Privacy Policy

Welcome to the Privacy Policy of the website of Rethink Filters (https://refilters.com.cy/). This policy explains how we collect, use and protect your personal data when you visit and interact with our website. We are committed to handling your personal data transparently, securely, and in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Cypriot Law providing for the Protection of Natural Persons with Regard to the Processing of Personal Data and for the Free Movement of Such Data (Law 125(I)/2018).

About Rethink Filters: the website is operated and maintained by CPC RETHINK FILTERS LTD, a company limited by guarantee without share capital, registered in the Republic of Cyprus under registration number ΗΕ 462620 on 10 July 2024, with its registered office at 229 Tseriou Avenue, 2047 Strovolos, Nicosia, Cyprus. We are the licensed collective system for the management of waste from tobacco products with filters, operating under a licence granted on 4 May 2026 under the Waste (Management of Waste from Tobacco Products with Filters and Filters Marketed for Use in Combination with Tobacco Products) Regulations of 2024 (Κ.Δ.Π. 53/2024). The website provides information about the Collective System, the environmental problem it addresses, our news and our contact details. It does not include e-commerce, user accounts, or online submission forms of any kind.

Scope of this Policy: this Policy concerns personal data processed in connection with the website https://refilters.com.cy/ and with communications you send us using the contact details published on it. It does not govern the administration of membership of the Collective System, the collection and reporting arrangements we operate with Producers and local authorities, or our obligations towards the competent authorities — those are handled separately, under the agreements and the legal framework that apply to them.

 

1. Definitions

A few terms are used throughout this Policy. They are explained here so that the rest of it reads clearly.

  • “Personal data” means any information relating to an identified or identifiable natural person.
  • “Processing” means anything done with personal data — collecting, storing, using, disclosing, transmitting or deleting it.
  • “Controller” means the person who decides why and how personal data are processed. For this website, that is CPC Rethink Filters Ltd.
  • “Processor” means a third party who processes personal data on our instructions and not for its own purposes — for example our website hosting provider.
  • “Collective System” means Rethink Filters, as identified above.
  • “Producer” means any person or undertaking that places tobacco products with filters, or filters marketed for use in combination with tobacco products, on the market of the Republic of Cyprus and is subject to obligations under the Regulations.
  • “Regulations” means the Waste (Management of Waste from Tobacco Products with Filters and Filters Marketed for Use in Combination with Tobacco Products) Regulations of 2024 (Κ.Δ.Π. 53/2024), as amended or replaced from time to time.

These terms are explained here in plain language. The full legal definitions are set out in Article 4 of the GDPR.

 

2. What Data Is Collected

2.1. Cookies & Usage Data

We collect limited technical data through cookies and similar technologies, such as device type, browser, pages visited and interaction patterns. These data help us understand how the website is used and improve its performance and content.

The website sets a strictly necessary cookie that remembers the language you have selected. Analytics cookies, and any other technology that is not strictly necessary, are placed only where you consent to them.

Like any website, our hosting infrastructure also generates server log data — including your IP address, the date and time of your request and your browser type — which is used for security, diagnostics and to keep the website running.

Please see Section 7 (Cookies and Tracking Technologies) for cookie categories and how to manage your preferences.

2.2. Direct Communications

This website does not include any online contact form, registration form or submission form. If you choose to contact us directly by telephone or e-mail using the details published on the website, we will process the information you choose to share — such as your name, e-mail address, telephone number, the organisation you represent, and the content of your message — for the purposes of communicating with you and handling your request.

Please avoid sending special categories of data (for example health or religious information) by e-mail or telephone. If such data are sent inadvertently, we will handle them confidentially and delete them where appropriate.

2.3. Information We Publish About Individuals

The website publishes the names of the members of our Board of Directors, as part of the transparency expected of a licensed collective system. It may also publish photographs, names or statements of individuals in news items reporting on our work, agreements and awareness activities — for example representatives of local authorities at a signing or an event.

Such information is published on the basis of our legitimate interest in operating transparently and communicating our work to the public (Article 6(1)(f) GDPR), and, where relevant, on the basis of the consent of the individuals concerned. If you appear in material published on our website and wish to request its correction or removal, please contact us using the details in Section 13 and we will review your request promptly and in good faith.

 

3. Data Controller

CPC Rethink Filters Ltd

229 Tseriou Avenue, 2047 Strovolos, Nicosia, Cyprus

Email: admin@refilters.com.cy  |  Tel: 7008 7333

A company limited by guarantee without share capital, registered in the Republic of Cyprus under number ΗΕ 462620 on 10 July 2024.

