Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when individuals use our services. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR). By using our services, you acknowledge that your personal data may be processed in accordance with this Policy and applicable law.

1. Data We Collect

We collect only the personal data necessary for legitimate business purposes and legal compliance. Depending on how you interact with us, the categories of data may include:

Identity data: name, surname, username, or similar identifier.
Contact data: postal address, email address, and telephone number.
Transaction data: details relating to purchases, payments, invoices, and service history.
Technical data: IP address, device type, browser type, operating system, and system logs.
Usage data: information about how services are used, preferences, and interaction records.
Communication data: records of correspondence, requests, complaints, and support interactions.
Verification data: information collected to confirm identity where required by law.

We do not intentionally collect special category data unless there is a specific lawful reason to do so and appropriate safeguards are in place. Where such processing is required, it will only occur in compliance with GDPR requirements.

2. How We Use Personal Data

Personal data is used for lawful and clearly defined purposes, including:

providing services and fulfilling requests;
processing transactions and managing accounts;
communicating with customers about service updates and support matters;
maintaining security, preventing fraud, and ensuring the integrity of systems;
meeting legal, accounting, tax, and regulatory obligations;
improving service quality, performance, and customer experience;
handling complaints, disputes, and enforcement activities.

We use a data minimisation approach, meaning we collect and process only what is necessary for the specific purpose. Where feasible, information is pseudonymised, aggregated, or otherwise limited to reduce privacy risks.

3. Lawful Basis for Processing

Under GDPR, we process personal data only where we have a valid lawful basis. Depending on the context, the lawful bases may include the following:

Contract: processing is necessary to perform a contract with you or to take steps before entering into a contract.
Legal obligation: processing is required to comply with a legal or regulatory duty.
Legitimate interests: processing is necessary for our legitimate interests or those of a third party, provided that your interests and fundamental rights do not override those interests.
Consent: processing takes place where you have given clear and informed consent. You may withdraw consent at any time, where applicable.
Vital interests: processing may occur to protect someone’s life or physical safety in exceptional circumstances.

When relying on legitimate interests, we assess the impact on individuals and apply appropriate safeguards. Where consent is the lawful basis, it is obtained in a clear and affirmative manner and is not bundled with unrelated processing.

4. Sharing and Processors

We may share personal data with trusted third-party service providers who act as processors on our behalf. These processors are engaged only where necessary and are required to process data under written agreements and strict instructions. They may assist with functions such as:

payment processing and fraud prevention;
IT hosting, cloud storage, and system maintenance;
customer support and communications management;
analytics, reporting, and service optimisation;
legal, compliance, auditing, or professional advisory services;
delivery or fulfilment services where relevant.

Processors are required to implement appropriate technical and organisational measures to protect personal data. They are not permitted to use your data for their own purposes unless they are separately acting as an independent controller and have a lawful basis to do so.

We may also disclose data where necessary to comply with a legal obligation, enforce our rights, protect against fraud, or respond to lawful requests from public authorities. If personal data is transferred outside the European Economic Area, appropriate safeguards will be used in accordance with GDPR, such as adequacy decisions, standard contractual clauses, or equivalent legal mechanisms.

5. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, tax, and reporting obligations. Retention periods are determined by considering the nature of the data, the purpose of processing, legal requirements, and the risk of harm from continued storage.

Typical retention principles include the following:

Contractual records are retained for the duration of the contract and for a further period as required for legal claims or regulatory compliance.
Financial and tax records are retained for the period required by applicable laws.
Customer service communications are retained only as long as needed to resolve issues, maintain records, or demonstrate compliance.
Technical logs are retained for security and operational purposes for a limited period.

When personal data is no longer required, it is deleted, anonymised, or securely archived so that it is no longer used for active processing. Retention periods may vary depending on legal obligations and the type of information involved.

6. Data Security

We apply appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, unlawful processing, alteration, or disclosure. These safeguards may include access controls, encryption, secure storage, staff confidentiality obligations, and ongoing security monitoring.

Although no system can be guaranteed to be completely secure, we regularly review our security measures and work to maintain a level of protection proportionate to the risks associated with processing.

7. Your Rights Under GDPR

Subject to applicable law, you have a number of rights in relation to your personal data. These rights may include:

Right of access: to obtain confirmation that your data is being processed and to receive a copy of it.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of your data in certain circumstances.
Right to restrict processing: to request limited use of your data in specific situations.
Right to data portability: to receive your data in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
Right not to be subject to solely automated decisions: to request human review where legally applicable.

We may need to verify your identity before responding to a request in order to protect your data. Requests will be handled within the time limits set by GDPR, unless an extension is permitted by law. In some cases, rights may be limited where necessary to comply with legal obligations or protect the rights of others.

8. Complaints and Supervisory Authority

If you believe that your personal data has been processed unlawfully or that your rights have not been respected, you may lodge a complaint with the relevant data protection supervisory authority. We encourage individuals to raise concerns so that issues can be reviewed and addressed promptly.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or data processing activities. Any revised version will apply from the date it takes effect. We recommend reviewing this Policy periodically to stay informed about how personal data is handled.

10. Summary of Key Principles

Transparency, lawfulness, data minimisation, purpose limitation, accuracy, storage limitation, integrity, and confidentiality guide our approach to privacy. We aim to process personal data fairly and responsibly, ensuring that the rights of individuals are respected at every stage.

This Privacy Policy applies to all customers in the area and is intended to be read together with any additional notices that may apply to specific services or processing activities.