OHLIA LTD · UPDOWNZONE
Privacy Policy
This Policy explains how OHLIA LTD processes personal data when you use UPDOWNZONE.
1. Controller
OHLIA LTD (HE472252), Agias Zonis 1, NICOLAOU PENTADROMOS CENTER, Floor 4, Flat 406, 3026 Limassol, Cyprus, is the data controller. Privacy enquiries and rights requests: updownzonepro@gmail.com.
2. Data we process
We may process account details such as name, verified email and authentication identifier; subscription, payment status and invoice records; notification preferences; and support communications. On a successful registration or sign-in we also record the time, IP address, user-agent, broad device category, operating system and browser name for account security. We do not use this technical log for advertising, precise location, behavioural profiling or device fingerprinting. Payment card details are handled by the payment provider and are not intended to be stored by OHLIA LTD.
3. Purposes and legal bases
Account and subscription data are processed where necessary to provide the requested service and perform the contract. Records required for invoicing, tax or compliance are processed to meet legal obligations. Successful sign-in security logs are processed on the basis of OHLIA LTD’s legitimate interests in protecting accounts, investigating abuse and fraud, and maintaining service security; these interests are balanced against users’ rights and the log is limited to necessary fields. Consent is used only where applicable law requires it.
4. Providers and transfers
Data may be shared only as necessary with hosting, authentication, payment, email and notification providers, and with professional advisers or authorities where legally required. If data is transferred outside the EEA, we use an applicable adequacy decision or appropriate contractual safeguards.
5. Retention
Core account data is kept while the account is active and is then deleted or anonymised when it is no longer needed, subject to applicable legal obligations and the establishment, exercise or defence of legal claims. Successful sign-in records, including exact IP address and user-agent, are automatically deleted after 12 months. Invoice and transaction records are retained for the period required by tax and accounting law.
6. Your rights
Subject to the GDPR and applicable law, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests, and may withdraw consent without affecting prior lawful processing. You may also complain to the Cyprus Commissioner for Personal Data Protection or your local supervisory authority.
7. Cookies, access and security
We use essential cookies or similar storage for authentication, language and security. Non-essential analytics or advertising cookies will not be activated without any consent required by law. Security login records are restricted to authorised administrators. We apply reasonable organisational and technical safeguards, but no online service can guarantee absolute security.
8. Children and changes
The service is not intended for persons under 18. We may update this Policy and will identify the effective date and communicate material changes where required.