3.1 Legal Basis for Processing

We process personal data on the following legal grounds:

  • Consent (Article 6(1)(a)): where you give clear, affirmative consent — for example by accepting non-essential cookies, or by agreeing to the publication of your photograph or statement.
  • Legitimate Interest (Article 6(1)(f)): where processing is necessary for our legitimate interests — the secure and functional operation of the website, responding to enquiries addressed to us, and communicating our work transparently to the public — provided that those interests do not override your rights and freedoms.
  • Legal Obligation (Article 6(1)(c)): where processing is necessary in order to comply with a legal obligation to which we are subject.
  • Public Interest / Official Authority (Article 6(1)(e)): where correspondence you send us relates to the statutory functions we perform as the approved body under the Regulations, and its processing is necessary in order to carry out those functions.

3.2 Enquiries

For any data protection enquiry, please contact us at admin@refilters.com.cy. You may also contact the Office of the Commissioner for Personal Data Protection (Cyprus) at commissioner@dataprotection.gov.cy.

 

4. How We Use Your Data

Data collected automatically (cookies, usage and server log data) and data you voluntarily share with us are used for:

  • ensuring the secure and efficient operation of the website;
  • analysing traffic and improving the user experience, where you have consented to analytics;
  • responding to and managing your enquiries received by e-mail or telephone;
  • communicating our environmental awareness work, including news and event reporting;
  • storing your cookie preferences.

Purpose of collection: personal data are processed solely in order to support the functionality and security of the website, to handle communications addressed to us, and to inform the public about the work of the Collective System. We do not use them for profiling, and we do not use them to target advertising at you.

 

5. How We Protect Your Data

We take appropriate technical and organisational measures to protect the personal data processed in connection with our website and our communications. These include secure hosting, encryption in transit (HTTPS), access controls limited to those who need them, and periodic review of the security of the website and its plugins.

 

6. Your Rights

As a user of our website, you have the following rights under the GDPR:

  • Right of Access (Article 15): to request access to the personal data we hold about you, including data collected through cookies or usage data.
  • Right to Rectification (Article 16): to request the correction of inaccurate or incomplete personal data.
  • Right to Erasure (Article 17): to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw your consent.
  • Right to Restriction of Processing (Article 18): to request that we restrict processing in certain circumstances, for example where you contest the accuracy of the data.
  • Right to Data Portability (Article 20): to receive a copy of the personal data you have provided in a structured, commonly used and machine-readable format, and to transmit it to another controller, where the processing is based on consent or contract and carried out by automated means.
  • Right to Object (Article 21): to object at any time to processing based on our legitimate interests or on the performance of a task carried out in the public interest, including the publication of material in which you appear.
  • Right to Withdraw Consent: where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

To exercise any of these rights, please contact us at admin@refilters.com.cy. We will respond in accordance with the GDPR, normally within one month. If you are not satisfied with our response, you may lodge a complaint as described in Section 11 (Complaint Mechanism).

 

7. Cookies and Tracking Technologies

Cookies are small text files stored on your device when you visit a website. We use cookies and similar technologies so that the website works properly, to remember your preferences and — where you consent — to understand how the website is used and to display content hosted by third parties.

We use both essential and non-essential cookies. The categories in use may include, but are not limited to:

  • Strictly Necessary (always active): required for the basic functioning of the website — for example remembering the language version you have selected, and maintaining the security and integrity of your session. These cookies do not require your consent and cannot be switched off.
  • Functional Cookies: enable additional features such as embedded video playback and embedded maps. Used only with your consent.
  • Statistics / Analytics Cookies: used to understand, in aggregate, how visitors interact with the website — for example which pages are visited and for how long — so that we can improve it. Used only with your consent.
  • Marketing / Advertisement Cookies: used to measure the effectiveness of awareness campaigns or to track users across websites for advertising purposes. Used only with your explicit consent.

Additional categories may be introduced depending on the services or integrations active at any given time. All non-essential cookies are placed only after you give consent, and refusing them has no effect on your ability to read the website.

You can manage your cookie preferences at any time using the cookie settings icon displayed at the bottom of your screen, or by selecting “Cookie Preferences” in the website footer. A settings panel will open where you can accept, refuse or adjust your preferences by category, with a clear explanation of each. This section, together with that panel, is the full description of the cookies we use — we do not maintain a separate cookie policy document.

 

8. Third-Party Services, Embedded Content and Links

8.1 Embedded Content and Service Providers

Some parts of the website load content hosted by third parties. When that content loads, your IP address and basic technical information about your device are disclosed to the provider, and the provider may set its own cookies. The providers currently involved are:

  • Vimeo — used to host and play video content on the website.
  • Google Maps — used to display the location of our offices on the Contact page.
  • Google Fonts — used to display the typefaces in which the website is written.
  • Google Analytics — used, with your consent, to understand in aggregate how the website is used. Analytics is not loaded, and no analytics cookie is set, unless you agree to it.
  • Website hosting and technical support — the website is hosted and maintained by service providers acting on our instructions and under written data processing agreements.

