Website privacy notice

Data covered by this notice

Inquiry details

When the online inquiry form is enabled, it asks for a name, work email address, company, focus area, and message. Rever uses those details to assess and respond to the request. The form clearly reports when its separate submission service is unavailable and does not claim that an unavailable submission was delivered.

Name, email address, focus area, and message are required for an online submission. Company is optional. Without the required details, Rever cannot assess or respond to the inquiry through the form.

A submission also creates a random request identifier and records limited delivery status and request metadata in Cloudflare D1. The audit record is retained for 90 days and is then deleted. SMTP2GO sends the inquiry to Rever’s authorised mailbox. Inquiry email copies in that mailbox are retained for up to 24 months after the last meaningful contact when no engagement follows.

Essential hosting and security data

Hosting and security infrastructure processes technical request data needed to deliver the website, maintain service logs, limit abusive traffic, and protect the service. REVER HOLDINGS LIMITED is the controller for this essential processing where it determines the purposes and means. Cloudflare processes technical request data as the static hosting and security provider.

When the inquiry form is enabled, Cloudflare Turnstile processes the challenge token and technical signals needed to detect automated abuse. Rever does not use the Turnstile token for advertising or include it in the inquiry email or analytics events.

Analytics

Website analytics is optional. The Google tag does not load and no analytics request is sent unless a visitor first accepts the optional analytics choice. Visitors can reject analytics or withdraw consent at any time through Analytics settings. Declining does not restrict access to the website.

The consent choice is stored in the visitor’s browser. After acceptance, Google Analytics may set analytics cookies and process device, browser, approximate-location, and interaction data. On withdrawal, Rever stops sending analytics events and asks the browser to remove the Google Analytics cookies available to the site.

After consent, Rever sends page views and a limited set of navigation, call-to-action, and successful-inquiry events. GA4 Enhanced Measurement is enabled for the web stream and may also collect standard interaction events where relevant, including page views, scroll depth, outbound link clicks, site search activity, video engagement, file downloads, and form-start or form-submit interaction metadata.

Google Analytics may process the page address, page title, referrer, device and browser information, approximate location, traffic source, and event metadata associated with those interactions. Rever does not intentionally send form field values, names, email addresses, company names, message contents, request identifiers, or Turnstile tokens to Google Analytics. The website does not place inquiry details in page addresses.

Rever configures the site tag not to use Google Signals or ad personalisation. Advertising storage, advertising user data, and advertising personalisation remain denied. The new property starts with a forward-only baseline, and Rever is not importing historical analytics into it.

Purposes and legal bases

When an individual asks Rever to take steps before entering into a contract, REVER HOLDINGS LIMITED processes the inquiry as necessary to take those steps at that person’s request.

For inquiries made by business representatives, and for inquiry follow-up, spam prevention, service security, and limited administrative records, REVER HOLDINGS LIMITED relies on its legitimate interests in responding to prospective clients, operating and protecting the website, and keeping proportionate business records. These interests are considered against the individual’s rights and reasonable expectations.

Optional analytics relies on the visitor’s consent. Consent can be declined or withdrawn without restricting access to the website.

Recipients, processors, and transfers

Inquiry emails are available to authorised Rever operators who need them to assess and follow up on the inquiry. Cloudflare hosts and protects the static website. When the form service is enabled, Cloudflare Turnstile helps distinguish legitimate submissions, a Cloudflare Worker processes the request, Cloudflare D1 holds the limited 90-day audit record, and SMTP2GO delivers the inquiry email. Google Gmail provides the authorised mailbox. The private mailbox destination is not published.

Cloudflare and SMTP2GO act as processors where they handle inquiry or technical request data on Rever’s instructions. Google provides Gmail and, only after consent and activation, Google Analytics 4. Providers may also determine independent account, security, and service purposes. REVER HOLDINGS LIMITED’s controller role does not extend to purposes that a provider independently determines.

Cloudflare, SMTP2GO, Google Gmail, and Google Analytics may process data outside the European Economic Area. Cloudflare’s processor transfers are covered by its Data Processing Addendum. SMTP2GO publishes its Privacy Policy and Data Processing Addendum. Google processing follows the Google Privacy Policy and its data-transfer frameworks. Further information or a copy of the relevant transfer safeguards may be requested through the public privacy contact. The website does not sell inquiry data or provide it to data brokers.

Google Analytics receives website analytics only after the visitor accepts and Rever activates the production property. SMTP2GO and the separate inquiry Worker receive form data only when the form service is enabled and a visitor submits it.

Retention

Inquiries that do not lead to an engagement are manually deleted 24 months after the last meaningful contact. This applies to the inquiry-email copies held in authorised Rever mailboxes. If an inquiry leads to an engagement, relevant records move to the client and legal-record schedule that applies to that engagement. A Rever owner or operator performs a manual review each quarter to identify and delete inquiry records whose retention period has ended.

The inquiry Worker keeps its limited D1 delivery and abuse-control audit record for 90 days. Essential hosting and security logs use the configured retention period of the relevant service and are not extended for general business use. A log excerpt preserved separately for a specific security incident or legal obligation is kept only until that purpose ends. Provider-independent account and security records follow the provider’s published retention policy.

Automated decisions

Rever does not use inquiry data for automated decision-making or profiling.

Rights, requests, and complaints

Subject to applicable data-protection law, an individual may request access, correction, deletion, restriction, or a copy of personal data, and may object to processing based on legitimate interests. Where the right applies, an individual may also receive personal data they provided in a structured, commonly used, machine-readable format and have it transmitted to another controller (data portability).

Privacy requests may be sent to contact@reverholdings.cy. A requester should avoid including sensitive information that is not needed for the request.

An individual may also complain to the Cyprus Commissioner for Personal Data Protection or another competent supervisory authority.

Security and updates

The site uses HTTPS and managed cloud services, but no internet or storage system can be guaranteed completely secure. This notice may change when the site’s data flows, service providers, controller details, or approved policies change. The review date above will be updated when material revisions are published.