Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using our services, you acknowledge that your personal data may be processed as described in this Policy.

1. Data We Collect

We collect only the personal data necessary to provide and improve our services, manage our relationship with customers, and comply with legal obligations. The types of data we may collect include:

Identity data such as name, title, and similar identifiers.
Contact data such as address, email address, and telephone number.
Account and transaction data such as service details, payment records, billing information, and order history.
Communication data such as messages, inquiries, feedback, complaints, and correspondence.
Technical data such as IP address, device information, browser type, and usage logs where applicable.
Preference data such as service preferences and marketing choices.

We do not intentionally collect special category personal data unless it is strictly necessary and permitted by law. If such data is ever processed, it will be handled with additional safeguards and only where a valid legal basis applies.

2. How We Use Personal Data

Personal data is used for legitimate operational and legal purposes, including:

providing and managing services;
processing requests, orders, payments, or transactions;
communicating with customers about service matters;
improving service quality and customer experience;
maintaining records and internal administration;
preventing fraud, misuse, or security incidents;
complying with legal, tax, accounting, and regulatory obligations.

We use personal data in a manner that is fair, transparent, and limited to what is necessary for the specific purpose for which it was collected.

3. Lawful Basis for Processing

Under GDPR, we process personal data only where we have a lawful basis. Depending on the circumstances, one or more of the following bases may apply:

Performance of a Contract

We process personal data when it is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract. This includes managing customer accounts, delivering services, and handling billing.

Legal Obligation

We may process personal data where required to comply with legal or regulatory duties, including recordkeeping, tax compliance, and responses to lawful requests from authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Examples include improving services, protecting systems, preventing fraud, and managing internal operations.

Consent

Where required by law, we will rely on your consent. When consent is used as the legal basis, it will be freely given, specific, informed, and unambiguous. You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Vital Interests and Public Interest

In limited cases, we may process data to protect vital interests or where processing is necessary for tasks carried out in the public interest, as permitted by law. These bases are expected to apply only rarely.

4. Sharing and Processors

We may share personal data with trusted third parties who act as processors on our behalf. Processors only process personal data under our instructions and are required to protect it appropriately. Typical processors may include:

IT and hosting providers that store or support systems and infrastructure;
payment service providers that process payments securely;
administrative or communication providers that help manage customer correspondence;
professional advisers such as auditors, accountants, or legal advisers where necessary;
security and fraud prevention providers that help detect and prevent misuse;
service delivery partners where needed to fulfil contractual obligations.

We require processors to implement appropriate technical and organizational measures, maintain confidentiality, and process personal data only for agreed purposes. Where personal data is transferred outside the European Economic Area, we will ensure suitable safeguards are in place, such as standard contractual clauses or other lawful transfer mechanisms.

We may also disclose personal data where required to comply with law, enforce our rights, protect the safety of individuals, or respond to valid legal process.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for legal, accounting, or reporting requirements. Retention periods may vary depending on the type of data and the reason for processing.

Data related to active customer relationships is typically retained for the duration of the relationship.
Billing, financial, and tax records may be retained for longer periods where required by law.
Enquiry and communication records may be kept for a reasonable period to support customer service and dispute handling.
When data is no longer needed, it will be securely deleted, anonymized, or archived in accordance with our retention practices.

Where retention is based on legal requirements, we will retain the data for the period mandated by applicable law. If we rely on legitimate interests or consent, we will review the necessity of continued retention periodically.

6. Security of Personal Data

We take appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. These measures may include access controls, encryption, secure storage, staff confidentiality obligations, and regular security reviews. While no system can be guaranteed to be completely secure, we work to maintain a level of protection appropriate to the risks involved.

7. Your Rights Under GDPR

You have a number of rights in relation to your personal data. Subject to legal limitations, these rights include:

Right of access – to request confirmation of whether we process your personal data and to obtain a copy.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of personal data in certain circumstances.
Right to restriction – to request that processing be limited in certain cases.
Right to data portability – to receive certain data in a structured, commonly used, machine-readable format.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

You also have the right to not be subject to a decision based solely on automated processing, including profiling, where such a decision produces legal or similarly significant effects, unless permitted by law.

To exercise your rights, you may make a request using the procedures made available to customers. We may need to verify your identity before responding. We aim to respond within the time limits required by GDPR, generally within one month, subject to lawful extensions where requests are complex or numerous.

8. Children’s Data

Our services are not directed to children unless expressly stated otherwise. We do not knowingly collect personal data from children in circumstances where parental consent or another legal basis is required. If we become aware that such data has been collected unlawfully, we will take appropriate steps to delete it or obtain the necessary authorization.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, business practices, or service operations. Any updated version will apply from the date it is made available. We encourage customers to review the Policy periodically to stay informed about how personal data is handled.

10. General Principles

We follow the core GDPR principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. This means we aim to process only the data that is necessary, keep it accurate and secure, and ensure that it is used in a manner consistent with the purposes described in this Policy.

Where processing is no longer necessary, we will cease processing and dispose of the data responsibly. We also review our data practices regularly to ensure that privacy protections remain appropriate and effective. If there is any conflict between this Policy and mandatory legal requirements, the applicable law will prevail.

Important note: This Privacy Policy applies to all customers in the area and should be read together with any applicable service terms or legal notices. It is designed to give clear information about personal data handling while preserving your rights under GDPR and related laws.