Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area and is intended to comply with the requirements of the General Data Protection Regulation (GDPR) and applicable local data protection laws. By using our services, you acknowledge that your personal data may be processed as described in this policy.

1. Data We Collect

We collect and process only the personal data that is necessary for the purposes described in this Privacy Policy. Depending on how you interact with us, the categories of data may include:

Identity data: name, title, and similar identifiers.
Contact data: address, email address, telephone number, and other communication details.
Transaction data: details about purchases, payments, invoices, and service history.
Technical data: IP address, device information, browser type, operating system, and usage logs.
Profile data: preferences, service settings, and feedback.
Communications data: records of messages, enquiries, complaints, and support interactions.

We do not intentionally collect special category data unless it is required by law or you choose to provide it in a lawful and necessary context. If such data is collected, it will be processed only where a valid legal condition under the GDPR applies.

2. How We Use Personal Data

We use personal data for legitimate business and operational purposes, including to:

provide, manage, and improve our services;
process transactions and deliver requested products or services;
communicate with customers about accounts, requests, and service updates;
handle complaints, support enquiries, and customer care matters;
maintain records, monitor service quality, and prevent fraud;
comply with legal, regulatory, and tax obligations;
protect our rights, property, and security, as well as those of our customers and third parties.

We will only use personal data in ways that are fair, lawful, and transparent. Where the purpose changes, we will assess whether the new processing is compatible with the original purpose or whether additional notice or consent is required.

3. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for each processing activity. Depending on the context, we may rely on one or more of the following lawful bases:

a. Contract

We process personal data where it is necessary to perform a contract with you or to take steps at your request before entering into a contract. This includes delivering services, managing payments, and fulfilling customer requests.

b. Legal Obligation

We process personal data where required to comply with legal obligations, such as accounting, tax, regulatory, or record-keeping requirements.

c. Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Examples include service improvement, fraud prevention, internal administration, and security monitoring.

d. Consent

In limited cases, we may rely on your consent, for example when certain optional processing activities require explicit permission. Where consent is used, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Data Sharing and Processors

We may share personal data with trusted third parties where necessary to operate our services, meet legal obligations, or support legitimate business functions. When we engage third parties to process personal data on our behalf, they act as processors and are bound by contractual obligations to process the data only on our instructions and to protect it appropriately.

Processors may include:

information technology and hosting providers;
payment service providers;
customer support and communication tools;
analytics and security service providers;
professional advisers, auditors, and compliance service providers.

We may also disclose personal data to authorities, courts, or other third parties where required by law or where such disclosure is necessary to protect legal rights or prevent harm. Where data is transferred outside the European Economic Area, appropriate safeguards will be used to ensure an adequate level of protection in accordance with GDPR requirements.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting obligations. Retention periods may vary depending on the type of data, the purpose of processing, and any legal requirement to keep records for a specific period.

When deciding how long to keep data, we consider:

the nature and sensitivity of the data;
the risk of harm from unauthorised use or disclosure;
the purposes for which we process the data;
whether we can achieve those purposes by other means;
legal and regulatory requirements applicable in the area.

Once personal data is no longer needed, it will be securely deleted, anonymised, or archived in accordance with applicable retention procedures. Retention does not mean indefinite storage, and we review records periodically to ensure they are not kept longer than necessary.

6. Security of Personal Data

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, secure storage, encryption, staff training, and monitoring of systems and processes.

Although we take reasonable steps to safeguard data, no system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will handle it in accordance with GDPR breach notification obligations.

7. Your Rights Under GDPR

If you are a customer in the area, you have certain rights in relation to your personal data under GDPR. These rights may be subject to legal limits and exemptions. They include:

Right of access: you may request confirmation of whether we process your data and obtain a copy of it.
Right to rectification: you may ask us to correct inaccurate or incomplete data.
Right to erasure: you may request deletion of your data in certain circumstances, such as when it is no longer necessary for the original purpose.
Right to restriction: you may ask us to restrict processing in specific situations.
Right to data portability: you may request your data in a structured, commonly used, machine-readable format where applicable.
Right to object: you may object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
Right to lodge a complaint: you may raise concerns with the competent data protection supervisory authority.

We will respond to rights requests within the time limits required by GDPR and may need to verify your identity before acting on your request.

8. Automated Decision-Making

We do not use personal data for decisions based solely on automated processing that produce legal or similarly significant effects, unless such processing is permitted by law and appropriate safeguards are in place. If this position changes, we will provide meaningful information about the logic involved and the consequences of the processing, as required by law.

9. Children’s Data

Our services are not intended for children unless clearly stated otherwise. We do not knowingly collect personal data from children without appropriate authorisation and lawful basis. Where we become aware that data has been collected inappropriately, we will take steps to delete it or obtain the required consent where permitted by law.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or operational needs. Any updated version will apply from the date it is made effective. We encourage customers to review this policy periodically to remain informed about how personal data is handled.

11. Application Across the Area

This Privacy Policy applies to all customers in the area, regardless of how they access our services or which channel they use to engage with us. All processing described here is carried out in accordance with the principles of data minimisation, purpose limitation, storage limitation, integrity, confidentiality, and accountability.

We are committed to processing personal data responsibly and transparently, and to respecting the rights of individuals under GDPR. If any part of this policy is found to conflict with mandatory legal requirements, the relevant law will prevail while the remainder of the policy stays in effect.