Each provider processes data under its own privacy policy, and we encourage you to review them. We are not responsible for the data practices of third parties.

8.2 Links to Other Websites

The website may contain links to external websites — for example those of public authorities, local authorities, partner organisations or our own social media profiles. These links are provided for convenience only. We do not control those websites and are not responsible for their content or their privacy practices.

8.3 Social Media Pages

We operate official pages and accounts on social media platforms, including but not limited to Facebook, Instagram, LinkedIn, TikTok and YouTube. Where we maintain such a presence, the platform operator and CPC Rethink Filters Ltd may act as joint controllers in respect of certain data processed through your interaction with those pages — for example page insights and engagement statistics.

Each platform operator processes your data under its own terms and privacy policy, independently of us. We do not control, and do not take responsibility for, the data practices of social media platforms. For questions about how a platform processes your data, please refer to that platform’s own privacy documentation.

 

9. Personal Data and Retention

9.1 Sensitive Data

We do not collect or process special categories of personal data (such as health, religious or political data) through this website. We advise users not to submit such information through any communication channel.

9.2 Data Sharing

We do not share your personal data with third parties for marketing or commercial purposes, and we do not sell or rent personal data under any circumstances. Limited data may be shared with trusted service providers acting as our processors, solely for operational reasons such as website hosting, maintenance or technical support; these providers act on our instructions and under data processing agreements compliant with Article 28 GDPR.

Personal data may also be disclosed where we are required to do so by law, or to a competent authority acting within its powers.

9.3 Data Retention

We retain personal data only for as long as is necessary for the purposes for which they were collected, unless a longer period is required by law. As a general guide:

  • General enquiries and correspondence: up to 12 months from the date of last contact, unless the matter is ongoing.
  • Correspondence connected with our statutory functions: for as long as required under the Regulations and applicable law.
  • Cookie and analytics data: in accordance with the settings of the relevant provider, typically between 13 and 26 months.
  • Server logs: for a short period, normally not exceeding 12 months, for security and diagnostic purposes.
  • Published material in which individuals appear: for as long as it remains relevant to the record of our work, subject to your right to object.

These are indicative periods and may vary according to the circumstances and applicable legal requirements. When data are no longer needed, they are securely deleted or anonymised. Our retention practices are reviewed periodically.

9.4 Automated Decision-Making

We do not carry out automated decision-making or profiling through the website. No decision producing legal effects, or similarly significant effects, is taken about you on the basis of automated processing alone.

9.5 International Data Transfers

Some of the third-party providers we use (such as video hosting, mapping, font delivery, analytics or social media platforms) may process data in countries outside the European Economic Area. Where such transfers occur, we ensure that they are carried out in accordance with Chapter V of the GDPR — through an adequacy decision of the European Commission, Standard Contractual Clauses, or other appropriate safeguards — so that your data receives a level of protection essentially equivalent to that within the EEA.

 

10. Incident Response

In the event of a personal data breach, we will promptly assess the situation and implement appropriate technical and organisational measures without undue delay.

If the breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the Office of the Commissioner for Personal Data Protection within 72 hours, in accordance with Article 33 GDPR. If it is likely to result in a high risk, we will also inform the affected data subjects without undue delay, in accordance with Article 34 GDPR.

Notifications will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address and mitigate it. Where the breach is unlikely to result in a risk to individuals’ rights and freedoms, no notification to data subjects is required.

 

11. Complaint Mechanism

If you have any concern or complaint about the way we process your personal data, we encourage you to contact us first at admin@refilters.com.cy, so that we can try to resolve the matter promptly.

If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority. In Cyprus, this is the Office of the Commissioner for Personal Data Protection, at commissioner@dataprotection.gov.cy.

 

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our legal obligations or the services active on the website — including when a consent tool or a web analytics service is introduced. The updated version will be posted on this page and takes effect from the date of publication. We encourage you to review this page periodically.

 

13. Contact Us

If you have any question about this Privacy Policy or about our website, please contact us:

CPC Rethink Filters Ltd
229 Tseriou Avenue, 2047 Strovolos, Nicosia, Cyprus
Email: admin@refilters.com.cy
Tel: 7008 7333
Registration No.: ΗΕ 462620

By accessing and using this website, you acknowledge that you have read, understood, and agreed to this Privacy Policy.