Privacy Policy

Effective Date: This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area where our services are offered and used. We are committed to processing personal data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

1. Scope of This Privacy Policy

This Privacy Policy applies to personal data relating to individuals who use our services, interact with us, make inquiries, receive communications, or otherwise engage with our business. It covers data collected directly from customers, as well as data that may be collected automatically through systems used to operate and secure our services.

For the purposes of this Policy, personal data means any information relating to an identified or identifiable natural person. This may include identifiers, contact details, transaction information, technical data, and other information that can be linked to an individual.

2. Data We Collect

We collect only the data necessary for specific, legitimate, and lawful purposes. The categories of data we may collect include:

Identity data, such as your name or similar identifiers.
Contact data, such as mailing address, email address, and telephone number.
Transaction data, such as records of purchases, orders, payments, and service history.
Technical data, such as device type, browser type, operating system, IP address, and usage patterns.
Communication data, such as correspondence, support requests, complaints, and feedback.
Preference data, such as service choices and consent preferences.

We do not intentionally collect special category data unless it is strictly necessary, legally permitted, and subject to additional safeguards. Where such information is required, we will limit collection to what is relevant and proportionate.

3. How We Use Personal Data

We process personal data for specific purposes, including:

providing and managing our services;
processing transactions and fulfilling requests;
maintaining service quality and customer support;
improving operations, security, and user experience;
fulfilling legal, tax, accounting, and regulatory obligations;
preventing fraud, misuse, unauthorized access, and other security incidents;
sending important service-related communications;
where permitted, carrying out limited marketing activities based on lawful requirements.

We process data only where it is necessary for one or more lawful purposes and in a manner that is fair, transparent, and proportionate.

4. Lawful Basis for Processing

Under the GDPR, every processing activity must have a lawful basis. We rely on the following lawful bases, depending on the context:

Contract

We process personal data when it is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract. This may include managing your account, delivering services, and processing payments.

Legal Obligation

We may process data when necessary to comply with legal obligations, including accounting, tax, consumer protection, anti-fraud, recordkeeping, and regulatory compliance requirements.

Legitimate Interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. Examples include service improvement, network and information security, internal administration, and prevention of misuse.

Consent

Where required by law, we rely on your consent. If consent is used as the basis for processing, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

5. Data Sharing and Processors

We may share personal data with carefully selected third parties that act as processors or, in some cases, independent controllers. Processors handle personal data on our behalf and only in accordance with our instructions and applicable law.

Examples of processor categories may include:

IT and hosting providers, who support system storage, infrastructure, and security;
payment service providers, who assist with payment processing and fraud prevention;
customer support and communications providers, who help manage messages and service interactions;
analytics and performance providers, who assist with measuring and improving service use;
professional advisers, such as legal, audit, accounting, and compliance advisers;
public authorities, when disclosure is required by law or a valid legal request.

Where we engage processors, we take appropriate steps to ensure they are bound by data processing terms that require confidentiality, security, lawful processing, and assistance with data subject rights where relevant.

We do not sell personal data. Any sharing is limited to what is necessary for the purposes described in this Policy and subject to appropriate safeguards.

6. International Transfers

If personal data is transferred outside the European Economic Area or other regions with equivalent protections, we ensure that appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, or other legally recognized transfer mechanisms. We aim to maintain a level of protection consistent with GDPR requirements.

7. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including satisfying legal, accounting, reporting, and operational requirements. Retention periods are determined by considering:

the nature and sensitivity of the data;
the purpose of processing;
legal and regulatory retention obligations;
the risk of harm from unauthorized use or disclosure;
whether the data is required for dispute resolution or enforcement.

When personal data is no longer needed, it will be deleted, anonymized, or securely archived in line with applicable law and internal retention practices. In some cases, data may be retained for a longer period where required by law or necessary to defend legal claims.

8. Security Measures

We use appropriate technical and organizational measures to protect personal data against accidental loss, unauthorized access, unlawful processing, alteration, and disclosure. These measures may include access controls, encryption where suitable, secure storage, staff confidentiality obligations, and regular review of security practices.

No system can be guaranteed completely secure, but we work to reduce risks and maintain safeguards proportionate to the nature of the data and the processing involved.

9. Your Rights Under GDPR

If you are located in the applicable area covered by GDPR or are otherwise entitled to GDPR protections, you have a number of rights regarding your personal data. Subject to legal limitations, these rights may include:

Right of access – to obtain confirmation and a copy of your personal data;
Right to rectification – to request correction of inaccurate or incomplete data;
Right to erasure – to request deletion of data in certain circumstances;
Right to restriction – to request limited processing in certain situations;
Right to data portability – to receive certain data in a structured, commonly used format and, where feasible, transmit it to another controller;
Right to object – to object to processing based on legitimate interests or direct marketing;
Right not to be subject to automated decision-making – where such decisions produce legal or similarly significant effects and are not otherwise permitted by law.

Where processing is based on consent, you also have the right to withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully before the withdrawal.

10. How Rights Can Be Exercised

To exercise your rights, you may submit a request using the process made available for data protection inquiries. We may need to verify your identity before responding, to protect your privacy and ensure that personal data is disclosed only to the correct person. We will respond within the time limits required by GDPR, typically within one month, unless an extension is permitted due to complexity or the number of requests.

Requests may be refused or limited where allowed by law, such as when they would adversely affect the rights of others, interfere with legal obligations, or conflict with permitted retention requirements.

11. Complaints

If you believe your personal data has been handled unlawfully or that your rights have not been respected, you may raise a complaint with the relevant supervisory authority in your jurisdiction. We encourage individuals to first raise concerns through the appropriate internal request process so that we can address them promptly and fairly.

12. Children’s Data

Our services are not intended for children unless explicitly stated otherwise. We do not knowingly collect personal data from children without appropriate authorization and safeguards where required by law. If we become aware that personal data has been collected from a child inappropriately, we will take steps to delete or securely handle it in accordance with legal requirements.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When updates are made, the revised version will apply from its effective date. We encourage customers to review this Policy periodically to remain informed about how personal data is protected and used.

14. Final Statement

This Privacy Policy is designed to provide clear information about how we process personal data in a GDPR-compliant manner. It applies to all customers in the area and is intended to ensure transparency, accountability, and respect for individual rights. We process personal data with care, only for lawful purposes, and retain it only for as long as necessary.