Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when we provide services to customers in the relevant area. It applies to all customers in that area and is intended to reflect the requirements of the General Data Protection Regulation (GDPR) and applicable data protection laws.

We are committed to handling personal data in a lawful, fair, transparent, and secure manner. This policy should be read carefully to understand what data we collect, why we collect it, how long we keep it, who may process it on our behalf, and what rights individuals have in relation to their data.

1. Data We Collect

We may collect and process different categories of personal data depending on how an individual interacts with our services. The data collected may include:

Identity data such as name, title, and identifiers used for account or service administration.
Contact data such as email address, billing address, delivery address, and telephone number.
Transaction data such as records of purchases, payments, service requests, and related correspondence.
Technical data such as device information, browser type, language settings, time zone, and usage logs.
Usage data such as information about how services are accessed, preferences, and interaction history.
Communication data such as messages, requests, feedback, and support-related notes.
Compliance data where required for legal, regulatory, fraud-prevention, or verification purposes.

We do not intentionally collect special category data unless it is strictly necessary and lawful to do so. Where such data is processed, additional safeguards will be applied in accordance with GDPR.

2. How We Use Personal Data

Personal data is used only for specified, explicit, and legitimate purposes. These purposes may include:

Providing and managing services and customer accounts.
Processing transactions, payments, and service-related requests.
Communicating with customers about service updates, changes, or support matters.
Maintaining records for administrative, audit, and compliance purposes.
Detecting, preventing, and investigating fraud, misuse, or security incidents.
Improving service quality, functionality, and customer experience.
Meeting legal, regulatory, tax, or accounting obligations.

We will not use personal data in a manner that is incompatible with the original purpose for which it was collected, unless another lawful basis applies.

3. Lawful Basis for Processing

Under GDPR, we must have a valid legal basis to process personal data. Depending on the activity, we may rely on one or more of the following lawful bases:

Contract — processing is necessary to enter into or perform a contract with the customer, or to take steps at the customer’s request before entering into a contract.
Legal obligation — processing is necessary to comply with legal or regulatory requirements.
Legitimate interests — processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the rights and freedoms of the individual.
Consent — where required, processing is based on freely given, specific, informed, and unambiguous consent.
Vital interests — in rare circumstances, processing may be necessary to protect someone’s life.
Public task — where applicable, processing may be necessary for tasks carried out in the public interest or under official authority.

Where consent is the lawful basis, individuals may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

4. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, tax, dispute-resolution, and reporting obligations. Retention periods may vary depending on the nature of the data and the reason for processing.

In general, retention is determined by the following factors:

Whether the data is needed to provide ongoing services.
Whether the data is required to comply with legal obligations.
Whether the data is necessary to resolve disputes or enforce agreements.
Whether a legitimate business need continues to exist.

When personal data is no longer required, it will be securely deleted, anonymized, or otherwise disposed of in a safe and appropriate manner.

5. Data Sharing and Processors

We may share personal data with trusted third parties that process data on our behalf. These parties act as processors and are only permitted to handle personal data according to our instructions and applicable law.

Processors may include:

IT and hosting providers that support system storage, security, and infrastructure.
Payment service providers that help process financial transactions.
Customer support tools used to manage enquiries and service communications.
Analytics providers that assist with service performance measurement and improvement.
Professional advisers such as legal, audit, tax, or compliance advisors where necessary.
Delivery, logistics, or administrative partners involved in service fulfilment where relevant.

Before engaging processors, we assess their ability to protect personal data and require appropriate contractual safeguards, including confidentiality obligations, security measures, and restrictions on sub-processing where applicable.

In limited cases, personal data may also be disclosed to independent controllers, such as public authorities, regulators, or law enforcement bodies, where required by law or necessary to protect rights and safety.

6. International Transfers

If personal data is transferred outside the European Economic Area or to a country that has not been granted an adequacy decision, appropriate safeguards will be implemented. These may include standard contractual clauses or other lawful transfer mechanisms permitted under GDPR. We take reasonable steps to ensure that any transferred data receives a level of protection essentially equivalent to that required within the EEA.

7. Security of Personal Data

We use appropriate technical and organisational measures to protect personal data against accidental loss, unlawful destruction, unauthorised access, alteration, or disclosure. These measures may include access controls, encryption where appropriate, secure storage, staff confidentiality obligations, and regular review of security practices.

While no system can be guaranteed completely secure, we continuously work to reduce risks and maintain a high standard of data protection.

8. User Rights Under GDPR

Individuals whose personal data we process have specific rights under GDPR. Subject to legal limitations, these rights include:

Right of access — to obtain confirmation that personal data is being processed and to receive a copy of that data.
Right to rectification — to request correction of inaccurate or incomplete personal data.
Right to erasure — to request deletion of personal data in certain circumstances.
Right to restrict processing — to request limitation of how personal data is used in certain situations.
Right to data portability — to receive personal data in a structured, commonly used, machine-readable format and to transfer it where applicable.
Right to object — to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time.
Right to lodge a complaint — to raise concerns with the competent data protection authority if the individual believes their rights have been infringed.

These rights may be subject to conditions and exemptions under applicable law.

How Rights Are Handled

When a rights request is received, we will take reasonable steps to verify identity before responding. We aim to respond within the timeframe required by GDPR. If a request is complex or numerous, we may extend the response period where permitted by law and will explain the reason for any delay.

We may not be able to comply fully with a request where retention is necessary for legal compliance, public interest, the establishment or defence of legal claims, or other lawful exceptions.

9. Children’s Data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children without appropriate authorization where required by law. If we become aware that personal data has been collected from a child in violation of this policy, we will take steps to delete or safeguard such data as appropriate.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service developments. Any revised version will apply from the date it becomes effective. We encourage customers to review this policy periodically to stay informed about how personal data is protected.

11. Scope and Applicability

This Privacy Policy applies to all customers in the area where our services are offered. By using the services, customers acknowledge that their personal data may be processed in accordance with this policy and with applicable GDPR requirements.

We are committed to ensuring that personal data is handled responsibly, transparently, and in a manner that respects individual rights.