Privacy Policy

This Privacy Policy explains how we collect, use, store, share, and protect personal data when providing our services to all customers in the area. It applies to every individual who uses, purchases, accesses, or otherwise interacts with our services in the area, whether online or offline. We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with the General Data Protection Regulation (GDPR).

1. Scope of This Policy

This policy applies to personal data processed in connection with our products, services, communications, operations, and customer support activities. It covers data collected directly from customers, data provided by third parties where permitted by law, and data obtained automatically through standard service usage. This policy applies to all customers in the area, regardless of the type of service used or the channel through which the service is accessed.

2. Personal Data We Collect

We may collect different categories of personal data depending on how you interact with us. The data collected may include:

Identity data: name, title, and similar identifiers.
Contact data: email address, telephone number, billing address, delivery address, or other communication details.
Transaction data: records of purchases, payments, service requests, and related correspondence.
Technical data: device information, browser type, IP address, operating system, and usage logs.
Profile data: preferences, feedback, service history, and customer account details.
Communication data: messages, inquiries, complaints, and other interactions with our teams.
Marketing data: consent preferences, communication choices, and responses to promotional materials.

We generally collect personal data directly from you when you provide it to us, but we may also receive information from service providers, payment partners, or other lawful sources where necessary.

3. How We Use Personal Data

We use personal data only for specified, explicit, and legitimate purposes. These include:

providing and managing our services;
processing payments and fulfilling transactions;
communicating service updates, notices, and administrative information;
responding to questions, complaints, and requests;
maintaining security, preventing fraud, and detecting misuse;
improving service quality, performance, and customer experience;
meeting legal, regulatory, and tax obligations;
carrying out internal reporting and business administration;
sending marketing communications where permitted by law and where appropriate consent or other lawful basis applies.

We will not use personal data in a way that is incompatible with the purposes described in this policy unless we are required or permitted to do so by law.

4. Lawful Basis for Processing

We process personal data under one or more lawful bases permitted by GDPR. Depending on the context, these may include:

4.1 Performance of a Contract

We process personal data where it is necessary to enter into or perform a contract with you, such as providing services, managing accounts, or completing payments.

4.2 Legal Obligation

We may process personal data where necessary to comply with legal obligations, including accounting, taxation, consumer protection, anti-fraud, or regulatory requirements.

4.3 Legitimate Interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. Examples may include service improvement, security monitoring, fraud prevention, and business administration.

4.4 Consent

Where required by law, we rely on your consent, for example for certain marketing communications or optional data processing activities. You may withdraw consent at any time, and such withdrawal will not affect the lawfulness of processing carried out before withdrawal.

4.5 Vital Interests and Public Interest

In rare cases, we may process personal data to protect vital interests or where processing is necessary for tasks carried out in the public interest or in the exercise of official authority, where applicable.

5. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting, regulatory, or reporting requirements. Retention periods depend on the type of data, the nature of our relationship with you, and applicable legal obligations.

When personal data is no longer required, we will delete it, anonymise it, or securely archive it in accordance with our retention procedures. In some cases, we may retain data longer if needed for the establishment, exercise, or defence of legal claims, or where required by law.

Retention is determined using proportionality and necessity principles.

6. Sharing and Processors

We may share personal data with trusted third parties that process information on our behalf or independently for lawful purposes. These parties may include:

IT and hosting providers that support infrastructure, storage, and technical operations;
payment processors that handle transactions and fraud screening;
customer support providers that assist with service inquiries;
analytics and security providers that help improve performance and protect systems;
professional advisers such as legal, audit, or accounting professionals;
public authorities where disclosure is required by law or lawful request.

Where a third party acts as a processor, we require them to process personal data only on our documented instructions, keep it confidential, implement appropriate technical and organisational measures, and assist us in meeting GDPR obligations. If a third party acts as an independent controller, their own privacy terms and legal obligations will apply.

7. International Transfers

If personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, such as standard contractual clauses or other legally approved transfer mechanisms. We take reasonable steps to ensure that any international transfer offers a level of protection consistent with GDPR requirements.

8. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption, backup procedures, role-based permissions, and staff confidentiality obligations. While no system can be guaranteed completely secure, we regularly review our controls to improve resilience and reduce risk.

9. Your Rights Under GDPR

Subject to applicable legal conditions, you have the following rights regarding your personal data:

Right of access: to obtain confirmation and a copy of your personal data.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of data in certain circumstances.
Right to restriction: to request limited processing in specific situations.
Right to data portability: to receive your data in a structured, commonly used, machine-readable format where applicable.
Right to object: to object to processing based on legitimate interests or to direct marketing.
Right to withdraw consent: where processing is based on consent.
Right not to be subject to automated decision-making: including profiling, where such decisions produce legal or similarly significant effects, unless permitted by law.

To exercise your rights, you may make a request through the appropriate service channel used by customers in the area. We may need to verify your identity before responding. We will respond within the time limits required by GDPR, typically within one month, subject to lawful extensions where necessary.

10. Complaints and Supervisory Authority

If you believe your personal data has been processed unlawfully, you have the right to lodge a complaint with a competent data protection supervisory authority. We encourage you to raise concerns through the normal service process first so that we can try to resolve the issue promptly and fairly.

11. Children’s Data

Our services are not intended for children unless explicitly stated otherwise. We do not knowingly collect personal data from children without appropriate authorisation where required by law. If we become aware that children’s data has been collected unlawfully, we will take appropriate steps to delete or protect that information.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, technical, operational, or business changes. Any revised version will apply from the date it is published or otherwise communicated, as appropriate. We encourage customers in the area to review this policy periodically to remain informed about how personal data is handled.

13. General Statement

We are committed to respecting privacy rights and handling personal data responsibly. Our approach is based on transparency, data minimisation, purpose limitation, storage limitation, accuracy, integrity, and confidentiality. We only process personal data where we have a lawful reason to do so and only for as long as necessary for the purposes described in this policy.

This Privacy Policy applies to all customers in the area and governs the processing of personal data in connection with our services. By using our services, you acknowledge that personal data may be processed as described above, subject always to applicable law.