Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when customers use our services in the relevant area. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Scope of This Policy

This policy applies to personal data processed in connection with our products, services, customer support, administration, and related operations. It covers information provided directly by customers, information collected automatically through service use, and information received from authorized third parties. By using our services, customers acknowledge that their personal data may be processed as described in this policy.

2. Personal Data We Collect

We collect only the personal data that is necessary for specified and legitimate purposes. Depending on how services are used, we may collect the following categories of information:

Identity data such as name, title, or similar identifiers.
Contact data such as billing or delivery details and other communication-related information.
Transaction data relating to purchases, payments, invoices, refunds, and service history.
Technical data such as device type, browser settings, log data, IP address, and usage information.
Profile data such as preferences, account settings, and service interests.
Communication data such as messages, feedback, complaints, or support requests.
Legal or compliance data where necessary to meet regulatory obligations.

We do not intentionally collect special category data unless it is required, permitted by law, and supported by an appropriate lawful basis. Where such data is processed, we apply enhanced safeguards.

3. How We Use Personal Data

We use personal data for defined purposes that are necessary for running our services and meeting our legal obligations. These purposes include:

Providing and maintaining services.
Processing transactions and managing accounts.
Communicating with customers about service matters.
Handling support requests, complaints, and disputes.
Improving service quality, security, and functionality.
Preventing fraud, misuse, and unauthorized access.
Meeting accounting, audit, and legal requirements.
Sending service-related notices and updates.

We will not use personal data for purposes that are incompatible with the original reasons for collection unless we have a lawful basis to do so and, where required, we have provided appropriate notice.

4. Lawful Basis for Processing

Under the GDPR, we must have a lawful basis for each processing activity. Depending on the circumstances, we rely on one or more of the following bases:

4.1 Performance of a Contract

We process personal data when it is necessary to enter into or perform a contract with a customer. This includes account creation, service delivery, billing, and customer support.

4.2 Legal Obligation

We may process personal data where it is necessary to comply with legal or regulatory obligations, including tax, accounting, consumer protection, and recordkeeping requirements.

4.3 Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by the customer’s rights and freedoms. Legitimate interests may include service improvement, fraud prevention, network security, internal analytics, and operational administration.

4.4 Consent

In limited cases, we may rely on consent. Where consent is used, it will be freely given, specific, informed, and unambiguous. Customers may withdraw consent at any time, and withdrawal will not affect the lawfulness of processing carried out before withdrawal.

4.5 Vital Interests and Public Interest

In rare circumstances, we may process personal data to protect vital interests or where processing is necessary for a task carried out in the public interest or in the exercise of official authority.

5. Data Sharing and Processors

We may share personal data with trusted third parties that help us provide services and operate our business. Where these third parties process personal data on our behalf, they act as processors and are bound by contractual obligations to protect the data and process it only according to our instructions.

Examples of processors and service providers may include:

IT and hosting providers that store or support systems and infrastructure.
Payment service providers that process transactions securely.
Customer support tools used to manage requests and communications.
Analytics and reporting providers used to measure performance and improve services.
Security providers used to prevent fraud, abuse, and cyber threats.
Professional advisers such as accountants, auditors, or legal advisers where necessary.

We may also disclose personal data where required by law, court order, or lawful request by a public authority. If a business transfer occurs, such as a merger or restructuring, personal data may be transferred as part of that transaction subject to appropriate safeguards.

6. International Transfers

Where personal data is transferred outside the European Economic Area or the relevant jurisdiction, we will ensure that adequate protection is in place. This may include the use of approved contractual clauses, equivalent safeguards, or transfers to countries recognized as providing an adequate level of protection.

7. Retention of Personal Data

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, and reporting requirements. Retention periods vary depending on the type of data, the purpose of processing, and any applicable legal obligations.

When determining retention periods, we consider:

Whether the data is needed to provide ongoing services.
Whether there is a legal or regulatory retention requirement.
Whether the data is needed to resolve disputes or enforce agreements.
Whether retention is justified by legitimate business needs.

When personal data is no longer needed, we will delete, anonymize, or securely archive it in accordance with our retention practices and applicable law.

8. Data Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction. These measures may include access controls, encryption, secure storage, monitoring, staff confidentiality obligations, and internal policies designed to reduce risk.

Although no system can be guaranteed to be completely secure, we take reasonable steps to maintain the confidentiality and integrity of personal data and to respond appropriately to security incidents.

9. Your Rights Under GDPR

Customers in the relevant area have the following rights, subject to legal limitations and conditions:

Right of access – to obtain confirmation and a copy of personal data we hold about you.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of personal data in certain circumstances.
Right to restriction – to request limited processing in certain situations.
Right to data portability – to receive certain data in a structured, commonly used, machine-readable format and to transmit it to another controller where applicable.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right not to be subject to automated decision-making – including profiling, where such decisions produce legal or similarly significant effects, unless permitted by law.

Where processing is based on consent, you may withdraw consent at any time. Where we process data for legitimate interests, you may object and we will assess whether compelling legitimate grounds override your interests, rights, and freedoms.

10. How to Exercise Your Rights

Requests to exercise data protection rights should be made through the appropriate internal process. We may need to verify identity before responding to protect your privacy and prevent unauthorized disclosure. We will respond within the time period required by GDPR, normally within one month, subject to lawful extensions where requests are complex or numerous.

If a request is manifestly unfounded, excessive, or repetitive, we may decline to act or may charge a reasonable fee where allowed by law.

11. Children’s Data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children without appropriate authorization or legal basis. If we become aware that data has been collected inappropriately, we will take reasonable steps to delete it or obtain the required consent or authorization.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service developments. Any revised version will apply from the date it becomes effective. Customers are encouraged to review this policy periodically to remain informed about how personal data is processed.

13. Additional Principles

We follow the core GDPR principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality. We also strive to maintain accountability by documenting our processing activities and reviewing our data protection measures regularly.

In summary, we process personal data only where necessary, with a valid lawful basis, for defined purposes, and with suitable safeguards. This policy applies to all customers in the relevant area and is intended to ensure that personal data is handled responsibly, transparently, and in accordance with GDPR requirements.