Privacy Policy
Last updated: 1 October 2026
1. Who is responsible for your data
The data controller for this website is:
- Legal entity: Nestloom Ltd, a company incorporated in the Republic of Cyprus
- Registration: HE478177 · VAT: 60191252P
- Registered address: Keryneias 12, 8543 Koili – Paphos, Cyprus
- Email: info@medelionpartners.com
No Data Protection Officer has been appointed. Appointing one is only mandatory in the cases set out in Article 37 GDPR, which are unlikely to apply to a practice of this size.
2. What we collect, and why
We only collect what you choose to give us. There is no account system, no profiling and no automated decision-making on this site.
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Name and email submitted through the contact form — and, if you choose to add them, company, role, country, topic and message | To read and answer your enquiry | Art. 6(1)(b) — steps prior to a contract, or 6(1)(f) legitimate interest in replying | 24 months after the last contact |
| Email address submitted to the mailing list | To send occasional notes and updates | Art. 6(1)(a) — your consent | Until you unsubscribe |
| Server log data (IP address, timestamp, user agent) | Security, abuse prevention and keeping the site running | Art. 6(1)(f) — legitimate interest | 30 days |
| Messages you send via WhatsApp or LinkedIn | To hold the conversation you started | Art. 6(1)(f) — legitimate interest | As long as the professional relationship is live |
Providing your data is voluntary, but without an email address we cannot reply to you.
3. Contacting me on other platforms
The site links to LinkedIn and WhatsApp. These links open the relevant platform and do not embed any tracking code into this site. Once you are on those platforms, however, their own terms and privacy policies apply, and they will process your data as independent controllers. We have no control over that processing.
- LinkedIn: LinkedIn Privacy Policy
- WhatsApp: WhatsApp Privacy Policy
4. Who else sees your data
We do not sell personal data, and we do not share it for advertising. It may be handled by the suppliers that make the service work, each acting as a processor under a written agreement (Art. 28 GDPR):
- Hosting provider: Dinahosting, Spain
- Form delivery and mailing list: n8n, self-hosted by Web Coding, Spain
- Professional advisers (accounting, legal) where strictly necessary
If any provider stores data outside the European Economic Area, that transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision. Details available on request.
5. Measuring how the site is used
If you accept the notice shown on your first visit, this site uses Google Analytics to understand which pages are read. It records the pages you visit, an approximate location derived from your IP address, and the kind of device and browser you are using. It does not record your name, your email address or anything you type into a form.
The lawful basis is your consent, and nothing loads until you give it. If you choose “only essential”, Google Analytics is never loaded and no request is made to it. You may change your answer at any time through Cookie Settings in the footer; choosing only essential afterwards also deletes the cookies it had set. Google acts as our processor and the data is transferred outside the EEA under the safeguards described in section 4.
The individual cookies and how long they last are listed in the Cookie Policy.
6. Fonts loaded from Google
This site currently loads its typefaces from Google Fonts. To serve them, your browser makes a request to Google's servers, and that request necessarily discloses your IP address to Google.
No cookie is set by this, but a German court has held that transmitting an IP address to Google Fonts without consent can infringe the GDPR. The clean fix is to self-host the font files, which removes the third-party request entirely. See the Cookie Policy for the current position.
7. Your rights
Under the GDPR you may ask us to:
- Access the personal data we hold about you
- Rectify anything inaccurate or incomplete
- Erase your data, where we have no overriding reason to keep it
- Restrict or object to our processing
- Receive your data in a portable format
- Withdraw consent at any time, without affecting what was lawful beforehand
Write to info@medelionpartners.com and we will respond within one month. If you believe we have handled your data badly, you are entitled to complain to the supervisory authority in Cyprus, where Nestloom Ltd is established — the Office of the Commissioner for Personal Data Protection — or to the authority of the EU country where you live or work.
8. Keeping data safe
The site is served over HTTPS and access to submitted data is limited to those who need it. No system is perfectly secure, but we take appropriate technical and organisational measures and will notify you and the supervisory authority of a qualifying breach as required by Articles 33 and 34.
9. Children
This site is aimed at professionals and is not directed at children. We do not knowingly collect data from anyone under 16.
10. Changes
If this policy changes materially we will update the date at the top and, where the change concerns processing based on your consent, ask for that consent again.