Privacy policy

Who we are

Apex Island Ltd ("Apex Island", "we", "us") is a company registered in Cyprus, company number HE495313, with its registered office at 7 Dositheou Street, Block C, Office 001C, 1071 Nicosia, Cyprus. We are the data controller for the personal data described in this policy. You can reach us at privacy@apex-island.com.

What we collect

When you send us a note through this website, we collect: your full name and email address, and, if you choose to give them, your phone number, company, role, and the message you write.

When you interact with the site, we also record technical context: the page you were on, the page you first arrived on, the site that referred you, any campaign tags in the link you followed, and your browser's user agent string.

When you book a call with us, we receive the details you give to Google Calendar, including your name, email address and the time you selected.

We do not collect special categories of personal data, and we do not ask for payment details through this website.

Why we use it, and our legal basis

• To answer you. When you contact us, we use your details to reply and to discuss whether we can help. Our legal basis is legitimate interest: you asked us to get in touch.
• To run and improve the site. We use technical and campaign data to understand which pages and campaigns bring people here. Our legal basis is legitimate interest in operating our business.
• To stay in touch. When you contact us you also agree, in the same tick box, to us sending you occasional emails about our work. Our legal basis is your consent, together with our legitimate interest in staying in contact with people who have asked about our services. You can withdraw at any time, and every email carries an unsubscribe link.

Who we share it with

We do not sell your personal data, and we do not share it for anyone else's marketing.

We use a small number of service providers who process data on our behalf:

• Supabase: database and application hosting for the details you submit.
• Google: calendar scheduling when you book a call, and our business email.
• Lovable: hosting for this website.

We may also disclose data where we are legally required to.

Where your data goes

Our providers may store or process data outside the European Economic Area, including in the United States. Where that happens, transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep it

We keep inquiry records for as long as we are in contact with you and for up to 24 months afterwards, so that we can pick up a conversation where it left off. If you consent to marketing, we keep your contact details until you unsubscribe or ask us to delete them. We keep a record of your consent, the wording you agreed to and when, for as long as we rely on it, plus a reasonable period afterwards, so we can show it was properly given.

Your rights

Under the GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data erased; restrict or object to how we use it; receive your data in a portable format; and withdraw consent at any time where we rely on it.

To exercise any of these, email privacy@apex-island.com. We will respond within one month.

If you are not satisfied with our response, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the supervisory authority in the country where you live.

Cookies and similar technologies

We store information on your device only when it is strictly necessary for the site to work, or when you have agreed to it. We do not use advertising cookies. When you first visit, a banner lets you accept all, reject all, or choose by category. Nothing optional is stored or loaded until you choose, and the site works fully either way.

Strictly necessary (always on)

• apex.consent.v1 (local storage): remembers your cookie choice. Kept for 6 months, then we ask again.
• __cf_bm (cookie, set by our hosting provider's security service): protects the site against automated abuse. Expires after 30 minutes.
• Sign-in session (local storage, admin area only): keeps the site owner signed in. Not used for visitors.
• apex.internal (local storage, admin area only): set when the site owner signs in, so the owner's own visits and clicks are kept out of site statistics. Stays until the browser storage is cleared. Not used for visitors.
• Rate limiting: when you submit a form or book a call, we keep a one-way hash of your IP address on our servers for abuse prevention. Nothing is stored on your device.

Analytics and measurement (optional)

• apex.attribution.v1 andapex.journey.v1 (session storage): the page you arrived on, the referring site, campaign tags, and the pages you view during this visit (up to 30). If you contact us, this is sent with your message so we know what brought you here. Cleared when you close the tab, or when you withdraw consent. Without consent we only read campaign tags from the address of the page you submit a form on, and store nothing.
• Google Analytics 4 (cookies _ga and _ga_*): counts visits, pages viewed, form submissions (by form type only) and booking-button clicks, so we can see which pages and campaigns work. IP addresses are anonymized, and Google Signals and ad personalization are off. We never send your name, email or other personal details. Cookies last up to 2 years. Google Ireland Limited processes this data on our behalf. Loaded only after you accept, and the cookies are deleted if you withdraw consent.

Embedded media (optional)

• Venue videos are hosted on YouTube. Nothing is loaded from YouTube until you press play. The video then loads from youtube-nocookie.com, and YouTube (Google) may store data on your device under its own policy. Podcast thumbnails are served from this site; links to YouTube, Spotify, LinkedIn and Instagram only contact those services if you click them.

Our fonts are hosted on this site, so no font request reaches a third party.

Changing your choice

Use the "Cookie settings" link at the bottom of any page to change or withdraw your choice at any time. Withdrawing is as easy as giving consent, and you can also clear site data in your browser settings.

Changes to this policy

If we change how we handle personal data, we will update this page and change the date at the top.