Privacy Policy

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data in connection with our services. It applies to all customers in the area where our services are offered, and it is intended to comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws. Please read this Policy carefully to understand our practices regarding personal data and how we treat it.

1. Scope of this Policy

This Policy applies to personal data collected from customers, prospective customers, and other individuals who interact with us in the ordinary course of business. It covers data collected through direct interactions, service use, customer support, administrative processes, and technical systems related to service delivery.

For the purposes of this Policy, personal data means any information relating to an identified or identifiable natural person. This may include information that identifies you directly, such as your name, or indirectly, such as an online identifier or service account reference.

2. Data We Collect

We collect only the information that is necessary for legitimate business and operational purposes. The categories of personal data we may collect include:

• Identity data: name, title, and similar identifiers.
• Contact data: address, email address, and telephone number.
• Customer records: account details, service history, correspondence, preferences, and transaction-related information.
• Financial data: payment-related details and billing records where relevant.
• Technical data: device information, IP address, browser type, log files, and usage statistics.
• Communication data: requests, feedback, complaints, and messages sent to us.
• Marketing preferences: choices regarding promotional messages and communications.

We do not intentionally collect special category data unless it is strictly necessary and a valid legal condition applies. Where special category data is required, we will limit collection to what is necessary and apply appropriate safeguards.

3. How We Use Personal Data

We use personal data for the following purposes:

• to provide and manage our services;
• to process transactions and maintain customer accounts;
• to communicate with you about service updates, support matters, or operational notices;
• to improve our services, systems, and customer experience;
• to carry out recordkeeping, administration, and internal reporting;
• to comply with legal and regulatory obligations;
• to detect, investigate, and prevent fraud, security incidents, or misuse;
• to establish, exercise, or defend legal claims;
• to send marketing communications where permitted by law and where you have not opted out.

We always aim to use personal data fairly, lawfully, and transparently. When we rely on legitimate interests, we ensure that those interests do not override your rights and freedoms.

4. Lawful Basis for Processing

Under GDPR, we must have a lawful basis to process personal data. Depending on the context, our lawful basis may include one or more of the following:

4.1 Performance of a Contract

We process personal data where it is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract. This includes account management, service delivery, billing, and related communications.

4.2 Legal Obligation

We process personal data where required to comply with legal obligations, such as tax, accounting, consumer protection, anti-fraud, or regulatory requirements.

4.3 Legitimate Interests

We may process personal data for our legitimate interests, provided that your interests and fundamental rights do not override those interests. Examples include improving services, maintaining security, preventing misuse, and managing customer relationships.

4.4 Consent

In some situations, we may rely on your consent, particularly for certain marketing activities or optional processing. Where consent is used, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4.5 Vital Interests and Public Interest

Although uncommon in our operations, we may process personal data where necessary to protect vital interests or where processing is required for a task carried out in the public interest or under official authority.

5. Data Sharing and Processors

We may share personal data with trusted third parties that act as processors or, in some cases, independent controllers. Processors only process personal data on our documented instructions and are subject to confidentiality and security obligations.

Examples of processors may include:

• IT and cloud service providers;
• payment and billing service providers;
• customer support and communication platforms;
• analytics and system monitoring providers;
• professional advisers acting under confidentiality obligations;
• archiving, document management, and secure storage providers.

Where personal data is transferred outside the European Economic Area or another territory with equivalent protections, we ensure appropriate safeguards are in place, such as standard contractual clauses or another valid transfer mechanism permitted by law.

We do not sell personal data. We only disclose information when necessary for service delivery, legal compliance, security, or other legitimate business purposes and always under appropriate contractual or legal controls.

6. Retention of Personal Data

We retain personal data only for as long as necessary for the purposes for which it was collected, including any legal, accounting, reporting, or dispute-resolution requirements. Retention periods vary depending on the type of data and the context of processing.

When determining retention periods, we consider:

• the nature and sensitivity of the data;
• the purpose of the processing;
• whether we have a continuing relationship with you;
• legal and regulatory obligations;
• limitation periods for potential claims;
• operational, audit, or security needs.

When personal data is no longer required, we will securely delete, anonymise, or otherwise irreversibly remove it from active use, subject to any mandatory retention requirements.

7. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures may include access controls, encryption, secure storage, staff training, and regular review of security practices.

However, no system can be guaranteed to be completely secure. We therefore encourage customers to take reasonable steps to protect their own information, including safeguarding account credentials and monitoring their communications.

8. Your Rights Under GDPR

Where GDPR applies, you may have the following rights in relation to your personal data:

• Right of access: to obtain confirmation and a copy of your personal data.
• Right to rectification: to correct inaccurate or incomplete personal data.
• Right to erasure: to request deletion in certain circumstances.
• Right to restriction: to limit processing in certain cases.
• Right to data portability: to receive certain data in a structured, commonly used, machine-readable format.
• Right to object: to object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent: where processing is based on consent.
• Right not to be subject to automated decision-making: including profiling, where applicable under law.

If you exercise any of these rights, we may need to verify your identity before responding. Some rights are subject to legal limitations and may not apply in every situation. We will respond to requests within the timeframe required by GDPR.

9. Cookies and Similar Technologies

Where relevant, we may use cookies or similar technologies to support core functionality, measure usage, and improve performance. Such technologies may collect technical data and usage information. Where consent is required, we will seek it before placing non-essential cookies.

You may manage browser settings to block or delete cookies, but doing so may affect the functionality or performance of certain features.

10. Children’s Data

Our services are not directed to children unless expressly stated otherwise. We do not knowingly collect personal data from children without lawful authority and appropriate safeguards. If we become aware that personal data has been collected improperly from a child, we will take reasonable steps to delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any updated version will apply from the date it becomes effective. We encourage you to review this Policy periodically to stay informed about how we protect your personal data.

12. General Statement

This Privacy Policy is intended to provide clear, transparent, and lawful information about our handling of personal data. It applies to all customers in the area served by our business operations. We are committed to processing data in a manner that is fair, secure, and proportionate, and to respecting your rights under applicable data protection laws.

By using our services, you acknowledge that your personal data may be processed as described in this Policy and in accordance with applicable legal requirements.