Privacy Policy

This Privacy Policy explains how personal data is collected, used, shared, stored, and protected when services are provided to customers in the relevant area. It applies to all customers in that area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and applicable local privacy laws.

We are committed to handling personal data fairly, lawfully, and transparently. We only collect data that is necessary for legitimate business purposes and take appropriate measures to protect it.

1. Scope of This Policy

This Privacy Policy applies to all customers in the area where our services are offered. It covers personal data collected through service requests, account creation, transactions, communications, support interactions, and the use of our services or related systems.

For the purpose of this policy, personal data means any information relating to an identified or identifiable natural person. This may include direct identifiers such as name and contact details, and indirect identifiers such as customer reference numbers or online identifiers.

2. Data We Collect

We may collect the following categories of personal data:

Identity data: name, surname, title, and similar identifiers.
Contact data: address, email address, telephone number, and preferred communication details.
Account and service data: account identifiers, service preferences, transaction records, service history, and customer interaction records.
Technical data: device type, operating system, browser information, log data, and usage information generated when interacting with our systems.
Financial data: billing details, payment status, invoicing information, and other records necessary to process payments or manage refunds.
Communication data: messages, feedback, complaints, and correspondence with support or service teams.

We do not intentionally collect special category data unless it is necessary and permitted by law. If such data is ever required, we will process it only where a valid legal condition under GDPR applies.

3. How We Collect Data

Personal data may be collected directly from you when you provide information through forms, telephone calls, emails, service requests, surveys, or account registration. We may also collect data automatically through technical systems when you use our services, such as usage logs and device-related information.

In some cases, we may receive data from third parties, such as payment providers, service partners, public authorities, or other legitimate sources, where this is necessary for service delivery, verification, fraud prevention, or legal compliance.

4. Purposes of Processing

We process personal data for the following purposes:

to provide and manage our services;
to create and maintain customer records;
to process transactions, payments, and refunds;
to communicate with customers about service matters;
to respond to enquiries, complaints, and support requests;
to improve service performance, quality, and customer experience;
to detect and prevent fraud, misuse, or unauthorized access;
to meet legal, regulatory, accounting, and tax obligations;
to establish, exercise, or defend legal claims.

We only use personal data in ways that are compatible with these purposes or otherwise permitted by law.

5. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for each processing activity. Depending on the context, we may rely on one or more of the following:

Contract: where processing is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract.
Legal obligation: where processing is required to comply with laws, regulations, court orders, or regulatory requests.
Legitimate interests: where processing is necessary for our legitimate business interests, provided these are not overridden by your rights and freedoms. Examples include service improvement, fraud prevention, and internal administration.
Consent: where we ask for your clear consent, for example for certain optional communications or specific data uses. You may withdraw consent at any time where processing relies on consent.
Vital interests: in rare circumstances where processing is necessary to protect someone’s life or physical safety.
Public task: where processing is necessary for tasks carried out in the public interest or under official authority, if applicable.

We assess and document the lawful basis before processing personal data and apply data minimisation principles whenever possible.

6. Sharing and Processors

We may share personal data with trusted third-party processors who act on our instructions and provide services such as payment processing, IT hosting, cloud storage, customer support tools, analytics, communications, and security monitoring. These processors are contractually required to protect personal data, use it only for the services they provide, and comply with GDPR obligations where applicable.

We may also disclose personal data to independent controllers where required by law, or where necessary to respond to lawful requests, protect rights, enforce agreements, or address security and fraud concerns.

Where personal data is transferred outside the European Economic Area, we will ensure appropriate safeguards are in place, such as an adequacy decision, standard contractual clauses, or other legally recognized transfer mechanisms.

7. Retention of Personal Data

We keep personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, tax, reporting, and dispute-resolution requirements. Retention periods vary depending on the type of data and the reason for processing.

In general, we apply the following retention principles:

data needed for an active customer relationship is retained for the duration of that relationship;
transaction and accounting records are retained for the period required by law;
support and communication records are retained for a reasonable period to manage enquiries and service issues;
technical logs are retained for limited periods to maintain security, troubleshoot problems, and analyze performance;
where data is no longer needed, it is securely deleted, anonymized, or archived in accordance with legal requirements.

When determining retention, we consider the nature of the data, legal obligations, business needs, and potential claims or audits.

8. Data Security

We use appropriate technical and organizational measures to protect personal data against accidental loss, unauthorized access, alteration, disclosure, or destruction. These measures may include access controls, encryption, secure storage, staff training, monitoring, and procedures for handling incidents.

While no system can be guaranteed to be completely secure, we continuously review our safeguards and improve them as needed to reduce risk.

9. Your Rights Under GDPR

If you are a customer in the relevant area, you have rights regarding your personal data. Subject to legal conditions and exemptions, these rights include:

Right of access: to obtain confirmation of whether we process your data and to receive a copy of that data.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of your data in certain circumstances.
Right to restriction: to request that processing be limited in specific situations.
Right to data portability: to receive your data in a structured, commonly used, machine-readable format and to request transfer where technically feasible.
Right to object: to object to processing based on legitimate interests or direct marketing, where applicable.
Right to withdraw consent: where processing relies on consent, you may withdraw it at any time.

You also have the right to be informed about how your data is used and to lodge a complaint with the relevant data protection authority if you believe your rights have been infringed.

10. Automated Decision-Making

We do not use personal data for decisions that produce legal or similarly significant effects solely by automated means unless this is lawful, necessary, and subject to suitable safeguards. If such processing is introduced, we will provide appropriate information and protections in line with GDPR requirements.

11. Children’s Data

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children without appropriate authorization or legal basis. If we become aware that data has been collected inappropriately, we will take steps to delete it or secure the necessary permissions.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, business practices, or service arrangements. Any revised version will apply from the date it becomes effective. We encourage customers to review this policy periodically so they remain informed about how personal data is handled.

Summary of Key Principles

Lawfulness, fairness, and transparency guide all processing.
Purpose limitation ensures data is used only for defined reasons.
Data minimisation means we collect only what is necessary.
Accuracy helps keep records up to date.
Storage limitation means data is retained only as long as needed.
Integrity and confidentiality are protected through security measures.

This Privacy Policy applies to all customers in the area and is designed to ensure personal data is handled in a lawful, secure, and responsible manner.