Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when services are provided to customers in the area. It applies to all customers in the area and is intended to provide clear information in line with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

By using our services, customers acknowledge that their personal data may be processed as described in this Policy. We are committed to processing personal data fairly, lawfully, transparently, and securely, and only for specified purposes.

1. Data We Collect

We may collect and process the following categories of personal data, depending on how a customer interacts with us:

Identity data such as name, title, and similar identifiers.
Contact data such as address, email address, and telephone number.
Transaction data such as payment records, order details, and service history.
Technical data such as device information, browser type, IP address, and log data.
Usage data such as how services are accessed and used.
Communication data such as correspondence and feedback.
Preference data such as settings, selections, and service preferences.

We do not intentionally collect special category data unless it is necessary and lawful to do so. Where such data is processed, we will apply appropriate safeguards and rely on a valid legal basis under GDPR.

2. How We Use Personal Data

Personal data is used only where necessary for defined purposes. These include:

providing and managing services;
processing transactions and maintaining records;
communicating with customers about services, updates, or changes;
improving service quality, performance, and customer experience;
meeting legal, regulatory, tax, and accounting obligations;
preventing fraud, misuse, or security incidents;
handling requests, complaints, and support matters.

We will not use personal data for purposes that are incompatible with the original collection purpose unless we have a lawful basis to do so.

3. Lawful Basis for Processing

Under GDPR, we process personal data only when we have a valid lawful basis. Depending on the activity, the lawful basis may be one or more of the following:

Performance of a contract – where processing is necessary to provide services or take steps requested before entering into a contract.
Legal obligation – where processing is required to comply with applicable laws and regulations.
Legitimate interests – where processing is necessary for our legitimate business interests, provided those interests are not overridden by the rights and freedoms of the individual.
Consent – where the individual has given clear and informed consent for a specific purpose. Consent may be withdrawn at any time.
Vital interests – in rare situations where processing is necessary to protect someone’s life.
Public task – where processing is necessary for a task carried out in the public interest, if applicable.

Where we rely on legitimate interests, we consider the nature of the data, the purpose of the processing, and the impact on the individual’s rights.

4. Sharing and Processors

We may share personal data with trusted third parties that act as processors on our behalf. These processors only handle personal data according to our instructions and are required to keep it secure and confidential.

Examples of processor categories may include:

IT and hosting providers;
payment service providers;
customer support systems;
analytics and service monitoring providers;
document storage and backup providers;
professional advisers who support operational, legal, or accounting functions.

We may also disclose personal data where required by law, by a court order, or to protect our rights, customers, staff, or the public. If personal data is transferred outside the European Economic Area, appropriate safeguards will be applied to ensure a level of protection consistent with GDPR.

5. Data Retention

We keep personal data only for as long as necessary for the purpose for which it was collected, or for as long as required by law. Retention periods depend on the type of data, the purpose of processing, and any legal or regulatory requirements.

In general, retention is determined by the following principles:

data used to provide services is kept for the duration of the relationship and a reasonable period afterward;
financial and tax records are retained for the period required by law;
support and communication records are retained for as long as needed to resolve issues or maintain accurate records;
technical logs are retained for security, monitoring, and diagnostic purposes for limited periods;
data subject to consent will be deleted or anonymised when consent is withdrawn, unless another lawful basis applies.

When personal data is no longer required, it will be securely deleted, anonymised, or otherwise rendered unusable.

6. Security of Personal Data

We implement appropriate technical and organisational measures to protect personal data against accidental loss, destruction, unauthorised access, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff training, and regular review of security practices.

Security is a shared responsibility, and we expect processors and other third parties acting on our behalf to maintain suitable protections as well.

7. User Rights Under GDPR

Individuals whose personal data is processed have rights under GDPR. Subject to legal limitations, customers in the area may exercise the following rights:

Right of access – to obtain confirmation of whether personal data is being processed and to receive a copy of that data.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of personal data in certain circumstances, also known as the right to be forgotten.
Right to restriction – to request limited processing in certain situations.
Right to data portability – to receive certain data in a structured, commonly used, machine-readable format and to transmit it to another controller where feasible.
Right to object – to object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent – to withdraw consent at any time where processing is based on consent.
Right not to be subject to solely automated decisions – to avoid decisions based solely on automated processing that produce legal or similarly significant effects, where applicable.

Requests will be handled in accordance with applicable law. We may need to verify identity before responding to a request.

How Rights May Be Limited

In some cases, a request may be declined or limited where the law permits, for example if fulfilling it would affect another person’s rights, conflict with legal obligations, or involve data that must be retained for compliance reasons.

8. Children’s Data

Our services are not intended for children unless expressly stated otherwise. If we learn that personal data of a child has been collected without appropriate authority or legal basis, we will take steps to delete it or obtain necessary permissions where permitted by law.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, operational practices, or data processing activities. When updates are made, the revised policy will apply from the date it becomes effective. Customers are encouraged to review this Policy periodically to stay informed about how personal data is protected.

Summary of commitment: We process personal data lawfully, transparently, and securely; limit collection to what is necessary; use trusted processors; retain data only as long as required; and respect the rights of all customers in the area.