Confidentiality of your IR63 and personal data

Our confidentiality commitment

Incometaxcyprus treats your IR63 (Employer's Tax Withholding Certificate) and every figure or document you upload as strictly confidential. We do not disclose, sell, share or publish your IR63, personal details, income, deductions, or any other information from your questionnaire to any third party, except as strictly required to prepare and submit your Cyprus income tax declaration on your behalf, or where disclosure is required by law.

Legal basis (GDPR)

We process your personal data under Regulation (EU) 2016/679 (GDPR) and the Cyprus Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data. Our lawful bases are:

• Performance of a contract (Art. 6(1)(b)) — to prepare, review and file your TD1 / IR1 declaration.
• Legal obligation (Art. 6(1)(c)) — to retain records required by Cyprus tax and accounting legislation.
• Your consent (Art. 6(1)(a)) — for any processing beyond the above, which you can withdraw at any time.

Professional secrecy

Cyprus tax confidentiality rules under the Assessment and Collection of Taxes Law (Law 4/1978, as amended) and the professional duty of confidentiality of licensed tax advisors apply to every member of our team. Unauthorized disclosure of taxpayer information is a serious legal and professional offence.

Who can see your IR63

• The licensed advisor assigned to prepare your declaration.
• The Cyprus Tax Department (e.g. via TaxisNet), only as required to submit your declaration or to respond to a lawful request from the authorities.
• Our secure infrastructure providers, strictly as data processors bound by GDPR contracts.

We do not share your IR63 with marketers, advertisers, data brokers or any party not directly involved in preparing your tax filing.

Retention

We retain your IR63 and related records for the period required by Cyprus tax and accounting law (currently 6+ years from the end of the relevant tax year). After the statutory period expires, records are securely deleted.

Security

Uploads are transmitted over encrypted HTTPS and stored in a private, access- controlled location. Access is limited to staff and advisors who need it to perform the service.

Your rights under GDPR

• Right of access to your data
• Right to rectification of inaccurate data
• Right to erasure (subject to legal retention obligations)
• Right to restrict or object to processing
• Right to data portability
• Right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus (dataprotection.gov.cy).

Contact

To exercise any of these rights or ask a privacy question, email us at hello@incometaxcyprus.com.