Privacy Policy

Last updated: 27 July 2026

This privacy policy explains how Coldstream PLC ("we", "us", "our") collects, uses, stores and protects your personal data when you visit our website at www.coldstreamplc.com or interact with us.

Coldstream PLC is a public limited company incorporated in the Republic of Cyprus (registration number HE 487842) with its registered office at 31 Evagoras Avenue, Evagoras House, 6th Floor, Office 61, Level 6 Executive Offices, 1066 Nicosia, Cyprus.

We are committed to protecting your privacy and handling your data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable data protection laws.

1. Data Controller

The data controller responsible for your personal data is:

2. What Personal Data We Collect

We may collect the following categories of personal data:

a) Information you provide directly

• Full name
• Email address
• Message content and nature of enquiry
• Any other information you choose to include in correspondence with us

b) Information collected automatically

• IP address
• Browser type and version
• Operating system
• Pages visited, time spent on pages, and navigation paths
• Date and time of your visit
• Referring website or source

3. How We Use Your Personal Data

We use your personal data for the following purposes:

• To respond to your enquiries: when you submit a contact form or email us, we use your details to respond and manage our relationship with you.
• To operate and improve our website: we use technical data to ensure the website functions correctly and to improve user experience.
• To comply with legal obligations: we may process your data where required by law, regulation or court order.
• To protect our legitimate interests: including the security of our website and the prevention of fraud.

4. Legal Basis for Processing

We process your personal data on the following legal bases under the GDPR:

• Consent (Article 6(1)(a)): where you have given clear consent for us to process your personal data for a specific purpose, such as submitting a contact form.
• Legitimate interests (Article 6(1)(f)): where processing is necessary for our legitimate interests (such as website security and improvement) and those interests are not overridden by your rights.
• Legal obligation (Article 6(1)(c)): where we need to process your data to comply with a legal obligation.

5. How We Store and Protect Your Data

Your personal data is stored securely and we take appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure or destruction. Contact form submissions are delivered to a secure email inbox managed by Coldstream PLC.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Contact form data is typically retained for 24 months unless a longer retention period is required for legal or regulatory purposes.

6. Sharing Your Data

We do not sell, rent or trade your personal data to third parties. We may share your data in the following limited circumstances:

• Service providers: we may share data with trusted third-party service providers who assist us in operating our website and conducting our business, subject to appropriate data processing agreements.
• Legal requirements: we may disclose your data where required by law, regulation, legal process or governmental request.
• Business transfers: in the event of a merger, acquisition or sale of assets, your data may be transferred as part of that transaction.

7. International Transfers

As a Cyprus-incorporated company, your data may be processed within the European Economic Area (EEA). If we transfer your data outside the EEA, we will ensure appropriate safeguards are in place in accordance with the GDPR, such as Standard Contractual Clauses approved by the European Commission.

8. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

• Right of access: you can request a copy of the personal data we hold about you.
• Right to rectification: you can ask us to correct any inaccurate or incomplete data.
• Right to erasure: you can ask us to delete your personal data in certain circumstances.
• Right to restrict processing: you can ask us to limit how we use your data.
• Right to data portability: you can request your data in a structured, commonly used, machine-readable format.
• Right to object: you can object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at privacy@coldstreamplc.com. We will respond to your request within 30 days.

You also have the right to lodge a complaint with a supervisory authority. The relevant authority in Cyprus is the Commissioner for Personal Data Protection (www.dataprotection.gov.cy).

9. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites and encourage you to read their privacy policies before providing any personal data.

10. Children

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will take steps to delete it.

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or applicable law. Any updates will be posted on this page with a revised "last updated" date. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this privacy policy or how we handle your personal data, please contact us at: