about all domains and whether the site is a brochure, shop, portal or platform. Ask for a fixed scope naming the documents and workflows included. Technical scanning, cookie controls, security testing, supplier negotiations and an incident response can be distinct tasks. A well-defined engagement makes it clear who owns the legal decisions and who changes the website.

Use the €150 + VAT consultation to prioritise the actual gaps and request a custom offer for the work your business needs. After drafting, give the developer approved instructions and verify the live form, banner, embedded tools and links. Keep an implementation record and set a review trigger for new providers, markets or features. The aim is a coherent visitor journey and an operation the team can explain, rather than a badge claiming universal compliance because a privacy policy appears in the footer.

Questions worth asking