(Voluntari, Global City, 10 Bucharest - North Road, O21, 4th Floor)

Last Amended on 28.02.2019

1. Field of Scope

This privacy notice lays out the way Cycle European Srl. (hereinafter referred to as “Cycle”) collects, uses, processes, stores, manages, and protects the personal data of entities and individuals, including the contact, financial commercial and cv data (hereinafter referred to as “Personal Data”), so as to meet the data protection standards of the company and comply with the applicable law.

This privacy policy shall apply to all information :

1. that relates to the products and services (hereinafter referred to as “Services”) provided by Cycle on the field of Overdue Receivables Management, where such data were obtained directly by acquisitions. Especially, Cycle provides two kinds of Services: a) B2C Receivables Management. Cycle undertakes to inform Client’s customers about their overdue or doubtful debts and to negotiate the timing and manner of paying these debts back, according to the instructions provided by the Client, b) B2B Receivables Management has been created and developed by Cycle to exclusively manage and handle delays in payment from any business customer of the Client regardless its legal form.
2. pertaining to visitors and clients of Cycle’s website http://www.cyclecollections.com/index.php/cycle-sa-ro (hereinafter called “Website”).
3. pertaining to candidate employee data collected during the recruitment process

This privacy policy shall also apply as regards the company’s phone recording system and the data management application developed and established by Cycle’s IT team. Especially, it is mentioned that the company’s phone system is a state-of-the-art Cisco Call Manager Voice Over IP (VoIP). This technology facilitates the full integration of data and voice networks and the management of information with respect to (incoming / outgoing / internal) calls thanks to a central management system entirely developed by our company's IT department.

With regard to our Data Management Application, we note that it has been developed internally by the company’s IT department using the latest tools (SQL Server 2008, PowerBuilder 11.0 & Visual Studio.net). The application has multiple access levels, distinguished into Agents, Supervisors, Managers and Administrators. Depending on the operator’s access level, the application displays the respective services-operations.

Cycle is bound to protect the privacy of Clients, individuals and other data subjects and adhere to the Data Protection legislation currently in effect.

This policy shall not apply to information collected through any other website, services, products, platforms or for practices of companies that we do not control. We are not responsible for any personal data protection practices pertaining to websites, services, products, platforms of other companies.

2. Categories & Types of Collected Data

Data Collected:

1. A. Individuals Personal, Commercial and Financial Data: Name and Surname, Telephone/Fax, E-mail address, Address of residence, residence, CNP, Series and ID number/passport number, Banking date, Date and place of birth, Age, Work, Profession, Function, Marital status, Children, Contract Number, Card Number, Currency, Product type, Product description, Assignment Date, Assignment Bucket, Expiration Date, Credit Limit, Outstanding Balance at Assignment Date, Outstanding Balance, Last payment amount, Last payment date, Loan Account - Account Number, Debt Amount,
2. B. Companies Commercial and Financial Data:Company and business professional contact information such as Name, Telephone / Fax, E-mail address, Financial / Commercial / Overdue Details (Administrative or contraventional sanctions), detailed trade and business credit information, including payment histories and patterns, summary business information regarding profitability, debts, assets, net worth, and business relationships, business professional data as it relates to their professional lives, such as name, company, title, business contact information, and trade association.

1. C. Website data: name, surname, e-mail, ip address.
2. D. CV Data of Candidate Employees: Name and Surname, Telephone / Fax, E-mail address, Address of residence / residence, CNP, Series and ID number/ passport number, Banking date, Sex, Date and place of birth, Age, Citizenship, Work, Profession, Training, Date of racial/ethnic origin, Religion, Health status, Hobbies, Function, Legitimate interests, Marital status, Children, Work, Profession, previous work experience,

Declaration Regarding The Processing of Personal Data By Cycle (by its capacity as Data Controller and Processor - in accordance with the General Data Protection Regulation EU 679/2016)

Why will you process my Personal Data (PD)?

Cycle provides products and services containing commercial and financial information about legal entities, sole proprietorships and individuals based on the intended purpose, such as described in paragraph 6 hereof. Their contents vary depending on the type and purpose of the provided service of Cycle. The lawful basis of the data processing is Cycle’s legitimate interest in accordance with applicable law and in some instances (voice recordings and candidate employee data) the consent of the data subjects.

Cookies

● What are cookies and why Cycle uses them: Cookies are pieces of information, in the form of very small text, usually consisting of letters and numbers, which are stored in the browser used by the individual Client (Chrome, Mozilla Firefox etc.), assisting us to make the Website work more efficiently. Cookies do not in any way cause damage to Client’s/visitor’s computers or files stored on them. Information stored in cookies is used for identification purposes. In this way we manage to operate the Website in an efficient way for the service we offer. The Website uses the Cookies to distinguish Clients/visitors and throttle request rate among other things

● Under no circumstances will the cookies contain personal information or information that will allow anyone to contact the Website's visitor by phone, e-mail, etc. Additionally, using cookies does not provide access to your computer's documents or files

● Which cookies are we using? The cookies described below may be stored in the browser. You can view and manage cookies in your browser (however, mobile browsers may not offer this visibility). Of the different types of cookies available, Cycle uses the following:

-          Session cookies: Session cookies allow Clients/Visitors to be recognized within a website so any page changes or item or data selection you do is remembered from page to page. Session Cookies are erased when the Client/visitor closes the browser

-          The essential technical cookies are of critical importance for the proper operation of the Website as they allow you to browse the Website and make use of its functions. These cookies do not identify your personal ID. Without these cookies, Cycle will be unable to offer proper functioning of the Website

The aforementioned cookies are exempt from the requirement of informed consent for their use from the Clients’/visitor’s part, given that they do not store personal data of the Client/visitor and are used for the sole purpose of carrying out the transmission of a communication.

