Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area and is designed to reflect the requirements of the General Data Protection Regulation (GDPR). By using our services, you acknowledge that your personal data may be processed in accordance with this Policy and applicable law.

1. Data Collection

We collect personal data that is necessary to provide and improve our services, manage customer relationships, and comply with legal obligations. The categories of data we may collect include:

Identity data such as name, title, and similar identifiers.
Contact data such as address, email address, and telephone number.
Account data such as account identifiers, preferences, and service history.
Transaction data such as payment records, billing details, and service purchases.
Technical data such as device information, browser type, log data, and usage statistics.
Communication data such as correspondence and service-related messages.

We generally collect personal data directly from you when you submit information, create an account, request services, complete forms, or communicate with us. We may also receive data from third parties where this is necessary for service delivery, fraud prevention, compliance checks, or operational support. We limit the data collected to what is relevant and necessary for defined purposes.

2. Purposes of Processing

We process personal data for the following purposes:

To provide, maintain, and deliver our services.
To manage customer accounts and requests.
To process payments and transactions.
To communicate service updates, notices, and administrative information.
To improve service quality, performance, and user experience.
To detect, prevent, and investigate fraud, abuse, or security incidents.
To comply with legal and regulatory obligations.
To establish, exercise, or defend legal claims.

We only use personal data in ways that are compatible with the original purpose of collection or for a compatible related purpose permitted by law.

3. Lawful Basis for Processing

Under GDPR, we must have a lawful basis to process personal data. Depending on the specific processing activity, we rely on one or more of the following bases:

Contract: Processing is necessary to enter into or perform a contract with you.
Legal obligation: Processing is required to comply with applicable laws and regulations.
Legitimate interests: Processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.
Consent: We may rely on your consent for certain optional activities, such as specific communications or non-essential data uses.
Vital interests: In rare cases, processing may be necessary to protect your vital interests or those of another person.
Public task: Where applicable, processing may be necessary for a task carried out in the public interest or in the exercise of official authority.

If we rely on consent, you may withdraw it at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

4. Data Sharing and Processors

We may share personal data with trusted third parties that act as processors on our behalf or, in some cases, as independent controllers. Processors are only permitted to process personal data according to our instructions and for the purposes set out in this Policy.

Types of processors may include:

IT and hosting providers for system operation, storage, and technical support.
Payment service providers for transaction processing and fraud prevention.
Customer support tools for managing inquiries and service communications.
Analytics providers for measuring service usage and performance.
Professional advisers such as legal, accounting, or audit professionals.
Authorities and regulators where disclosure is required by law.

Where we use processors, we take appropriate steps to ensure that data protection obligations are contractually imposed and that personal data is protected with suitable technical and organisational measures. We do not sell personal data.

5. International Transfers

If personal data is transferred outside the European Economic Area or the United Kingdom, we will take steps to ensure that an adequate level of protection is maintained. Such steps may include standard contractual clauses, adequacy decisions, or other approved safeguards. These measures help ensure that personal data remains protected even when processed in other jurisdictions.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting, reporting, and dispute-resolution requirements. Retention periods vary depending on the type of data, the reason for processing, and any applicable legal obligations.

In general:

Account and service data are retained for the duration of the relationship and for a reasonable period afterward.
Transaction and financial data are retained for the period required under tax, accounting, or commercial law.
Communication data are retained as long as needed to manage the request or maintain records.
Technical and security logs are retained for operational, security, and fraud-prevention purposes.

When personal data is no longer required, we will securely delete, anonymise, or otherwise dispose of it in accordance with our retention procedures. In some cases, data may be retained for a longer period where necessary to establish or defend legal claims.

7. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, encryption, monitoring, secure storage, staff training, and restricted permissions. While no system can be completely secure, we work to maintain a level of security appropriate to the risks of processing.

8. Your Rights Under GDPR

Subject to the conditions and exceptions set out in GDPR, you have the following rights regarding your personal data:

Right of access: You may request confirmation of whether we process your personal data and obtain a copy of that data.
Right to rectification: You may request correction of inaccurate or incomplete data.
Right to erasure: You may request deletion of your personal data in certain circumstances.
Right to restriction: You may request limitation of processing in certain situations.
Right to data portability: You may receive your data in a structured, commonly used, machine-readable format and transmit it to another controller where applicable.
Right to object: You may object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time.
Right not to be subject to automated decision-making: You may have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise your rights, you may submit a request through the appropriate service channel. We may need to verify your identity before responding. We will respond within the time limits required by GDPR unless an extension is lawfully permitted due to complexity or volume.

9. Data Accuracy and Your Responsibilities

We take reasonable steps to keep personal data accurate and up to date. However, we also depend on you to provide correct information and to notify us of relevant changes. Keeping your information current helps us deliver services accurately and securely.

10. Automated Processing

Where we use automated tools to support operations such as fraud detection, risk assessment, or service personalisation, we will ensure that such processing is fair, proportionate, and lawful. If a decision is made solely by automated means and has legal or similarly significant effects, additional safeguards will apply where required by law.

11. Children’s Data

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children where such collection is not permitted. If we become aware that we have collected such data unlawfully, we will take appropriate steps to delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, our practices, or operational needs. The revised version will apply from the date it is published or otherwise communicated. We encourage you to review this Policy periodically to remain informed about how we process personal data.

Summary of Key Points

In short, we collect only the personal data needed to provide services, rely on lawful bases under GDPR, use processors under strict controls, retain data only as long as necessary, and respect your rights regarding your information. This Policy applies to all customers in the area and is intended to ensure transparent, fair, and lawful processing of personal data.

Important: Nothing in this Policy limits rights granted to you under applicable data protection law.