Privacy Policy -

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when services are provided to customers in the relevant area. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and related data protection laws. Please read this policy carefully to understand how personal data is handled and what rights individuals have in relation to it.

1. Data We Collect

We collect only the personal data that is necessary for the purposes described in this policy. Depending on the interaction, this may include:

Identity data such as name, title, and similar identifiers.
Contact data such as email address, telephone number, billing details, and service address.
Transaction data such as records of purchases, payments, and service history.
Technical data such as device type, browser type, IP address, and usage logs.
Communication data such as correspondence and service-related requests or feedback.
Preference data such as chosen settings, interests, or consent choices where applicable.

We do not intentionally collect special category data unless it is strictly required, permitted by law, or explicitly provided by the individual for a specific purpose. Where such data is involved, additional safeguards are applied.

2. How We Use Personal Data

Personal data is used only for legitimate business and operational purposes. These may include:

Providing and managing services or products.
Processing transactions and payments.
Maintaining records and internal administration.
Responding to enquiries, complaints, and support requests.
Improving services, systems, and customer experience.
Meeting legal, regulatory, accounting, and tax obligations.
Preventing fraud, misuse, and security incidents.

Where we rely on consent, individuals may withdraw that consent at any time. Where we rely on legitimate interests, we assess those interests against the rights and freedoms of individuals to ensure that processing remains fair and proportionate.

3. Lawful Basis for Processing

Under GDPR, personal data must be processed on a valid lawful basis. We may rely on one or more of the following bases, depending on the purpose:

Contract — where processing is necessary to enter into or perform a contract with a customer.
Legal obligation — where processing is required to comply with a legal or regulatory duty.
Legitimate interests — where processing is necessary for our legitimate business interests, provided those interests are not overridden by individual rights.
Consent — where an individual has freely given clear consent for a specific purpose.
Vital interests — where processing is necessary to protect someone’s life or prevent serious harm, though this will only be used in exceptional circumstances.
Public task — where processing is necessary for carrying out a task in the public interest, if applicable.

We make sure that each processing activity has a documented legal basis and that personal data is not used in a way that is incompatible with the original purpose.

4. Sharing and Processors

We may share personal data with trusted third parties known as processors, who act on our instructions and are contractually required to protect the data. These may include providers of hosting services, payment processing, customer support tools, analytics services, document storage, and other operational systems.

Processors are selected carefully and only given access to the data needed to perform their services. They must:

Process data only for specified purposes.
Implement appropriate technical and organisational security measures.
Keep data confidential.
Assist with compliance obligations where required.
Delete or return data at the end of the service relationship, where appropriate.

We may also disclose personal data to regulators, law enforcement, tax authorities, auditors, or other parties where required by law or where necessary to protect legal rights, security, or the integrity of systems. Where data is transferred outside the relevant jurisdiction, appropriate safeguards are used to maintain an adequate level of protection.

5. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, reporting, and dispute-resolution requirements. Retention periods depend on the type of data, the purpose of processing, and any legal obligations that apply.

In general, we apply the following principles:

Data linked to active customer relationships is kept for the duration of the relationship.
Transaction and accounting records are retained for the period required by tax and financial regulations.
Support communications are kept for a reasonable period to manage follow-up and service quality.
Technical logs are retained only as long as needed for security, troubleshooting, and performance monitoring.
Where data is no longer needed, it is securely deleted, anonymised, or otherwise irreversibly removed from active systems.

Retention is reviewed periodically to ensure that personal data is not stored for longer than necessary. When retention is based on legal requirements, the relevant minimum period takes precedence.

6. Security Measures

We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption, authentication procedures, secure storage, staff confidentiality obligations, and regular security reviews.

Although no system can be guaranteed to be completely secure, we take reasonable steps to reduce risks and to respond promptly to any suspected personal data breach. Where required by law, affected individuals and relevant authorities will be notified without undue delay.

7. User Rights Under GDPR

Individuals whose data is processed under this policy have rights under GDPR. Subject to legal conditions and exemptions, these rights may include:

Right of access — to request confirmation of whether personal data is processed and to obtain a copy of that data.
Right to rectification — to request correction of inaccurate or incomplete data.
Right to erasure — to request deletion of personal data in certain circumstances.
Right to restriction — to request limited processing in specific situations.
Right to data portability — to receive certain data in a structured, commonly used, machine-readable format and, where feasible, to have it transmitted to another controller.
Right to object — to object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time.
Right not to be subject to automated decision-making — including profiling, where such decisions produce legal or similarly significant effects, unless permitted by law.

Requests relating to these rights will be handled in accordance with applicable law. We may need to verify identity before acting on a request. Some requests may be refused or limited where legal obligations require us to retain or continue processing data. Individuals also have the right to lodge a complaint with the relevant data protection authority if they believe their rights have been infringed.

8. Data Accuracy and Minimisation

We strive to keep personal data accurate, relevant, and up to date. Individuals are encouraged to provide correct information and to notify us of changes where necessary. We also apply the principle of data minimisation, meaning we collect and process only the data that is needed for the specified purposes.

By limiting the amount of data collected, we reduce privacy risks and help ensure that processing remains lawful, fair, and transparent.

9. Children’s Data

Where services are not intended for children, we do not knowingly collect personal data from children without appropriate authorisation or consent where required by law. If we become aware that data has been collected in breach of this requirement, we will take appropriate steps to delete it or seek the necessary legal basis.

10. Changes to This Policy

This Privacy Policy may be updated from time to time to reflect changes in legal requirements, processing practices, or operational needs. Any revised version will apply from the date it takes effect. We encourage individuals to review this policy periodically so they remain informed about how personal data is used and protected.

Summary of Key Principles

Transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality guide our handling of personal data. We process information lawfully, retain it only as long as needed, use processors under contractual safeguards, and respect the rights of individuals in the relevant area.

This policy applies to all customers in the area and governs the processing of personal data in connection with the services provided.