Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area and describes the rights and choices available to individuals under applicable data protection laws, including the General Data Protection Regulation (GDPR).

1. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed when individuals use our services, interact with our business, place orders, make inquiries, or otherwise engage with us. It is intended to provide a clear explanation of what data we collect, why we collect it, the legal grounds for processing, how long we keep it, who may process it on our behalf, and what rights individuals may exercise.

For the purposes of this Policy, “personal data” means any information relating to an identified or identifiable person. This may include details that directly identify a person, as well as information that can identify them indirectly when combined with other data.

2. Data We Collect

We collect only the data necessary to operate our services, meet legal obligations, and improve the customer experience. The types of data collected may include:

• Identity data such as name, title, or similar identifiers.
• Contact data such as address, email address, or phone number.
• Transaction data such as payment status, service history, or purchase records.
• Communication data such as messages, feedback, complaint details, or correspondence.
• Technical data such as device type, browser type, IP address, and usage information.
• Profile data such as preferences, service selections, and interaction history.
• Legal or compliance data where required for identity verification, fraud prevention, or recordkeeping.

We do not intentionally collect special category data unless it is strictly necessary and permitted by law. Where special category data may be processed, we will ensure an appropriate lawful basis exists and that additional safeguards are applied.

3. How We Use Personal Data

We use personal data for legitimate business and legal purposes, including:

• providing and delivering our services;
• processing transactions and managing customer relationships;
• responding to inquiries, requests, and complaints;
• maintaining records and administrative functions;
• improving service quality, safety, and performance;
• detecting, preventing, and investigating fraud or misuse;
• complying with legal, regulatory, and tax obligations;
• protecting our rights, property, and legitimate business interests.

We will not use personal data in a way that is incompatible with the purposes described in this Policy without informing individuals and, where necessary, obtaining a valid legal basis.

4. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for each processing activity. Depending on the context, we may rely on one or more of the following lawful bases:

4.1 Contract

We process personal data where it is necessary to enter into or perform a contract with a customer, or to take steps at the customer’s request before entering into a contract.

4.2 Legal Obligation

We process personal data where required to comply with applicable laws, regulations, court orders, tax obligations, accounting rules, or lawful requests from public authorities.

4.3 Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided such interests are not overridden by the individual’s rights and freedoms. Examples include service improvement, fraud prevention, internal administration, and security monitoring.

4.4 Consent

In some cases, we rely on consent, particularly where the law requires it. Where consent is used, it will be informed, specific, freely given, and capable of being withdrawn at any time.

4.5 Vital Interests and Public Interest

In limited circumstances, processing may be necessary to protect vital interests or to carry out a task in the public interest, where applicable law permits.

5. Sharing and Processors

We may share personal data with trusted third parties that support our operations. These third parties act as processors when they handle data on our behalf and under our instructions. Typical processor categories may include:

• IT and hosting providers;
• payment and billing service providers;
• customer support and communication platforms;
• data storage and backup providers;
• analytics and performance monitoring services;
• professional advisers such as auditors, accountants, or legal advisers.

We require processors to process personal data only on documented instructions, to keep it confidential, and to apply appropriate technical and organisational security measures. Where a processor engages a sub-processor, it must do so only in compliance with applicable data protection requirements.

We may also share personal data where required by law, to respond to lawful requests, or to protect the rights, safety, or property of individuals, customers, or our business. We do not sell personal data as part of our ordinary operations.

6. International Transfers

If personal data is transferred outside the European Economic Area or to a country that does not provide an adequate level of protection, we will use appropriate safeguards as required by law. These may include standard contractual clauses, adequacy decisions, or other permitted transfer mechanisms. We take reasonable steps to ensure that personal data remains protected wherever it is processed.

7. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, reporting, and dispute resolution requirements. Retention periods depend on the type of data, the purpose of processing, and any legal obligations that apply.

In general, records related to contracts, transactions, and customer service may be retained for the duration of the relationship and for an additional period afterward to comply with legal obligations or to establish, exercise, or defend legal claims. When personal data is no longer required, we will delete it, anonymise it, or securely archive it where deletion is not immediately possible.

Retention decisions are reviewed periodically to ensure that data is not kept longer than necessary.

8. Security of Personal Data

We use appropriate technical and organisational measures to protect personal data against accidental loss, unlawful destruction, unauthorised access, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff confidentiality obligations, and monitoring of systems and processes. While no system can be guaranteed to be completely secure, we continuously work to reduce risk and strengthen our safeguards.

9. User Rights Under GDPR

Individuals whose personal data we process have rights under GDPR. Subject to legal conditions and exemptions, these rights may include:

• Right of access – to obtain confirmation about whether personal data is being processed and to receive a copy of that data.
• Right to rectification – to request correction of inaccurate or incomplete personal data.
• Right to erasure – to request deletion of personal data in certain circumstances.
• Right to restriction – to request limited use of personal data in certain cases.
• Right to data portability – to receive certain data in a structured, commonly used, machine-readable format and, where feasible, to have it transmitted to another controller.
• Right to object – to object to processing based on legitimate interests or direct marketing, including related profiling where applicable.
• Right to withdraw consent – to withdraw consent at any time where processing is based on consent.
• Right to lodge a complaint – to file a complaint with a supervisory authority if an individual believes their rights have been infringed.

We may need to verify identity before acting on a request to protect privacy and security. Requests will be handled within the timeframes required by law, unless a lawful extension applies.

10. Children’s Data

Our services are not directed to children unless expressly stated. We do not knowingly collect personal data from children without appropriate legal basis and, where required, parental or guardian consent. If we become aware that data has been collected inappropriately, we will take steps to delete it or otherwise process it in accordance with law.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, our practices, or our services. Any updated version will apply from the date it takes effect. We encourage individuals to review the Policy periodically to remain informed about how personal data is processed.

12. General Statement

This Privacy Policy is intended to be transparent and fair, and to reflect our commitment to lawful, secure, and responsible handling of personal data. It applies to all customers in the area and should be read together with any additional terms or notices that may apply to specific services or processing activities. By using our services, individuals acknowledge that their personal data may be processed as described in this Policy and in accordance with applicable law.