Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected in connection with our services. It applies to all customers in the area where our services are offered, and it is intended to comply with the General Data Protection Regulation (GDPR) and applicable local privacy laws. By using our services, customers acknowledge that their personal data may be processed as described in this Policy.

1. Scope of This Policy

This Policy applies to personal data relating to identifiable individuals who use, inquire about, purchase, or otherwise interact with our services. It covers data collected through direct interactions, automated technologies, service-related communications, and third parties acting on our behalf. It does not apply to anonymized data that cannot reasonably be used to identify an individual.

For the avoidance of doubt, this Policy applies to all customers in the area served by our organization, including individuals acting in a personal capacity and those acting on behalf of a business or other entity where personal data is processed.

2. Data We Collect

We may collect the following categories of personal data:

Identity data: such as name, username, and similar identifiers.
Contact data: such as address, email address, telephone number, and preferred communication language.
Transaction data: such as service requests, order details, payment records, billing history, and delivery or service fulfillment information.
Technical data: such as IP address, device type, browser type, operating system, log data, and usage information.
Communication data: such as messages, feedback, complaints, support requests, and records of correspondence.
Preference data: such as service preferences, marketing choices, and other settings selected by the individual.

We generally collect data directly from the individual concerned. We may also receive data from service providers, payment providers, public sources, business partners, or other parties where lawful and appropriate.

3. How We Use Personal Data

We process personal data only for specified, explicit, and legitimate purposes. These may include:

providing and managing services;
processing transactions and fulfilling requests;
communicating with customers about service matters;
handling customer support and complaints;
maintaining records, security, and operational integrity;
detecting, preventing, and investigating fraud or misuse;
meeting legal, tax, accounting, and regulatory obligations;
improving services, systems, and customer experience;
sending marketing communications where permitted by law and where consent or another lawful basis applies.

We do not use personal data in ways that are incompatible with these purposes unless we have a valid legal basis to do so.

4. Lawful Basis for Processing

Under the GDPR, we rely on one or more of the following lawful bases when processing personal data:

4.1 Contract

We process personal data where it is necessary to enter into or perform a contract with the customer, or to take steps at the individual’s request before entering into a contract. This includes providing services, processing orders, managing accounts, and responding to service-related requests.

4.2 Legal Obligation

We may process personal data to comply with legal requirements, including tax, accounting, consumer protection, recordkeeping, and other obligations imposed by law.

4.3 Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided that those interests are not overridden by the individual’s rights and freedoms. Legitimate interests may include maintaining security, preventing fraud, improving services, and managing internal operations.

4.4 Consent

In some cases, we rely on consent, for example for certain marketing activities or where required by law. Where consent is used as the legal basis, individuals may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

4.5 Vital Interests and Public Interest

In limited circumstances, we may process personal data where necessary to protect vital interests or where processing is carried out in the public interest or in the exercise of official authority, as permitted by applicable law.

5. Data Sharing and Processors

We may share personal data with trusted third parties where necessary for the purposes described in this Policy. Such parties may act as processors or, in some cases, as independent controllers. When we use processors, they act only on our documented instructions and are bound by contractual obligations to protect personal data.

Typical categories of processors may include:

IT and hosting providers that support infrastructure, storage, and system maintenance;
payment service providers that handle payment processing and related verification;
customer support providers that assist with communications and service management;
analytics providers that help us understand service performance and usage patterns;
professional advisers such as auditors, insurers, or legal advisers where necessary;
compliance and security providers that help with monitoring, authentication, and fraud prevention.

We may also disclose personal data where required by law, court order, regulatory request, or to protect the rights, property, or safety of our organization, our customers, or others.

6. International Transfers

If personal data is transferred outside the European Economic Area or another jurisdiction with equivalent protections, we ensure appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms recognized by the GDPR. Where required, we assess the risks of transfer and apply additional measures to protect personal data.

7. Retention of Personal Data

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the duration of any contractual relationship and for a reasonable period thereafter. Retention periods are determined by the nature of the data, the purpose of processing, legal and regulatory obligations, limitation periods, and the need to resolve disputes or enforce agreements.

In general:

service and transaction records are retained for the period required to manage the relationship and meet legal obligations;
support communications are kept for as long as needed to resolve issues and maintain records;
technical logs are retained for security, troubleshooting, and audit purposes for limited periods;
marketing data is retained until consent is withdrawn or the individual opts out, where applicable.

When data is no longer required, it is securely deleted, anonymized, or otherwise rendered inaccessible in accordance with our retention procedures.

8. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption where appropriate, least-privilege permissions, staff training, monitoring, and regular review of security practices.

While no system can be guaranteed to be fully secure, we take reasonable steps to reduce risks and respond promptly to suspected incidents. If a personal data breach occurs, we will assess the situation and, where required by law, notify the relevant authority and affected individuals.

9. User Rights Under GDPR

Individuals whose personal data is processed under this Policy have the following rights, subject to applicable legal conditions and exceptions:

Right of access: to obtain confirmation of whether personal data is being processed and to receive a copy of that data.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request limited processing in certain cases.
Right to data portability: to receive certain data in a structured, commonly used format and, where feasible, have it transmitted to another controller.
Right to object: to object to processing based on legitimate interests or to direct marketing at any time.
Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time.
Right to lodge a complaint: to raise concerns with the relevant data protection authority.

We will respond to valid requests in accordance with GDPR timelines and requirements. We may need to verify identity before fulfilling a request to protect against unauthorized disclosure.

10. Marketing Communications

Where permitted, we may send information about services, offers, or updates. Individuals may opt out of marketing communications at any time, and we will honor such preferences in accordance with applicable law. Marketing preferences do not affect essential service communications that are necessary for account, transaction, or legal purposes.

11. Automated Decision-Making

We do not carry out decisions based solely on automated processing that produce legal or similarly significant effects unless explicitly permitted by law and subject to appropriate safeguards. If such processing is introduced, individuals will be informed about its logic, significance, and consequences, as required by the GDPR.

12. Children’s Data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children without appropriate authorization or legal basis. If we become aware that personal data has been collected unlawfully from a child, we will take appropriate steps to delete or protect it as required.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, our services, or our data processing practices. Any updated version will apply from the date it becomes effective. Individuals are encouraged to review this Policy periodically to stay informed about how personal data is protected.

By continuing to use our services, customers in the area acknowledge that they have read and understood this Privacy Policy and how their personal data may be processed.