(A) This Policy

This Privacy Policy explains how Rega collects and uses personal data when you visit our website, contact us, or use us to coordinate a corporate services request. Rega is operated by P.K.Z. Your Point Services Ltd, a company registered in Cyprus under number HE475295, with registered address at Georgiou Anastasiou 9, 1st floor, 1107, Nicosia, Cyprus. In this Policy, “Rega”, “we”, “us”, and “our” refer to that company.

Rega is a technology and coordination provider, not a licensed corporate services provider. We coordinate onboarding, information and document collection, signatures, and provider communications. We act as a controller where we determine how and why data is used for our website, enquiries, communications, billing, and coordination. An independent provider has separate responsibilities for processing it controls.

(B) Collection of Personal Data

We may collect personal data directly from you, from another person acting for a proposed or existing client, from the relevant corporate services provider, and from public or professional sources where appropriate. If you give us data about another person, you should be authorised to do so and should direct that person to this Policy where practicable.

We also collect technical information through cookies and similar technologies as described in section (N). Please use the communication method identified for your matter and do not send unnecessary sensitive material.

(C) Creation of Personal Data

We may create correspondence, coordination notes, billing records, records of instructions and approvals, and records showing when information or documents were requested, received, or passed to a provider. We may record whether an onboarding step remains outstanding. Provider acceptance and compliance decisions are made by the relevant provider.

(D) Categories of Personal Data

Depending on the request, we may process:

• identity and contact information, including name, date of birth, nationality, residential address, email, telephone number, passport or other identity document details, and copies;
• proof of address and information about residence or tax residence;
• professional, company, business, ownership, control, and tax information, including details of beneficial owners, directors, shareholders, authorised persons, and corporate representatives;
• information about the requested service, proposed structure, activities, counterparties, expected transactions, and related communications;
• source of funds or source of wealth information where the provider requires it for acceptance or compliance;
• signature, billing, payment, and transaction administration information; and
• website device, browser, cookie, and interaction data.

These are data categories. They are not all special category data under Article 9 GDPR, and we do not collect every item in every matter.

(E) Sensitive and Criminal-Offence Data

We request special category data only where necessary. Article 9 data requires both an Article 6 basis and an applicable Article 9 condition, such as explicit consent where appropriate or legal claims. We process criminal conviction or offence data only where authorised by Union or Member State law with required safeguards. Fraud prevention does not remove these requirements.

(F) Purposes and Legal Bases

We process personal data for the following purposes and legal bases:

• where an individual is personally a party, to take requested steps before entering a contract and to perform that contract;
• for corporate representatives, beneficial owners, directors, employees, advisers, and other connected people, our legitimate interests in responding to the requested service, coordinating onboarding and provider communications, administering the business relationship, and keeping an accurate record of instructions, subject to a balancing assessment and the person’s rights;
• to comply with legal obligations imposed on Rega under applicable EU or Member State law. This does not mean that Cayman obligations imposed on WB are Rega’s own legal obligations;
• for our legitimate interests in protecting systems and communications, preventing misuse and fraud, investigating incidents, and establishing, exercising, or defending legal claims;
• for website analytics and advertising measurement through cookies and similar technologies, our legitimate interest in understanding and improving the website and measuring our advertising, as described in section (N); and
• for marketing, consent where the law requires it, or another lawful basis where marketing is permitted without consent. You may object or unsubscribe at any time.

You may withdraw consent without affecting earlier lawful processing. If information required for the requested service is not provided, Rega or the independent provider may be unable to proceed.

(G) Sharing Personal Data

We may share relevant data with the independent corporate services provider, professional advisers, payment, accounting, hosting and communications suppliers, authorities where required, and recipients you authorise. We limit disclosure to what is necessary and remain responsible for our own disclosure, security, retention, and transfer compliance, including liability imposed by law. Suppliers that process data only on our behalf are subject to appropriate processing agreements and lawful instructions. Providers acting for their own statutory or professional purposes have their own controller responsibilities.

(G1) Independent Cayman Corporate Services Provider

The current Cayman corporate services provider is WB Corporate Services (Cayman) Ltd, listed by the Cayman Islands Monetary Authority as a Corporate Service Provider under register reference 1290181. WB’s public privacy policy is available at https://wb.group/privacypolicy/, and WB may be contacted at info@wb.group.

To the extent WB determines its own purposes and means, it acts as an independent controller for its acceptance decisions, identity and compliance checks, Cayman anti-money laundering processes, statutory filings, service delivery, and retention obligations. A request to erase data held by Rega does not automatically erase data held by WB. Rights must be considered against each organisation’s processing and applicable legal duties.

Roles depend on the actual activity and agreements. Rega may be a processor for a specific activity or a joint controller with WB where the legal test is met. We can direct requests to WB without avoiding Rega’s own obligations.

