Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected by all customers in the area when using our products and services. It applies to all customers in the area and is written to reflect key requirements under the General Data Protection Regulation (GDPR). By interacting with our services, you acknowledge that your personal data may be processed as described in this policy.

1. Scope of this Policy

This Privacy Policy applies to all customers in the area, including individuals who purchase, request, use, subscribe to, or otherwise engage with our services. It also applies where we process personal data in connection with customer support, billing, account management, marketing activities, analytics, and compliance obligations. This policy is intended to provide clear and transparent information about our data practices.

2. Data We Collect

We may collect and process different categories of personal data depending on how you interact with our services. The information collected may include:

Identity data, such as your name or similar identifiers.
Contact data, such as address, email, or other communication details.
Transaction data, including records of services requested, purchases made, and related payment information.
Account data, such as login details, preferences, and profile settings.
Technical data, including device type, browser type, IP address, and usage logs.
Communications data, such as messages, feedback, complaints, and support requests.
Marketing and preference data, reflecting your choices about receiving promotions or updates.

We generally do not collect special category data unless it is strictly necessary and permitted by law. If such data is required, we will process it only with an appropriate legal basis and safeguards.

3. How We Use Personal Data

We use personal data for the following purposes:

To provide and operate our services.
To manage accounts, transactions, and service delivery.
To respond to customer inquiries and support requests.
To maintain security, prevent fraud, and detect misuse.
To comply with legal and regulatory requirements.
To improve service performance, quality, and user experience.
To send marketing communications where allowed by law and where consent or legitimate interest applies.

We only process personal data for specified, explicit, and legitimate purposes.

4. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for each processing activity. Depending on the context, we may rely on one or more of the following bases:

4.1 Performance of a Contract

We process personal data where it is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract. This includes processing needed to deliver services, handle orders, manage accounts, and provide customer support.

4.2 Legal Obligation

We may process personal data where required to comply with applicable laws, regulations, tax rules, accounting obligations, or lawful requests from public authorities.

4.3 Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Examples include protecting our systems, improving our services, preventing fraud, and managing internal operations. Where we rely on legitimate interests, we assess the impact on your rights and apply appropriate safeguards.

4.4 Consent

Where required, we rely on your consent, for example for certain marketing communications or optional cookies and similar technologies. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

5. Data Sharing and Processors

We may share personal data with trusted third parties that act as processors or, in some cases, independent controllers. Processors are only permitted to process personal data on our instructions and are bound by appropriate contractual and confidentiality obligations.

Categories of processors may include:

IT and hosting providers that store or secure data systems.
Payment service providers that help process transactions.
Customer support service providers that assist with service operations.
Analytics providers that help us understand service usage.
Professional advisers, such as legal, accounting, or audit services.
Compliance and security partners that help prevent fraud or protect our systems.

We may also disclose personal data if required by law, to protect our rights, to respond to lawful requests, or in connection with a corporate transaction such as a merger or restructuring, provided appropriate safeguards are in place.

6. International Transfers

If personal data is transferred outside the European Economic Area, we will ensure that appropriate safeguards are applied. These may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms. We take reasonable steps to ensure that any international transfer respects GDPR requirements.

7. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, reporting, and dispute-resolution requirements. Retention periods vary depending on the type of data and the purpose of processing.

In determining retention periods, we consider:

The amount, nature, and sensitivity of the data.
The risk of harm from unauthorized use or disclosure.
The purposes for which we process the data.
Applicable legal obligations and limitation periods.

When personal data is no longer required, we will delete it securely or anonymize it where possible. We do not keep personal data longer than necessary.

8. Security Measures

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction. These measures may include access controls, encryption, monitoring, secure storage, and staff confidentiality obligations. While no system can be guaranteed to be fully secure, we work continuously to reduce risks and maintain strong safeguards.

9. Your Rights Under GDPR

As a data subject, you may have the following rights in relation to your personal data, subject to legal limitations and exceptions:

Right of access to obtain confirmation and a copy of your personal data.
Right to rectification to correct inaccurate or incomplete data.
Right to erasure to request deletion of personal data in certain circumstances.
Right to restriction of processing in certain cases.
Right to data portability to receive data in a structured, commonly used format where applicable.
Right to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent where processing is based on consent.
Right to lodge a complaint with a supervisory authority if you believe your rights have been violated.

Where permitted by law, we may need to verify your identity before responding to a request. We will respond within the time limits set by GDPR unless an extension is lawfully permitted.

10. Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects for customers unless such processing is permitted by law and appropriate safeguards are provided. If this changes, we will inform you and explain the logic involved, as well as the significance and consequences of such processing.

11. Children

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children in circumstances where consent or parental authorization is required without the appropriate legal basis. If we become aware that personal data has been collected inappropriately, we will take reasonable steps to delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service features. Any revised version will apply from the date it is made effective. We encourage customers to review this policy periodically so they remain informed about how their data is processed. This policy applies to all customers in the area at all times, subject to future updates.

13. Summary of Core Principles

Our approach to data protection is based on transparency, necessity, security, and accountability. We collect only data that is needed for legitimate business and legal purposes; we use it only on a valid lawful basis; we share it only with appropriate processors or where legally required; and we keep it only as long as necessary. We also respect your GDPR rights and provide a clear framework for exercising them.

Key Commitments

Transparency: we explain what data we collect and why.
Lawfulness: we process data only under an appropriate lawful basis.
Minimization: we limit data collection to what is necessary.
Retention control: we delete or anonymize data when it is no longer needed.
Accountability: we use processors carefully and maintain safeguards.
Respect for rights: we support access, correction, deletion, objection, and other GDPR rights.

This Privacy Policy is designed to meet GDPR expectations for clarity and fairness while applying to all customers in the area.