Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, retained, and protected when services are provided to all customers in the area. It is intended to be clear and transparent and to reflect the requirements of the General Data Protection Regulation (GDPR). By using the services, you acknowledge that personal data may be processed in the ways described below.

1. Data We Collect

We collect only the data that is necessary for specific, legitimate, and limited purposes. Depending on the way you interact with the services, this may include:

Identity data such as name, title, or similar identifiers.
Contact data such as address, email address, or telephone number.
Transaction data such as records of products or services purchased, payment status, and related details.
Technical data such as device type, browser type, internet protocol address, and system logs.
Usage data such as information about how services are accessed and used.
Communication data such as correspondence, inquiries, feedback, complaints, or support requests.
Preference data such as settings or choices you make in relation to service delivery.

We do not collect more data than is necessary. Where special category data is not required, we do not intentionally request it. If such information is ever provided to us, it will be processed only where a lawful basis exists and with appropriate safeguards.

2. How We Use Personal Data

Personal data is used for the following purposes:

To provide and manage services.
To process transactions and maintain records.
To communicate with you regarding requests, updates, and service-related matters.
To improve service quality, performance, and user experience.
To detect, prevent, and address fraud, misuse, or security issues.
To comply with legal and regulatory obligations.
To establish, exercise, or defend legal claims.

We process data in a manner that is adequate, relevant, and limited to what is necessary for the specified purpose.

3. Lawful Basis for Processing

We only process personal data where a lawful basis under GDPR applies. Depending on the activity, the lawful basis may be one or more of the following:

Contract

We process personal data when it is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract.

Legal Obligation

We may process personal data where it is necessary to comply with a legal obligation, such as tax, accounting, consumer protection, or regulatory requirements.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your interests, rights, or freedoms. Examples include service improvement, security monitoring, administrative functions, and fraud prevention.

Consent

Where consent is the lawful basis, we will ask for it in a clear and informed manner. You may withdraw consent at any time, and such withdrawal will not affect the lawfulness of processing before withdrawal.

Vital Interests

In rare cases, processing may be necessary to protect someone’s vital interests.

4. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, reporting, or dispute-resolution requirements. Retention periods depend on the nature of the data and the reason for processing.

When determining how long to keep data, we consider:

The amount, nature, and sensitivity of the data.
The potential risk of harm from unauthorised use or disclosure.
The purposes of processing and whether those purposes can be achieved by other means.
Applicable legal and regulatory obligations.

Once the retention period ends, personal data is securely deleted, anonymised, or archived where appropriate. Data will not be kept longer than necessary.

5. Sharing and Processors

Personal data may be shared with carefully selected third parties that act as data processors or independent controllers, depending on the purpose. We use processors only where they provide sufficient guarantees regarding GDPR compliance and appropriate technical and organisational security measures.

Processors may include:

IT and hosting providers.
Payment service providers.
Customer support tools.
Analytics or performance monitoring providers.
Document storage or archiving services.
Professional advisers, such as legal, accounting, or audit support providers.

Processors are permitted to process personal data only on documented instructions and for the agreed purposes. They are required to protect the confidentiality and integrity of the data and must not use it for their own purposes.

We may also disclose personal data where required by law, court order, regulatory request, or to protect rights, safety, and security.

6. International Transfers

If personal data is transferred outside the European Economic Area or the UK, appropriate safeguards will be used to ensure an adequate level of protection. Such safeguards may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms. All transfers are assessed with care to maintain GDPR-level protection.

7. Data Security

We implement appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, encryption where appropriate, logging, staff confidentiality obligations, and regular review of security practices.

Although no system can be guaranteed completely secure, we take reasonable steps to reduce risk and to respond promptly to any suspected incident involving personal data.

8. Your Rights Under GDPR

As a data subject, you have rights in relation to your personal data. Subject to legal conditions and exemptions, these rights may include:

Right of access – to obtain confirmation and a copy of your personal data.
Right to rectification – to correct inaccurate or incomplete data.
Right to erasure – to request deletion of personal data in certain circumstances.
Right to restriction – to request limits on how personal data is processed.
Right to data portability – to receive your data in a structured, commonly used, machine-readable format and, where technically feasible, have it transferred to another controller.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent.
Right not to be subject to solely automated decision-making – where such decisions produce legal or similarly significant effects, unless permitted by law.

You also have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been infringed. We encourage you to raise concerns promptly so they can be reviewed and addressed.

9. Children’s Data

The services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children where such collection is not appropriate or lawful. If we become aware that data has been collected in error, we will take reasonable steps to delete it.

10. Automated Decision-Making and Profiling

Where applicable, personal data may be analysed to improve services, detect fraud, or manage operations. However, we do not carry out solely automated decision-making that produces legal or similarly significant effects unless this is permitted by law and appropriate safeguards are in place. If profiling is used, it will be limited, proportionate, and consistent with GDPR principles.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service arrangements. Any revised version will apply from the date it is issued or made available. We encourage you to review this policy periodically to stay informed about how personal data is processed.

12. Applicability

This Privacy Policy applies to all customers in the area and governs the processing of personal data in connection with the services provided. It is intended to support transparency, accountability, and compliance with GDPR principles of fairness, lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability.

In summary: personal data is collected only for specified purposes, processed under a valid lawful basis, retained for a limited period, shared only with trusted processors or when required by law, and protected by technical and organisational safeguards. Your rights remain central to how your data is handled.