Privacy Policy

How ITFG handles personal data on tfg.institute, under the General Data Protection Regulation.

This policy explains what personal data tfg.institute collects, why, on what legal basis, who processes it, and what rights you have. It applies to this website. It does not cover correspondence conducted outside the site or data processed by third parties whose sites we link to.

Last updated: 11 September 2026.

Who is responsible

The controller of the personal data described here is:

I.T.F.G. INSTITUTE FOR TECHNOLOGY FINANCE AND GOVERNANCE, a private company limited by guarantee without share capital, registered with the Cyprus Registrar of Companies under number HE 498068, with its registered office at Chrysanthou Mylona 1, Panayides Building, 2nd Floor, Office 1, 3030 Limassol, Cyprus.

For any matter concerning this policy or your personal data, write to privacy@tfg.institute.

We have not appointed a Data Protection Officer. Our processing is limited in scope and volume and does not meet the criteria in Article 37 of the General Data Protection Regulation that would require one. Enquiries go to the address above and are handled by the institute directly.

What we collect, and why

Enquiries sent through the contact form. The form asks for your name, your email address, the type of enquiry, and your message. We use these to read and answer your enquiry. Nothing in the form is optional beyond the enquiry type, and we ask for no information about you that is not needed to reply.

Server logs. Like any web server, the machine serving this site records requests: the IP address the request came from, the time, the page requested, the referring page where one is sent, and the browser user agent string. These records exist to keep the site running and to detect abuse. We do not use them to build profiles of visitors and we do not combine them with form submissions.

Analytics, only where you have accepted them. See the analytics section below. No analytics script loads unless you have accepted it, and none runs at all where you have not been asked.

We do not collect special categories of data, we do not profile visitors, and we take no automated decisions that produce legal or similarly significant effects.

We rely on Article 6(1)(f) of the General Data Protection Regulation, our legitimate interest, for answering enquiries you send us and for keeping the site secure and operational through server logs. Our interest is in operating as a functioning research institution and in protecting the site; we consider this proportionate because the data involved is limited, expected by anyone sending an enquiry, and not used for any further purpose.

We rely on Article 6(1)(a), your consent, for analytics. Consent is requested before anything loads, is recorded only in your own browser, and can be withdrawn at any time as described below.

Who else processes this data

Formspree (Formspree Inc., United States) receives and relays contact form submissions. Your name, email address, enquiry type and message pass through and are stored in their system so that we can retrieve them. Because Formspree is based outside the European Economic Area, transfers rely on the standard contractual clauses adopted by the European Commission under Article 46 of the Regulation.

Synthonyx Technologies Ltd, ITFG’s founding member, provides the infrastructure and hosting on which this site runs and therefore processes server logs on our behalf.

We do not sell personal data, we do not share it for advertising, and we disclose it to no one else except where we are legally required to.

How long we keep it

Correspondence is kept for as long as the matter it concerns is live, and then for up to two years, so that we can pick up a thread that resumes later. Server logs are kept for a short operational period, ordinarily not more than 90 days, and then discarded. Where you have accepted analytics, the aggregate statistics they produce contain no personal data and are kept indefinitely.

Cookies and analytics

This site sets no cookies. It loads no advertising, no social media widgets, and no third-party fonts: typefaces are served from our own domain precisely so that visiting the site sends no request to anyone else.

Where analytics are enabled on this site we use Plausible Analytics, a European service that measures page views without cookies, without device identifiers, and without tracking anyone across sites or over time. It still loads only if you accept it. If you have not been shown a notice asking, no analytics of any kind are running.

Your answer to that notice is the one thing this site stores on your device: a single entry in your browser’s local storage, under the key itfg.consent.analytics, recording whether you accepted or declined and when. It never leaves your browser and is never sent to us. Declining is respected until you say otherwise, and clearing your browser storage removes it.

Your rights

Under the General Data Protection Regulation you may ask us to confirm what personal data of yours we hold and to give you a copy of it; to correct it where it is wrong; to erase it; to restrict how we use it; to provide it in a portable form; and to object to processing we base on legitimate interest. Where we rely on your consent, you may withdraw it at any time, which does not affect processing carried out before you withdrew it.

Write to privacy@tfg.institute to exercise any of these. We will respond within one month. We ask for no more identification than we need to be sure the request is yours.

If you believe we have handled your personal data unlawfully, you may complain to the supervisory authority: the Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus. You may also complain to the authority in the country where you live or work.

Changes

We will update this policy when the site or our processing changes, and the date at the top will change with it. Material changes will be noted here rather than made silently.