Privacy policy

Who is responsible

Data controller: By Jensen Group, Nikolaou Leonidou 6, 8220 Chloraka, Cyprus.

Company registration number: pending issuance. It will be published here when received.

Privacy questions and requests can be submitted securely through our data-rights form or sent by post to the address above.

What we process and why

We may process your name, email, order and location details, instructions, uploaded photograph, selected historical scene, payment status and support correspondence. We use this information to review, create, deliver and support the memory you request; administer payments and records; keep the service secure; and meet legal obligations.

Depending on the activity, our legal basis is performing a contract or taking steps you request before a contract, complying with a legal obligation, our legitimate interests in operating and protecting the service, or consent where the law requires it.

How the service works

Your request is saved for human intake review. AI-assisted tools may help create the requested historical reconstruction, and a person reviews production before delivery. Generated media is a creative reconstruction, not authentic historical footage. We do not make decisions with legal or similarly significant effects about you solely by automated means.

Payments and service providers

Stripe processes payments and receives the information needed to complete and document a transaction. City Time Box does not store full card details. Netlify provides hosting, forms and server functions. Any additional production provider must be assessed and added to this policy before it receives customer material.

Where a provider processes personal data outside the European Economic Area, we require an applicable lawful transfer mechanism and appropriate safeguards.

Retention and security

Source photographs are intended to be deleted 30 days after production unless a legal dispute or documented legal obligation requires limited retention. Order, payment and accounting records may be retained for longer where required by law. Privacy and support messages are kept only as long as needed to resolve the request and document the response.

We use access controls and proportionate technical and organisational safeguards. No internet service can guarantee absolute security.

Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent where processing relies on consent. We may need to verify your identity before acting. Please do not send identity documents unless requested through a secure channel.

You may also lodge a complaint with the Cyprus Office of the Commissioner for Personal Data Protection or another competent data-protection authority. The European Data Protection Board’s complaint page lists the relevant authorities.