Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected when customers use our products and services. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and applicable local data protection laws.

1. Scope of This Policy

This Policy applies to all personal data processed in connection with our services, including information collected from customers, prospective customers, and users who interact with our services in the relevant area. By using our services, individuals acknowledge that their data may be processed as described in this Policy. This Policy does not apply to data that has been anonymised in a manner that prevents identification of any individual.

2. Data We Collect

We only collect personal data that is relevant, limited, and necessary for the purposes described in this Policy. Depending on the relationship and services provided, we may collect the following categories of data:

Identity data such as name, title, and identification details where required.
Contact data such as address, email address, and telephone number.
Account data such as account identifiers, login details, and preferences.
Transaction data such as service records, purchase history, payment status, and related billing information.
Technical data such as device type, browser information, IP address, and usage logs.
Communication data such as correspondence, support requests, feedback, and complaint records.
Compliance data such as records needed to meet legal, accounting, or regulatory obligations.

We do not intentionally collect special category data unless it is strictly necessary and a valid legal basis applies. If such data is required, we will handle it with heightened protection and only where permitted by law.

3. How We Use Personal Data

Personal data is processed only for specific, explicit, and legitimate purposes. These may include:

providing and managing services;
creating and maintaining customer accounts;
processing transactions and related administrative tasks;
responding to inquiries, requests, and complaints;
improving service quality, functionality, and user experience;
detecting and preventing fraud, misuse, and security incidents;
complying with legal, regulatory, tax, and accounting obligations;
establishing, exercising, or defending legal claims;
sending service-related notices and important updates.

We will not use personal data for purposes that are incompatible with the original reason for collection unless the law permits or requires such use.

4. Lawful Basis for Processing

Under GDPR, every processing activity must rely on a lawful basis. We process personal data on one or more of the following grounds:

Contract

We process data when it is necessary to enter into or perform a contract with a customer, including delivering services, managing accounts, and handling payments.

Legal Obligation

We process data when required to comply with legal obligations, including tax, accounting, consumer protection, anti-fraud, and record-keeping duties.

Legitimate Interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the individual’s rights and freedoms. Legitimate interests may include service improvement, internal administration, security, and fraud prevention. Where required, we conduct a balancing assessment before relying on this basis.

Consent

We may rely on consent for specific processing activities, especially where law requires prior permission. When consent is used, it will be informed, specific, freely given, and capable of withdrawal at any time.

Vital Interests and Public Interest

In rare situations, processing may be necessary to protect vital interests or to perform a task carried out in the public interest, where these bases are applicable under law.

5. Data Sharing and Processors

We may share personal data with trusted third parties that assist in providing our services. These third parties act as processors when they process data on our behalf and under our instructions. Examples may include service providers for hosting, IT support, payment processing, analytics, document management, customer support, and secure data storage.

Before engaging a processor, we assess whether it provides sufficient guarantees to implement appropriate technical and organisational measures. Each processor is contractually bound to process data only on our documented instructions, to maintain confidentiality, to protect data against unauthorised access or loss, and to assist with GDPR compliance where appropriate.

We may also disclose data to independent controllers where necessary, such as to legal advisers, regulators, auditors, insurers, or public authorities. In these cases, the recipient determines its own purposes and means of processing, subject to applicable law.

We do not sell personal data. Any transfer of data to third parties is limited to what is necessary and permitted by law.

6. International Transfers

If personal data is transferred outside the European Economic Area or another jurisdiction with equivalent protections, we will ensure appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms. We take reasonable steps to confirm that transferred data remains protected to a standard consistent with GDPR requirements.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. Retention periods depend on the type of data, the nature of the service, and any legal obligations that apply.

In general, we consider the following factors when determining retention:

whether the data is needed to provide ongoing services;
whether a legal claim may arise or be defended;
mandatory retention periods under law;
auditing, tax, and regulatory requirements;
whether the individual has requested deletion and whether deletion is legally permitted.

When personal data is no longer needed, we securely delete, destroy, or anonymise it in line with our retention practices. Where data is retained in backup systems, it will be isolated and deleted in accordance with backup lifecycle procedures.

8. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental loss, unlawful destruction, unauthorised access, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff confidentiality obligations, monitoring, and periodic review of security practices.

Although no system can be guaranteed to be completely secure, we take data protection seriously and continually assess the effectiveness of our safeguards. Where a personal data breach occurs and is likely to result in a risk to individuals, we will take action in accordance with applicable law, including notification where required.

9. User Rights Under GDPR

Individuals whose personal data we process have rights under GDPR. Subject to legal limits and verification of identity, these rights may include:

Right of access – to obtain confirmation of whether data is processed and receive a copy of the personal data.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of personal data in certain circumstances.
Right to restriction – to request limitation of processing in certain situations.
Right to data portability – to receive data in a structured, commonly used, machine-readable format and transmit it where applicable.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing.
Right to complain – to lodge a complaint with a supervisory authority if a data protection concern is not resolved.

We will respond to rights requests within the timeframes required by law, typically within one month, unless an extension is permitted due to complexity or volume. Requests may be limited where compliance would adversely affect the rights of others or where retention is required by law.

10. Children’s Data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children without appropriate authorisation or consent where required by law. If we become aware that data has been collected from a child unlawfully, we will take appropriate steps to delete it.

11. Automated Decision-Making

We do not use personal data for decisions based solely on automated processing that produce legal or similarly significant effects, unless such processing is permitted by law and appropriate safeguards are in place. If such processing is introduced, affected individuals will be informed and provided with relevant rights and safeguards under GDPR.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, technical, operational, or service-related changes. The most current version will apply to all processing activities from the date of publication or effective date stated in the updated notice. We encourage individuals to review this Policy periodically to remain informed about how personal data is handled.

Effective principles: data minimisation, purpose limitation, storage limitation, integrity, confidentiality, and accountability guide our processing activities. We are committed to handling personal data lawfully, fairly, and transparently for all customers in the area.