Clipcompass / Purepixls Field Inquiries
Atlas Home / Statutory Governance

Privacy & Data Protection Policy

Effective Date: January 1, 2026. This comprehensive Privacy Policy defines our data governance standards in compliance with EU General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA).

1. Data Controller Information

This website (clipcompasspurepixls.rest) is operated by Clipcompass Purepixls Ltd., registered under Company Registration No. HE-491823, having its scientific station at Cedar Valley Station, Paphos Forest Reserve, Troodos Mountain Complex, 4800, Cyprus. For all data protection and privacy inquiries, you may reach our designated Data Protection Officer (DPO) at [email protected].

2. Categories of Personal Data Collected

We strictly adhere to the principle of data minimization. We only collect personal information that is demonstrably necessary to deliver our academic services, process botanical field permit inquiries, and operate our open-access botanical repository:

  • Direct Contact Data: When you complete our field inquiry form, we collect your full name, academic affiliation, email address, and the specific details of your research scope.
  • Technical and Telemetry Data: We automatically record IP addresses (truncated and anonymized prior to storage), browser classification, screen resolution, referrers, and timestamps of page interactions.
  • Local Storage and Preference Data: We store your consent choices regarding analytics and cookies locally on your device via HTML5 Local Storage.

3. Lawful Basis for Processing (GDPR Article 6)

We process personal data solely under verified lawful grounds recognized by Article 6 of the General Data Protection Regulation (Regulation (EU) 2016/679):

  • Consent (Art. 6(1)(a)): For non-essential analytics tracking and direct inquiries where you explicitly opt in.
  • Contractual / Pre-Contractual Measures (Art. 6(1)(b)): To review research permits, herbarium access requests, and institutional partnership agreements.
  • Legitimate Interests (Art. 6(1)(f)): To safeguard the website against malicious automated attacks, denial-of-service attempts, and unauthorized data scraping.
  • Legal Compliance (Art. 6(1)(c)): To preserve records required by the Republic of Cyprus and European Union statutory bodies.

4. Third-Party Data Processors and Service Providers

We do not sell, rent, or trade your personal information to commercial advertising networks or data brokers. Data may be processed on our behalf by vetted third-party service providers bound by strict Data Processing Agreements (DPAs):

  • Hosting Infrastructure: Cloud hosting facilities located strictly within the European Union / European Economic Area (EEA), ensuring complete alignment with GDPR Chapter V standards.
  • DNS & Threat Mitigation: Global content delivery networks that route and sanitize HTTP traffic without persisting unencrypted personal payloads.
  • Academic Collaboration Partners: Official state forestry bodies, including the Cyprus Department of Forests, strictly for processing authorized scientific field access permits.

5. Data Retention Schedules

We retain personal data only for the duration necessary to satisfy the specific purpose for which it was gathered:

  • Field Inquiries & Messages: Retained for a maximum of twenty-four (24) months from the date of last correspondence, after which records are permanently purged.
  • Technical Logs: Server access and error logs are stored on rotating schedules and permanently overwritten after thirty (30) days.
  • Cookie Consent Tokens: Persisted in your browser's local storage for up to twelve (12) months unless cleared manually by the user.

6. Your Statutory Rights Under GDPR and CCPA

Depending on your jurisdiction, you are entitled to exercise the following fundamental rights regarding your personal information:

  • Right of Access (GDPR Art. 15): You have the right to request a complete copy of the personal information we hold concerning you.
  • Right to Rectification (GDPR Art. 16): You may request the immediate correction of inaccurate or incomplete personal records.
  • Right to Erasure ("Right to be Forgotten", GDPR Art. 17): You may demand the deletion of your personal data where retention is no longer justified.
  • Right to Restrict Processing (GDPR Art. 18): You may restrict processing under circumstances where the accuracy of the data is contested.
  • Right to Data Portability (GDPR Art. 20): You may request your data in a structured, commonly used, and machine-readable format.
  • Right to Object (GDPR Art. 21): You may object at any time to processing grounded in legitimate interest.
  • California Privacy Rights (CCPA / CPRA): California residents hold the right to know what personal categories are collected, request deletion, opt out of any hypothetical sale of personal info, and be free from discriminatory treatment for exercising privacy rights.

To exercise any of these statutory rights, please submit your verified written request to our Data Protection Officer at [email protected]. We verify identity and respond within thirty (30) calendar days at zero charge.

7. Security Measures & Technical Safeguards

We employ state-of-the-art administrative, technical, and physical safeguards to prevent accidental loss, unauthorized access, destruction, or disclosure of personal data. All communication between your client device and our servers is encrypted using modern Transport Layer Security (TLS 1.3). Server endpoints enforce strict firewall boundaries, role-based access protocols, and automated anomaly detection.

8. Supervisory Authority Contact

If you believe that our handling of your personal data violates European privacy regulations, you possess the legal right to lodge a formal complaint with the competent supervisory authority:

Office of the Commissioner for Personal Data Protection (Cyprus)
15 Kypranoros Street, 1061 Nicosia, Cyprus
Website: www.dataprotection.gov.cy