Cycle does not manage, collect or process geolocation data, which are collected and processed exclusively by the companies providing operating systems for each device you use (in case of use of iOS-Apple Inc or in case of android - Google Inc). Cycle does not have access to the positioning refresh rate of GPS.

3. Data Collection Points

1) Clients - A,B [business owners and principals, businesses' creditors, vendors and suppliers]

2) Cycle’s Agents - A, B,

3) Candidate Employees – D,

4) Cycle Website - C,

5) Public records - A, B [such as business registrations, Uniform Commercial Code filings and bankruptcy filings]

4. Transfer of Data to Third Parties

Cycle reserves the right to disclose your personal data to any member of its affiliate/subsidiary companies (parent company and its subsidiaries) or other third parties to the extent it is reasonably necessary for the purposes determined in this notice and in particular:

• Your data will be transferred to the departments of Cycle that are competent for the smooth and trouble-free operation of its services and functions
• Your data may be transmitted and become accessible by legal entities (corporate clients) or Cycle’s agents with which, we have entered from time to time into contractual agreements for the purpose of fulfilling our company’s legitimate interest (provision of credit control information and management of overdue receivables ) in a correct and within our contractual terms framework.
• Your data may be disclosed to cloud hosting providers for the purpose of storing and safeguarding the data with the appropriate technical and security measures
• Your data may be transmitted, become accessible and processed by subsidiaries of our group within the European union, which apply the appropriate technical, physical and administrative security measures for the protection of the data from loss, misuse, damage, alteration, unauthorised access and disclosure, as provided by article 32 of the GDPR 679/2016
• During all data transfers, we always take all appropriate measures so as to ensure that the transmitted data are the minimum required for the intended processing purpose and that the conditions for legitimate and lawful processing will always be met
• Cycle servers are hosted at IBM’s data centre (hosting provider) located in Athens. You may find more information on IBM’s privacy notice in the following link: https://www.ibm.com/privacy/details/us/en/#section_2

5. Personal Data Retention Period

The data retention period depends on the lawful basis of processing, as set out in detail below:

• In case the lawful basis for processing is the exercise of legitimate interest, the processing of personal data is carried out for as long as it is considered necessary for the achievement of the intended statutory purpose of Cycle described in paragraph 6 below, and until such time the limitation period of any related claims has expired.
• In case the personal data of the Client (Account Information) are provided under their own consent such as when he data subject subscribes to the Cycle’s newsletter, we shall retain those data until the granted consent by the data subject has been withdrawn. In case the consent is withdrawn for any valid reason, we shall retain them for as long as it is required until the limitation period of any related claims expires.
• In case the lawful basis for processing is the performance of the contract, we shall retain your data for as long as you retain the contractual relationship with Cycle in hard copy and in electronic form or we shall retain them for as long as it is required until the limitation period of any related claims expires.
• It especially mentioned that Voice recording data retained for 1 year from the last individual communication. In any case each customer is properly informed during the telephone communication about the recording and retention period of the recordings (according to ICAP’s contract obligations and the instructions of each Client).

6. Legitimate Interest - Intended Purpose - Lawful Basis for Data Processing

Cycle within the framework of the general business activity according to the legislatory frame applicable and in pursuit of its statutory objectives, among which it is the collection, management, and provision of commercial and economic information (business information), overdue debts and personal data as described above, of individuals and legal entities, has created and maintains a database, which is daily updated with economic and commercial information in terms of economic units details. Cycle processes and stores the said data within the E.U.

7. Rights of the Data Subjects

You may exercise, as the case may be, the rights deriving from the applicable Greek Legislation and the General Data Protection Regulation (Regulation (EU) 2016/679) which are as follows: (a. the right of information (article 13), b. the right of access (article 15), c. the right to rectification (article 16), d. the right to erasure “right to be forgotten” (article 17), e. the right to restriction of processing (article 18), f. the right to data portability (to receive your personal data in a structured and commonly used format - article 20 where applicable) and g. the right to object (article 21) which applies to certain data processing activities