(H) International Transfers

We may transfer information needed for the Cayman service to WB in the Cayman Islands. Countries used by other providers may vary; email us for relevant details. Before a restricted transfer, we will ensure a lawful mechanism, such as an EU adequacy decision or Standard Contractual Clauses with a transfer assessment and supplementary measures where needed. UK rules are addressed only where applicable.

We do not treat acceptance of this Policy as consent authorising an international transfer. You may ask at hello@thepointlegal.com for information about the applicable mechanism and how to obtain a copy of relevant safeguards, subject to necessary redactions.

(I) Security

We are responsible for appropriate technical and organisational measures to protect personal data against unlawful access, disclosure, alteration, loss, or destruction. No transmission or storage is completely secure. We assess incidents and make notifications where legally required. These limitations do not remove our statutory security obligations.

(J) Accuracy

We take reasonable steps to keep personal data accurate and current for the purposes for which it is used. Please tell us if information changes or appears incorrect. We may ask for updated evidence where accuracy matters to the requested service.

(K) Data Minimisation

We aim to collect, use, and disclose only personal data that is adequate, relevant, and limited to what is necessary for the relevant purpose. Provider requirements can differ by service and applicant. We will not describe all provider compliance material as required by Rega’s own legal duties where that is not the case.

(L) Retention

We retain data only as long as necessary for its purpose and applicable legal, accounting, security, dispute, and claims requirements. The period depends on the record, relationship status, limitation periods, and preservation duties. We then delete or anonymise it unless the law permits or requires retention. WB applies its own criteria to data it controls.

(M) Your Rights

Subject to applicable limits, you may request access, a copy, correction, erasure, restriction, portability, and processing information. You may object to legitimate-interest processing or direct marketing, withdraw consent, and challenge qualifying solely automated decisions. Some rights apply only in specified circumstances, and legal duties or others’ rights may limit a request.

Send requests to hello@thepointlegal.com. We may need information to verify identity and locate the relevant records. You may complain to the Cyprus Commissioner for Personal Data Protection or another competent supervisory authority in your place of residence, work, or the alleged infringement. Exercising rights with Rega does not automatically exercise rights with WB, but we can help direct the request.

(N) Cookies and Similar Technologies

We use necessary cookies to operate the website, and analytics and advertising cookies and similar technologies to understand how the website is used and to measure the performance of our advertising. These load when you open the website. A notice on the website informs you about them; by continuing to use the website, you agree to their use.

We use the following services:

• Google Analytics (Google Ireland Limited and Google LLC) to measure website visits and interactions, including visits from our Google Ads advertising. Google may receive the page URL, IP address, browser and device information, and cookie identifiers. See https://policies.google.com/privacy.
• Microsoft Clarity (Microsoft Corporation) to understand how visitors use the website through heatmaps, session replays and interaction data such as clicks, scrolling and page navigation. Clarity masks text entered into fields and other sensitive content by default. See https://privacy.microsoft.com/privacystatement.
• Meta Pixel (Meta Platforms Ireland Limited) to send page-view events to Meta to measure advertising performance. Meta may receive the page URL, IP address, browser information, and cookie identifiers. We do not enable automatic advanced matching or send incorporation documents or form contents through this pixel. See https://www.facebook.com/privacy/policy/.
• LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) to measure the performance of our LinkedIn advertising, including clicks on WhatsApp and Telegram contact links. LinkedIn may receive the page URL, IP address, browser information, and cookie identifiers. See https://www.linkedin.com/legal/privacy-policy.

These providers may process data outside the EEA, including in the United States, where Google LLC, Microsoft Corporation, Meta Platforms, Inc. and LinkedIn Corporation participate in the EU-U.S. Data Privacy Framework.

You can block or delete cookies in your browser settings, use the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout, or object by emailing hello@thepointlegal.com. Blocking necessary storage may affect website functions.

(O) Marketing

We may send information about Rega services where we have the required consent or another lawful basis. You can unsubscribe using the link in a message, where provided, or email us. We will keep the minimum information needed to record an opt-out. We do not use service communications to override a marketing objection.

(P) Contact and Changes

P.K.Z. Your Point Services Ltd controls Rega’s own enquiries, website, communications, billing, and coordination processing. Contact hello@thepointlegal.com or Georgiou Anastasiou 9, 1st floor, 1107, Nicosia, Cyprus. We may update this Policy for changes in law or processing and bring material changes to attention where appropriate.

(Q) Definitions

• “controller”, “processor”, “personal data”, “processing”, and “special categories of personal data” have the meanings given in the GDPR;
• “GDPR” means Regulation (EU) 2016/679, as applicable;
• “independent controller” means an organisation that determines its own purposes and means for particular processing, rather than acting only on another controller’s instructions;
• “corporate services provider” or “provider” means the licensed or otherwise authorised third party delivering the relevant corporate service; and
• “you” includes a website visitor, enquirer, client, applicant, corporate representative, beneficial owner, director, shareholder, authorised person, or other individual whose data is processed in connection with a request.