Privacy Policy

This Privacy Policy explains how personal data is collected, used, shared, retained, and protected for all customers in the area. It applies to any individual who uses, accesses, or otherwise interacts with the services provided. We are committed to handling personal data in a lawful, fair, and transparent manner in line with the General Data Protection Regulation (GDPR).

1. Scope of This Policy

This policy applies to all customers in the area, including current, former, and prospective users of the services. It covers data processed in connection with service delivery, account administration, communication, compliance, support, and operational improvement. By using the services, individuals acknowledge that their personal data may be processed as described in this policy.

2. Personal Data We Collect

We may collect and process different categories of personal data depending on how services are used. The data collected may include:

Identity data: name, title, and similar identifiers.
Contact data: address, email address, telephone number, and other communication details.
Transaction data: records of purchases, orders, payments, invoicing, and related correspondence.
Technical data: device type, IP address, browser type, log data, and usage information.
Profile data: preferences, service history, feedback, and settings.
Communication data: messages, support requests, complaints, and records of interactions.

We collect personal data directly from individuals, through service use, and from third parties where permitted by law. Where required, we may also receive data from payment providers, delivery partners, fraud-prevention sources, and publicly available sources.

3. Why We Use Personal Data

Personal data is processed for specific, legitimate, and clearly defined purposes, including:

providing and administering services;
managing customer accounts and transactions;
verifying identity and preventing fraud;
responding to enquiries and support requests;
improving service quality, functionality, and user experience;
maintaining records and internal operations;
meeting legal, regulatory, tax, and accounting obligations;
protecting rights, property, and safety;
sending essential service-related communications.

Where allowed by law, we may also use data for analytics, security monitoring, and service development. Any processing beyond these purposes will be carried out only where a valid legal basis exists.

4. Lawful Basis for Processing

We process personal data only where a lawful basis under GDPR applies. Depending on the activity, the lawful basis may include:

Contract: processing is necessary to provide services, take steps requested before entering into a contract, or perform obligations under an agreement.
Legal obligation: processing is required to comply with laws, regulations, court orders, or official requests.
Legitimate interests: processing is necessary for our legitimate business interests, provided those interests are not overridden by the individual’s rights and freedoms. Examples include service improvement, fraud prevention, network security, and internal administration.
Consent: where required, processing is based on freely given, specific, informed, and unambiguous consent. Consent may be withdrawn at any time without affecting prior lawful processing.

Where special category data is processed, additional conditions required under GDPR will apply. Such data will only be handled when strictly necessary and legally permitted.

5. Data Sharing and Processors

We may share personal data with trusted third parties acting as processors or, in limited cases, independent controllers. Processors process data only on our instructions and are required to use appropriate security measures. The types of processors may include:

IT hosting and infrastructure providers;
cloud service providers;
payment processors and financial service providers;
customer support and communication platforms;
analytics and reporting providers;
security, fraud detection, and identity verification partners;
professional advisers such as legal, audit, and accounting services.

We may also disclose personal data where necessary to comply with legal requirements, enforce agreements, protect against harm, or establish, exercise, or defend legal claims. Where data is transferred outside the European Economic Area, appropriate safeguards will be used, such as Standard Contractual Clauses or other legally approved mechanisms.

6. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, regulatory, accounting, tax, and reporting obligations. Retention periods are determined by the nature of the data, the purpose of processing, applicable laws, and operational needs.

In general:

account and service records are kept for the duration of the relationship and for a reasonable period afterward;
transaction and financial records are retained for the period required by tax and accounting laws;
support and communication records are kept as long as needed to resolve issues and maintain accurate records;
security logs and technical data are kept for a limited period unless longer retention is necessary for investigations, legal obligations, or system protection.

When personal data is no longer required, it will be securely deleted, anonymised, or archived in a way that prevents further identification where appropriate.

7. Data Security

We use technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, encryption, secure storage, staff training, system monitoring, and restricted permissions. Although no system can be guaranteed completely secure, we take reasonable and appropriate steps to safeguard all personal data processed under this policy.

8. User Rights Under GDPR

Individuals whose personal data is processed under this policy have rights under GDPR, subject to legal limitations. These rights include:

Right of access: to obtain confirmation and a copy of personal data being processed.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request limited processing in certain situations.
Right to data portability: to receive data in a structured, commonly used format and transmit it to another controller where applicable.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing relies on consent, it may be withdrawn at any time.

Individuals also have the right to lodge a complaint with a competent data protection authority if they believe their rights have been infringed. Requests relating to rights will be handled in accordance with GDPR timeframes and requirements.

9. Automated Decision-Making

We do not use personal data for decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals unless such processing is lawful and subject to appropriate safeguards. If such processing is introduced, affected individuals will be informed as required by law and given access to relevant rights and explanations.

10. Children’s Data

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children without appropriate authority or legal basis. If we become aware that data has been collected inappropriately, we will take steps to delete it or process it lawfully as soon as reasonably possible.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulatory guidance, operational practices, or service developments. Any revised policy will apply from the date it takes effect. Continued use of the services after changes become effective indicates acknowledgment of the updated terms, where permitted by law.

Summary of Key Commitments

Transparent collection: only the data needed for legitimate purposes is collected.
Lawful processing: processing is based on contract, legal obligation, legitimate interests, or consent.
Limited retention: data is kept only as long as necessary.
Controlled sharing: processors are bound by instructions and security obligations.
Individual rights: users can access, correct, erase, restrict, port, and object to processing.

This Privacy Policy applies to all customers in the area. It is intended to provide clear information about how personal data is handled and the protections available under GDPR.