Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and applicable local data protection laws. By using our services, customers acknowledge that their personal data may be processed as described below.

1. Who We Are

For the purposes of data protection law, we act as the data controller for personal data collected through our services, unless otherwise stated. This means we determine the purposes and means of processing personal data. In some cases, we may also act as a data processor where we process data on behalf of another controller and in accordance with their instructions.

2. Personal Data We Collect

We collect only the personal data necessary for the purposes described in this policy. Depending on the way customers interact with our services, we may collect the following categories of data:

Identity data such as name, title, and relevant account identifiers;
Contact data such as address, email address, and telephone number;
Transaction data such as purchase or service history, payment status, and related records;
Technical data such as IP address, device information, browser type, operating system, and usage logs;
Profile data such as preferences, feedback, service settings, and communication choices;
Communication data such as enquiries, support requests, complaints, and correspondence;
Usage data such as interactions with our services, pages viewed, and time spent using features.

We do not intentionally collect special category personal data unless it is necessary and lawful to do so. Where special category data is processed, we will apply appropriate safeguards and rely on a valid legal condition under GDPR.

3. How We Collect Data

We may collect personal data directly from customers when they register, purchase, contact us, or otherwise interact with our services. We may also collect data automatically through technical systems when customers use digital services. In certain cases, we may receive personal data from third parties such as business partners, service providers, or publicly available sources, where permitted by law.

4. Purposes of Processing

We use personal data only for specified, explicit, and legitimate purposes. These include:

providing and managing our services;
verifying identity and maintaining account records;
processing transactions and fulfilling requests;
communicating service updates, notices, and administrative messages;
responding to enquiries, complaints, and support requests;
improving service quality, security, and functionality;
preventing fraud, misuse, and other unlawful activity;
complying with legal obligations and regulatory requirements;
maintaining internal records and business administration.

Where required, we will seek additional consent before using personal data for any purpose not compatible with the original collection purpose.

5. Lawful Basis for Processing

We process personal data only where a lawful basis under GDPR applies. Depending on the context, our lawful bases may include the following:

Contract

We process data where it is necessary to perform a contract with a customer or to take steps at the customer’s request before entering into a contract. This includes managing accounts, delivering services, and handling payments.

Legal Obligation

We may process data where necessary to comply with legal and regulatory obligations, such as accounting, tax, anti-fraud, or recordkeeping requirements.

Legitimate Interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the customer’s rights and freedoms. Examples include improving services, maintaining security, detecting misuse, and managing internal administration. Where we rely on legitimate interests, we assess the impact on individuals and apply safeguards.

Consent

In certain situations, we may rely on consent, for example where required for specific optional communications or certain processing activities. Where consent is used as the lawful basis, customers have the right to withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

6. Sharing and Processors

We may share personal data with carefully selected third parties where necessary for the purposes described in this policy. These parties may act as processors or independent controllers, depending on the nature of the relationship.

Our processors may include:

IT and hosting providers;
payment and transaction service providers;
customer support and communication tools;
data storage and backup providers;
analytics and security service providers;
professional advisers and administrative service providers.

Where a third party acts as a processor, they process personal data only on our documented instructions and are bound by contractual obligations to protect data, maintain confidentiality, and implement appropriate technical and organizational measures. We do not permit processors to use personal data for their own purposes.

We may also disclose data if required by law, court order, or competent authority, or where necessary to establish, exercise, or defend legal claims.

7. International Transfers

If personal data is transferred outside the European Economic Area or to a country that does not provide an adequate level of protection, we will ensure appropriate safeguards are in place. These safeguards may include standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms permitted under GDPR. We will take steps to ensure that transferred data remains protected to a standard consistent with this policy.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, tax, and reporting obligations. Retention periods are determined based on several factors:

the nature of the data and the purpose of processing;
contractual and business requirements;
legal obligations and limitation periods;
security, audit, and dispute resolution needs.

When personal data is no longer required, we will delete, anonymize, or securely archive it in accordance with our retention procedures. In some cases, data may be retained for a longer period if necessary to comply with legal obligations or to resolve disputes.

9. Data Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption where appropriate, secure storage, staff confidentiality obligations, and regular review of security practices. While no system can be guaranteed to be completely secure, we take reasonable steps to reduce risks and protect personal data.

10. User Rights

Customers whose personal data is processed under GDPR have several important rights. Subject to legal limitations, these rights include:

Right of access – to request confirmation of whether we process personal data and to obtain a copy of it;
Right to rectification – to request correction of inaccurate or incomplete data;
Right to erasure – to request deletion of personal data in certain circumstances;
Right to restriction – to request limited processing in certain cases;
Right to data portability – to receive certain data in a structured, commonly used, machine-readable format and to transmit it elsewhere where technically feasible;
Right to object – to object to processing based on legitimate interests or direct marketing;
Right to withdraw consent – where processing is based on consent;
Right to lodge a complaint – with a supervisory authority if a customer believes their rights have been infringed.

Where a request is made, we may need to verify identity before responding. We will respond within the time limits required by law and may refuse or limit requests where permitted under GDPR, for example where the request would adversely affect the rights of others or where we are legally required to retain the data.

11. Children’s Data

Our services are not intended for children unless clearly stated otherwise. We do not knowingly collect personal data from children in circumstances where such collection is not lawful. If we become aware that personal data has been collected from a child without appropriate authorization or legal basis, we will take steps to delete it as soon as reasonably possible.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation, operational practices, or service developments. Any revised version will apply from the date it is published or otherwise communicated. Customers are encouraged to review this policy periodically to remain informed about how their personal data is handled.

13. Final Statement

This Privacy Policy applies to all customers in the area and sets out the principles under which personal data is collected, used, retained, and shared. We are committed to processing personal data lawfully, fairly, and transparently, and to respecting the rights of individuals under GDPR. If a provision of this policy conflicts with mandatory law, the law will prevail to the extent required.