Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when services are provided to customers in the area. This policy applies to all customers in the area and is intended to be read together with any applicable terms, notices, or service-specific information. It has been prepared to reflect key requirements of the General Data Protection Regulation (GDPR), including transparency, lawful processing, data minimisation, security, and respect for individual rights.

1. Data We Collect

We may collect and process different categories of personal data depending on how services are used and what information is provided. The data collected is limited to what is necessary and relevant for the purposes described in this policy.

Categories of personal data

Identity data: name, title, and similar identifiers.
Contact data: address, email address, telephone number, and other communication details.
Account and service data: records of services requested, preferences, service history, and account-related information.
Transaction data: details relating to purchases, payments, invoices, refunds, and billing records.
Technical data: device information, log data, IP address, browser type, operating system, and usage patterns.
Communication data: correspondence, inquiries, complaints, and records of support interactions.
Verification data: information needed to confirm identity, eligibility, or authority to act.

We do not intentionally collect special category data unless it is required by law, necessary for a specific service, or voluntarily provided and permitted under GDPR conditions. Where such data is processed, appropriate safeguards are applied.

2. How Data Is Collected

Personal data may be collected directly from individuals when they submit information, communicate with us, or use services. Data may also be collected automatically through technical systems and service logs, or indirectly from trusted third parties where lawful and appropriate.

Information provided during enquiries, registrations, or service requests.
Information generated through transactions, support cases, and operational records.
Information collected through cookies or similar technologies, where permitted.
Information received from service partners, payment providers, or other processors acting on our instructions.

Where personal data is collected from a third party, we take steps to ensure that the source is authorised to share the information and that the processing is consistent with GDPR principles.

3. Purposes of Processing

We process personal data only for specified, explicit, and legitimate purposes. These purposes may include:

providing and administering services;
managing customer relationships and communications;
processing transactions and maintaining accounting records;
verifying identity and preventing fraud or misuse;
improving service quality, functionality, and customer experience;
meeting legal, regulatory, tax, and audit obligations;
handling complaints, disputes, and requests;
protecting the security, integrity, and availability of systems and data.

We do not use personal data in ways that are incompatible with these purposes unless required or permitted by law.

4. Lawful Basis for Processing

Under GDPR, every processing activity must rely on a lawful basis. Depending on the context, we may process personal data on one or more of the following bases:

Contract: processing is necessary to enter into or perform a contract, or to take steps at the request of the individual before entering into a contract.
Legal obligation: processing is required to comply with applicable law, regulation, tax rules, or formal requests from public authorities.
Legitimate interests: processing is necessary for our legitimate interests or those of a third party, provided these interests are not overridden by the individual’s rights and freedoms.
Consent: processing is based on consent where required, and consent may be withdrawn at any time where it is the lawful basis.
Vital interests: processing may occur where necessary to protect someone’s life or physical safety.
Public task: where applicable, processing may be required for tasks carried out in the public interest or under official authority.

We assess and document the appropriate lawful basis before processing personal data for a new purpose.

5. Data Retention

Personal data is kept only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, reporting, dispute resolution, and operational requirements. Retention periods depend on the type of data, the purpose of processing, and any mandatory retention rules.

Retention approach

Service and account data are retained for the duration of the relationship and for a reasonable period thereafter.
Transaction and financial records are retained for periods required by tax, audit, or commercial law.
Communications and support records are retained as long as needed to manage requests or defend legal claims.
Technical logs may be retained for security monitoring, troubleshooting, and fraud prevention for limited periods.

When data is no longer needed, it is securely deleted, anonymised, or archived in accordance with our retention rules and applicable law.

6. Processors and Data Sharing

We may engage third-party processors to perform services on our behalf. These processors act under our instructions and are required to protect personal data through appropriate technical and organisational measures.

Types of processors may include

payment service providers;
IT hosting and cloud infrastructure providers;
customer support and communication platforms;
accounting, auditing, and compliance tools;
security, fraud prevention, and monitoring services;
document storage and archiving services.

We may also share personal data with independent controllers where required by law or where necessary for service delivery, dispute handling, or protection of rights. In such cases, the receiving party is responsible for its own compliance obligations.

We require appropriate contractual safeguards with processors, including data processing terms, confidentiality obligations, and security commitments.

7. International Transfers

If personal data is transferred outside the European Economic Area or to a jurisdiction without an adequacy decision, we will use recognised transfer safeguards where required. These may include standard contractual clauses, supplementary technical measures, or other lawful mechanisms permitted under GDPR. Such measures are designed to ensure that personal data remains protected to an appropriate standard.

8. Security Measures

We implement proportionate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, encryption, role-based permissions, secure storage, staff training, and incident response procedures. While no system can be guaranteed completely secure, we continuously review and improve our safeguards.

9. User Rights

Individuals whose data is processed under GDPR have specific rights. Subject to legal limits and verification of identity, you may exercise the following rights:

Right of access: to obtain confirmation of processing and a copy of personal data.
Right to rectification: to correct inaccurate or incomplete data.
Right to erasure: to request deletion in certain circumstances.
Right to restriction: to limit processing in certain situations.
Right to data portability: to receive certain data in a structured, commonly used format and to transmit it where applicable.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent, withdrawal is possible at any time.
Right to lodge a complaint: to raise concerns with a competent data protection authority.

Requests will be handled in accordance with GDPR timelines and requirements. We may ask for information necessary to confirm identity and protect against unauthorised disclosure.

10. Automated Decision-Making

We do not use personal data for decisions that produce legal or similarly significant effects based solely on automated processing unless this is clearly disclosed, lawful, and subject to appropriate safeguards. If such processing is used in the future, individuals will be informed of the logic involved and their available rights.

11. Children’s Data

Our services are not directed to children unless explicitly stated for a particular service. If personal data relating to a child is processed, it will only occur with appropriate legal basis and safeguards, including parental or guardian authorisation where required.

12. Changes to This Policy

This Privacy Policy may be updated from time to time to reflect changes in legal requirements, operational practices, or service arrangements. The most current version will apply to the processing of personal data. Continued use of services after an update does not waive any rights granted under applicable data protection law.

13. Summary of Core Principles

We process personal data lawfully, fairly, and transparently. We collect only what is needed, retain it only as long as necessary, and share it only with trusted processors or where required by law. We respect the rights of individuals and apply suitable safeguards to protect data throughout its lifecycle.

In all cases, this policy applies to all customers in the area. It is designed to ensure that personal data is handled responsibly, securely, and in accordance with GDPR obligations.