Privacy Policy

1. Who we are

The data controller for personal information collected through this website is The Gateway Project (Pyla) Ltd., a not-for-profit company registered in Cyprus, with its registered office in Pyla, Larnaca District, Cyprus.

You can reach our data-protection contact at [email protected].

2. Information we collect

We only collect personal information that you give us directly or that is strictly necessary to operate this website. This includes:

• Contact form submissions — your name, email address, organisation (optional), and the message you send us.
• Email correspondence — any information you choose to include when you write to us.
• Programme application data — where you apply through a partner organisation to join an exchange, the partner shares relevant details with us with your consent.
• Technical data — limited server logs (IP address, browser type, pages visited) for security and operational purposes.

We do not knowingly collect special-category data (such as health, racial or religious information) through this website.

3. How we use information

We use personal information to:

• Respond to enquiries from partner organisations, funders, journalists, volunteers and young people.
• Administer youth exchanges and follow-up activities.
• Send occasional updates to people who have explicitly asked to hear from us.
• Meet our legal, accounting and reporting obligations to funders such as Erasmus+.
• Keep this website secure and improve its content.

We do not use your information for automated decision-making or profiling.

4. Lawful basis

Under Article 6 of the GDPR, we rely on the following lawful bases:

• Consent — when you submit a contact form, sign up for updates, or take part in a programme.
• Contract — to deliver an exchange or partnership you have engaged us for.
• Legal obligation — to satisfy funder reporting and statutory record-keeping.
• Legitimate interests — to keep this website secure and to follow up with partners and supporters, balanced against your rights.

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out beforehand.

5. Cookies and analytics

This website uses only strictly-necessary session cookies that are required for the site to function (for example, to remember your language preference and protect form submissions). These do not require consent under EU rules.

We do not use third-party advertising or cross-site tracking cookies. If we add privacy-friendly analytics in future, we will update this policy and ask for consent where required.

6. Sharing and processors

We do not sell personal information. We share it only with:

• Trusted service providers acting as processors on our behalf (for example, our email host and website host), bound by written data-processing agreements.
• Partner youth organisations and funders, where this is necessary to deliver an exchange you have applied to participate in.
• Public authorities where we are legally required to do so.

7. How long we keep data

We keep personal information only for as long as we need it, including to meet legal, accounting or reporting requirements:

• Contact-form enquiries: up to 24 months after our last interaction.
• Programme participant records: for the duration of the programme and up to 7 years afterwards, in line with Erasmus+ and statutory audit requirements.
• Newsletter subscribers: until you unsubscribe or after 24 months of inactivity.
• Server logs: up to 90 days.

8. International transfers

Our data is processed inside the European Economic Area (EEA) wherever possible. Where a processor operates outside the EEA, we rely on Standard Contractual Clauses or an adequacy decision to ensure your data receives an equivalent level of protection.

9. Your rights

Under the GDPR you have the right to:

• Access the personal information we hold about you.
• Rectify inaccurate or incomplete information.
• Erase your data ("right to be forgotten") where the law allows.
• Restrict or object to processing in certain circumstances.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time where consent is the basis of processing.
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, please email [email protected]. We will respond within one month.

10. Children and young people

Many of our programmes work with young people aged 15 and over. When a young person under 16 applies through a partner organisation, we obtain consent from a parent or legal guardian, and we limit data collection to what is strictly necessary for the programme and for safeguarding purposes.

11. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These include encrypted transport (HTTPS), access controls and staff training. No method of transmission over the internet is 100% secure, so we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy from time to time to reflect changes in our practice or in the law. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email.

13. Contact and complaints

Questions about this policy or how we handle your data should be sent to [email protected] or by post to The Gateway Project (Pyla) Ltd., Pyla, Larnaca District, Cyprus.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus, or with the supervisory authority in the EU member state where you live, work or where the alleged infringement took place.