• These rights can be exercised only in cases where CYCLE acts as Data Controller and in particular when CYCLE: (i) processes the personal data of candidate employees for the purpose of evaluating future collaborations (ii) processes the personal data acquired through acquisitions in pursuance of its statutory objectives (provision of overdue receivable management services) (iii) processes the personal data of visitors and clients of CYCLE’s website
• This Privacy Notice does not apply to personal data mentioned on business documents that our customers transmit to our systems when using our Services
• These rights shall be exercised free of charge for you by sending a relevant letter to the Data Protection Officer (DPO) of Cycle: Voluntari, Global City, 10 Bucharest - North Road, O21, 4th Floor, or via e-mail to This email address is being protected from spambots. You need JavaScript enabled to view it.. In case however the aforementioned rights are exercised excessively and without good cause thus causing us administrative burden, we may charge you with the cost related to the exercise of the respective right.
• In case you exercise any of your rights, we will take all appropriate measures available for the satisfaction of your request within thirty (30) days following the receipt of the relevant request. We may either inform you on the acceptance of your request or on any objective grounds that hinder the processing of your request.
• Notwithstanding the above, you may at any time object to the processing of your Personal Data, by withdrawing your consent (article 7, par. 3 of the GDPR 679/2016) by sending a letter to the Data Protection Officer (DPO) of Cycle: Voluntari, Global City, 10 Bucharest - North Road, O21, 4th Floor, or via e-mail to This email address is being protected from spambots. You need JavaScript enabled to view it. This right applies only in cases where the lawful basis for the data processing is the consent of the Data Subject.

8. Data Processing by Cycle

Cycle in most instances, collects, uses, processes, stores, manages data provided by Cycle’s corporate clients (b2b companies and bank institutions) - which may contain personal data (who may refer to individuals or companies) - within the framework of provision of our services. Such data in most instances has been collected by Cycle’s clients and are related to data of their customers. Therefore Cycle shall operate in most instances as the “Data Processor” of the personal data, which are included in the said business data. Consequently, in those cases different provisions of the GDPR 679/2016 shall apply, with which we comply.

Additionally, Cycle applies throughout the data processing procedure, the appropriate technical, physical, and administrative security measures for the protection and security of the personal data from loss, misuse, damage or modification, unauthorised access and disclosure, in compliance with article 32 of the GDPR 679/2016, in order to ensure the appropriate security level against those risks. Those include, among others, as the case may be: a) application of encryption protocols b) the ability to ensure confidentiality (article 90 GDPR 679/2016), the integrity, availability, and resilience of processing systems and services on an ongoing basis, c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident, d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing. Moreover, Cycle shall take measures so as to ensure that any physical person acting under the authority of the data controller or of the processor, who has access to personal data, shall not process those data except on instructions from the data controller and limits access to your personal information to authorised employees.

Indicative security measures applied by Cycle are as follows:

• Cycle ISO 9001:2008 and ISO 27001:2013 International Standards
• Cycle maintains a dedicated information security team that plans, implements and provides surveillance of our information security program. Acknowledging the potential of IT and office automation support and the capability of processing and using data, the company has invested in developing and employing these capabilities. With a team of experienced, specialized, full-time programmers and analysts forming an independent IT division, Cycle is able to cover all of its IT needs.
• The company controls the security and functionality of its services before they are introduced to the Internet, for any vulnerabilities in technology
• The company performs ongoing infrastructure checks to detect weaknesses and potential intrusions, vulnerabilities in systems etc.
• The company’s office automation system is based on a Local Area Network (LAN/TCP/IP) and uses a Microsoft Windows 2008 and 2012 Servers. It consists of multiple Cisco Catalysts Switches and uses special routers, firewalls and safety devices in order to ensure a secure connection to the Internet.
• The company’s Data Center is one of the most advanced in Greece, with dual UPS-sustained power systems, fire detection and automatic fire extinguishing systems. There is an access control system in all critical points, be it access to data or access to telecommunications, which are under 24-hour surveillance by security guards.
• Each day, we create backup copies of all the critical data that we store in a special area located outside the company, as specified by our Disaster Recovery Plan.
• Cycle maintains a High Availability Cluster Infrastructure
• The company uses the open standard protocol to access Lightweight Directory Access Protocol (LDAP) directory services and uses encrypted passwords
• The company protects its Web Sites by presenting a Web Application Firewall and an IDS/IPS Firewall in-front of the Web Servers
• The company operates an ISMS - Information Security Management System to reduce Cyber-Security Risks.

9. Submission of Complaint - Appeal

• For any issue regarding the processing of your personal data, you may contact us via e-mail at This email address is being protected from spambots. You need JavaScript enabled to view it.
• Moreover, you shall always be entitled to contact the Data Protection Authority, which may accept the submission of relevant complaints in writing at its protocol in its offices at 28-30 G-ral Gheorghe Magheru Bld. District 1, post code 010336, Bucharest, Romania or by e-mail This email address is being protected from spambots. You need JavaScript enabled to view it. in accordance with the instructions indicated on its website.
• If you no longer wish to receive newsletters from CYCLE, please send an e-mail to http://www.cyclecollections.com/index.php/contacts/romania or follow the unsubscribe instructions included in each relevant email/communication.

10. Amendments

This policy may be renewed from time to time, due to amendments to the related legislation or change to the corporate structure of Cycle. Thereby, we encourage the Clients to periodically visit this site so as to be informed regarding recent information of privacy practices. In any case, the Clients may be informed by e-mail or a notice in our Website regarding any amendments to this policy.