DRAFT – pending legal review
This text is a working draft and has not yet been approved by legal counsel. Passages marked in yellow are still open and will be clarified before publication.
This notice supplements the general privacy policy of S.F. Custos Global Reach Ltd at https://custosglobal.com/privacy/ and applies specifically to the SFC Intelligence platform at intel.custosglobal.com.
S.F. Custos Global Reach Ltd, Lordou Vyronos 61-63, 6th floor, Office 602, 6023 Larnaca, Cyprus. Email: office@custosglobal.com.
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Account data: name, email address, password (stored only as a one-way hash), role, account status, date of acceptance of our terms | Creating and managing your account, verifying that access is granted only to approved professionals | Art. 6(1)(b) contract / pre-contractual steps | For the duration of the account; deleted within 30 days after account closure, unless retention is legally required [KLÄREN: Frist] |
| Login data: time of last login, session cookie | Secure sign-in and keeping you signed in | Art. 6(1)(b); Art. 6(1)(f) security | Session cookie: up to 30 days [wird im Zuge der Härtung verkürzt]; login time: as account data |
| Usage data within the platform: reports you request (country, city, topic, report type), time of request | Delivering the requested reports, preventing abuse (rate limits) | Art. 6(1)(b); Art. 6(1)(f) | 12 months [KLÄREN] |
| Server logs: IP address, time, requested page, browser information | Security, error analysis, protection against attacks | Art. 6(1)(f) | 30 days [KLÄREN: tatsächliche nginx-Logrotation prüfen] |
We do not use analytics or advertising cookies on intel.custosglobal.com. The only cookie set is the technically necessary session cookie after you sign in. Web fonts are delivered from our own server.
Reports on SFC Intelligence are drafted with the help of large language models from our curated knowledge base of open sources. We do not send your personal data to AI providers. A report request only transmits the selected country, city, topic and report type; your name, email address or other account data are not part of the request to the model. AI-generated content is labelled as such in every report.
We use the following service providers, bound by data processing agreements where required:
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Server hosting and database | Germany (EU) | EU |
| Cloudflare, Inc. (R2 storage) | Storage and delivery of report PDF files | EU/US [KLÄREN: Bucket-Region] | EU–US Data Privacy Framework / Standard Contractual Clauses |
| CartoDB Inc. / CARTO (map tiles) | Displaying the background map; your browser loads map images directly from CARTO, which transmits your IP address and the site origin | USA | Standard Contractual Clauses / EU–US Data Privacy Framework |
| Anthropic PBC / OpenAI (language models) | Drafting reports – no personal data transmitted | USA | not applicable to personal data |
| Brevo (Sendinblue SAS) | Transactional emails (e.g. account confirmation), once introduced | France (EU) | EU |
Map tiles: the interactive map loads background tiles directly from CARTO Basemaps (CartoDB Inc., USA), based on OpenStreetMap data. Your browser transmits your IP address, browser type and the referring page to CARTO. CARTO processes this data as our processor, truncates IP addresses on receipt and keeps the logs for 30 days in the United States (EU Standard Contractual Clauses / EU-U.S. Data Privacy Framework). [Hinweis: vom Anwalt prüfen lassen – CARTO-Basemaps-Bedingungen §10 (29.09.2026).]
Where data is processed outside the EEA, we rely on adequacy decisions (including the EU–US Data Privacy Framework for certified providers) or Standard Contractual Clauses.
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time with effect for the future. To exercise your rights, contact office@custosglobal.com. You may lodge a complaint with the Commissioner for Personal Data Protection, Cyprus (www.dataprotection.gov.cy), or with the supervisory authority of your EU country of residence.
Access to the platform is restricted to approved accounts. Connections are encrypted (TLS). Passwords are stored only as hashes. Databases are not accessible from the internet.
Please do not enter sensitive personal data (e.g. travel itineraries of named persons, health data, passport data) into free-text fields on the platform. For sensitive matters, contact us first via office@custosglobal.com to arrange a secure channel.
We will update this notice when our processing changes. Version: [Datum der Freigabe].