PRIVACY POLICY

Last updated: May 25, 2026

This Privacy Policy (hereinafter referred to as the “Policy”) defines the procedure for processing and protecting personal data of users (hereinafter referred to as the “User”, “You”) of the website https://khand-group.com (hereinafter referred to as the “Website”), owned by KHAND LTD (hereinafter referred to as the “Company”, “We”, “Us”).

We take your privacy very seriously. Within the scope of our activities as a fiduciary and administrative service provider in Cyprus, regulated by the relevant supervisory authorities (including CySEC), we ensure strict compliance with the General Data Protection Regulation of the European Union (GDPR, Regulation (EU) 2016/679), as well as the Cyprus Law provides for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data (Law 125(I)/2018).

1. GENERAL PROVISIONS AND DATA PROCESSING PRINCIPLES

The controller of your personal data is KHAND LTD, a company registered in the Republic of Cyprus (registration number HE 362096), holding an ASP (Administrative Service Provider) license. The processing of personal data is based on the following core principles:

• Lawfulness, fairness, and transparency: Data is processed only when there are legitimate grounds, fairly and openly in relation to the User.
• Purpose limitation: Collection is carried out exclusively for clearly defined, explicit, and legitimate purposes.
• Data minimization: We only collect data that is necessary to achieve the stated purposes.
• Accuracy: Inaccurate data is deleted or corrected in a timely manner.
• Storage limitation: Data is stored in a form that permits identification of data subjects for no longer than is necessary.
• Integrity and confidentiality: Appropriate security of personal data is ensured, including protection against unauthorized or unlawful processing.

2. CATEGORIES OF PERSONAL DATA COLLECTED

We may collect and process several types of information depending on your interaction with the Website:

1. Information provided by you voluntarily: When filling out contact forms or sending emails to info@khand-group.com, including your name, email address, phone number, company name, and the text of your message.
2. Automatically collected technical data: IP address, browser type and version, language settings, operating system, referral source, time of visit, and pages viewed.
3. Cookies and tracking technologies: Data regarding your activity on the Website, collected to enhance user experience.

 

 

3. PURPOSES AND LEGAL BASES FOR DATA PROCESSING

The table below outlines the categories of data, the purposes of their use, and the corresponding legal bases in accordance with the GDPR:

Data Category	Purpose of Processing	Legal Basis (GDPR)
Contact details (name, email, phone, message text)	Responding to User inquiries, providing consultations on fintech structures, relocation, and compliance.	Performance of pre-contractual obligations at the request of the data subject (Art. 6(1)(b) GDPR) or legitimate interest of the Company (Art. 6(1)(f) GDPR).
Technical data (IP address, server logs, browser data)	Ensuring Website stability and security, preventing cyberattacks and fraud.	Legitimate interest of the Company in maintaining secure IT infrastructure (Art. 6(1)(f) GDPR).
Cookies (analytical and marketing)	Website audience analysis, interface optimization, improving Website functionality.	Explicit consent of the User (Art. 6(1)(a) GDPR), expressed through the cookie banner.
Client data (upon entering into a contract)	Providing professional corporate, legal, and administrative services, conducting KYC/AML procedures.	Performance of a contract (Art. 6(1)(b) GDPR) and compliance with a legal obligation under CySEC regulations (Art. 6(1)(c) GDPR).

 

We do not use your personal data for automated decision-making, including profiling, which produces legal effects concerning you.

4. DATA RETENTION PERIODS

We retain your data only for the period necessary to fulfill the purposes for which it was collected, or in accordance with Cyprus statutory requirements:

• Contact data from feedback forms is stored for 1 (one) year from the date of the last contact, unless the interaction progresses into a contractual relationship.
• Technical data and cookies are stored in accordance with the lifespan of specific cookies (typically from a few sessions up to 24 months).
• Client data related to the provision of corporate administration and compliance services is retained for at least 5 to 7 years after the termination of the business relationship, in accordance with Cyprus Anti-Money Laundering (AML) legislation.

5. DATA TRANSFER TO THIRD PARTIES AND INTERNATIONAL TRANSFERS

The Company undertakes not to sell or rent your personal data. Transfer of information to third parties is possible exclusively in the following cases:

1. Service Providers: IT contractors, hosting providers, and analytical services operating strictly on the basis of Data Processing Agreements (DPAs).
2. State Authorities: Regulatory bodies (CySEC), Cyprus tax authorities, and law enforcement agencies in response to lawful requests and to comply with legal obligations.
3. Professional Partners: Banks, auditors, and legal consultants involved in structuring your business, only with your consent or within the scope of contract performance.

In the event that data is transferred outside the European Economic Area (EEA), We ensure that appropriate safeguards are implemented, such as the Standard Contractual Clauses (SCC) approved by the European Commission.

6. RIGHTS OF DATA SUBJECTS

In accordance with the GDPR, you possess a wide range of rights regarding your personal data:

• Right of access (Art. 15 GDPR): You can request confirmation as to whether your data is being processed and obtain a copy of it.
• Right to rectification (Art. 16 GDPR): You have the right to request the correction of inaccurate or incomplete data.
• Right to erasure / “Right to be forgotten” (Art. 17 GDPR): You can request the destruction of data if it is no longer needed or if you have withdrawn consent.
• Right to restriction of processing (Art. 18 GDPR): You can demand that data processing be suspended in certain situations.
• Right to data portability (Art. 20 GDPR): You can request your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): You can object to data processing based on the legitimate interests of the Company.
• Right to withdraw consent: If processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, you may send an official request to our email address: info@khand-group.com. We undertake to review and respond to the request within 30 days of receipt.

You also have the right to lodge a complaint with the supervisory authority of Cyprus: Office of the Commissioner for Personal Data Protection.

7. USE OF COOKIES

Our Website uses cookies to optimize performance and analyze traffic. Upon your first visit to the Website, a cookie banner requests your consent to the use of analytical and marketing cookies.

You can change your browser settings at any time to block cookies or receive notifications when they are sent. Please note that disabling essential (technical) cookies may result in improper functioning of certain sections of the Website.

8. DATA SECURITY

We implement strict technical and organizational security measures to protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The use of the HTTPS encryption protocol ensures secure data transmission between your device and the Website’s servers. Access to your data is granted exclusively to authorized employees of the Company who have signed a non-disclosure agreement.

9. CHANGES TO THE PRIVACY POLICY

We reserve the right to make changes to this Policy at any time to reflect changes in our data processing practices or legal requirements. The new version of the Policy becomes effective upon its publication on the Website. We recommend checking this page periodically to stay informed of the current version.

10. CONTACT INFORMATION

If you have any questions, comments, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

Company Name: KHAND LTD

Email: info@khand-group.com

Phone Number: +357 22751001

Office Address: 20, Ionos Str., Office 401, Engomi 2406, Nicosia, Cyprus