Privacy Policy

A.P.K. Prestige Drives Limited, a private limited company incorporated under the Companies Law Cap. 113 of the Republic of Cyprus (Registration No. HE 458041), with its registered office in Limassol, Cyprus, trading as Prestyn Motors ("we", "us", "our"), is the data controller of your personal data within the meaning of Regulation (EU) 2016/679 ("GDPR") and the Processing of Personal Data (Protection of Individuals) Law of 2018 (Law 125(I)/2018), as amended.

To contact us regarding data protection matters: info@prestynmotors.com | +357 96 307 227 | Limassol, Cyprus.

We collect and process the following categories of personal data:

• Identity data: full name.
• Contact data: email address, telephone number, and postal address.
• Account data: username and hashed password, account preferences.
• Transaction data: vehicle purchase orders, payment instructions, import records, invoices, customs declarations, and receipts.
• Communication data: messages and correspondence exchanged via email, WhatsApp, or our website contact forms.
• Technical data: IP address, browser type, device type, pages visited, and session duration, collected automatically via cookies and analytics tools.
• Compliance data: any identification or vehicle documentation provided for customs or regulatory purposes.

We process your personal data on the following legal bases under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)): to register and manage your account, process import orders, and provide the services you have requested.
• Legal obligation (Art. 6(1)(c)): to comply with Cyprus and EU law, including the keeping of financial records under Companies Law Cap. 113, VAT obligations under the VAT Law of 2000 (as amended), and customs requirements.
• Legitimate interests (Art. 6(1)(f)): for website analytics to improve our services, fraud prevention, and communications with existing customers. We balance these interests against your rights and freedoms.
• Consent (Art. 6(1)(a)): for non-essential cookies and direct marketing to prospective customers, where required. Consent may be withdrawn at any time.

Your personal data is used strictly for the following purposes:

• Registering and maintaining your account on our platform.
• Processing your vehicle import order: vehicle sourcing and purchase from Japanese market suppliers, shipping, customs clearance, SVA inspection, registration, and delivery.
• Issuing invoices, receipts, customs declarations, and registration documents.
• Sending transactional updates about your import status.
• Responding to your enquiries and providing customer support.
• Improving our website and services through anonymised analytics.
• Complying with our legal, tax, and regulatory obligations.
• Detecting and preventing fraud and security breaches.

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

We may share your personal data with the following categories of recipients, only to the extent necessary:

• Shipping and logistics providers: to arrange international freight and marine insurance from Japan.
• Cyprus Customs (T.E.FA.) and the Department of Road Transport: to fulfil mandatory import, SVA inspection, and vehicle registration procedures.
• Technology service providers: Supabase Inc. (cloud database and authentication, EU-hosted servers); Cloudflare Inc. (security and bot protection); Vercel Inc. (website hosting); PostHog Inc. (anonymised product analytics).
• Professional advisers: lawyers, accountants, or auditors, where strictly necessary and bound by professional confidentiality.

All third-party processors are required to process your data only as instructed and in compliance with applicable data protection law, pursuant to data processing agreements under Art. 28 GDPR.

Some service providers (Supabase, Cloudflare, Vercel, PostHog) may process data outside the European Economic Area ("EEA"). Where such transfers occur, we ensure appropriate safeguards are in place in accordance with Chapter V GDPR, including reliance on European Commission adequacy decisions or Standard Contractual Clauses (SCCs). You may request a copy of the relevant safeguards by contacting us.

We retain your personal data only for as long as necessary for the purposes set out in this Policy:

• Account data: for the duration your account is active, plus six (6) months following account closure.
• Transaction and financial records: seven (7) years, as required by the Income Tax Law (Cap. 297, as amended) and the VAT Law of 2000.
• Communication records: three (3) years from the date of last contact.
• Technical / log data: up to twelve (12) months.

On expiry of the relevant retention period, your data is securely deleted or anonymised.

Under GDPR and Law 125(I)/2018, you have the following rights in respect of your personal data, exercisable at any time by contacting info@prestynmotors.com:

• Right of access (Art. 15): to obtain confirmation of whether we process your data and to receive a copy.
• Right to rectification (Art. 16): to have inaccurate or incomplete data corrected without undue delay.
• Right to erasure (Art. 17): to request deletion where there is no longer a lawful basis for processing.
• Right to restriction (Art. 18): to limit processing in certain circumstances, e.g. while accuracy is contested.
• Right to data portability (Art. 20): to receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): to object to processing based on legitimate interests or direct marketing at any time.
• Right not to be subject to automated decision-making (Art. 22): we do not use solely automated decisions that produce legal or similarly significant effects.

We will respond to your request within one (1) calendar month of receipt. We may extend this period by a further two months for complex or numerous requests, in which case we will inform you accordingly.

You have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus (the competent supervisory authority under Art. 77 GDPR):

We encourage you to contact us first so that we can address your concern directly before escalating to the supervisory authority.

For full details of the cookies we use, the purposes for which they are set, and your choices, please refer to our Cookie Policy.

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. Material changes will be communicated by email to registered users or by a prominent notice on our website. The "Last updated" date at the top of this page reflects the date of the most recent revision. We encourage you to review this Policy periodically.