Privacy Policy

1. Who is responsible

HEARTWING MEDIA LTD, a company registered in Cyprus, is the controller of personal data collected through this corporate website. Contact info@heartwingmedia.com with “Privacy” in the subject line. Our corporate particulars appear on the Company information page.

This notice covers the Heartwing Media corporate website and enquiries made through it. Gina’s application has its own privacy information. Following a link to Gina does not transfer a contact-form message or create a family account.

2. Information we receive

When you contact us, we receive your name, email address, optional organisation, selected enquiry category and message. Further correspondence may include details you choose to provide about a proposal, service request or business relationship.

For security, the contact service uses a short-lived anti-forgery cookie and an IP-derived keyed identifier to limit automated requests. The identifier is not used for advertising or cross-site tracking. Our hosting infrastructure may process IP addresses, requested paths, timestamps and error information to deliver and protect the website. We do not request attachments, passwords, card details or children’s personal information through this form.

3. Why we use information

We use enquiry details to understand and answer your request, evaluate relevant proposals and maintain necessary correspondence. Our usual basis is our legitimate interest in managing communications and protecting our services. Where you ask us to take steps towards a contract with you, we rely on those pre-contractual steps; where you act for an organisation, we generally rely on legitimate interests. Applicable legal duties may require us to retain or disclose certain information.

We do not use contact messages to enrol you in marketing, sell personal information or make solely automated decisions producing legal or similarly significant effects. Providing the required fields is voluntary, but without them we cannot respond through the form. You can contact us by email instead.

4. Who may receive it

Access is limited to authorised people who need the information to handle the enquiry, operate the site or meet legal obligations. Our website hosting and email providers process information on our behalf under appropriate contractual arrangements. Professional advisers and competent authorities may receive information where reasonably necessary for legal advice, claims, compliance or a lawful request. Prospective partners do not receive your message simply because they are described on our partnership page.

5. International processing

Hosting and email arrangements determine where information is processed. Where a service provider transfers personal data outside the European Economic Area, the relevant transfer must be covered by an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses, together with supplementary measures where needed. Contact us for information about the safeguards applicable to your data. We do not treat an enquiry as consent to unrestricted international transfers.

6. Retention

Our retention schedule for ordinary enquiries is up to 12 months after the last substantive contact, unless an ongoing relationship, dispute or legal duty justifies longer retention. Records forming part of a contract or legal matter follow the applicable business-record schedule. Privacy-request correspondence is normally retained for up to 24 months after closure to document our response.

The application’s rate-limit identifiers expire after one hour and are purged on the next request and at service start. The application does not save message bodies to a contact database or application logs; accepted enquiries are held in the company email system. Server security logs should be retained for no longer than 30 days unless an incident requires preservation. Email backup copies follow the provider’s documented backup lifecycle and should not be restored to active use after a deletion except where necessary for recovery and then re-deleted.

7. Your choices and rights

Depending on the circumstances, you can request access, correction, erasure, restriction or a portable copy of relevant information. You can object to processing based on legitimate interests. If we rely on consent for a future, separately identified purpose, you can withdraw it without affecting earlier lawful processing.

Email us to exercise your rights. We may ask for proportionate evidence to confirm identity. We normally respond within one month; a permitted extension for complex or numerous requests will be explained within that period. Rights are subject to applicable conditions and exemptions. You may complain to the Cyprus Commissioner for Personal Data Protection or another competent supervisory authority, including where you live or work in the EEA.

8. Children, security and changes

This corporate contact service is intended for adults, including parents, carers and professional contacts. Children should ask an adult to contact us. If you believe we have received unnecessary personal information about a child, tell us so we can assess and remove it where appropriate.

We use proportionate measures to protect communications, including encrypted transport when deployed over HTTPS, restricted access and validation of submitted information. No internet service can guarantee absolute security. This notice may change when our services or processing arrangements change; the revision date below identifies the current version.