Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using our services, you acknowledge that your personal data may be processed as described in this policy.

1. Data We Collect

We may collect personal data directly from you, automatically through your use of our services, or from third parties where permitted by law. The categories of data we collect may include:

Identity information: name, title, and similar identifiers.
Contact information: email address, telephone number, billing address, and delivery address.
Account information: usernames, preferences, and records related to service use.
Transaction information: details about purchases, subscriptions, payments, and related records.
Technical data: device type, IP address, browser type, operating system, and usage logs.
Communication data: records of correspondence, inquiries, feedback, and support requests.

We only collect personal data that is relevant and necessary for the purposes set out in this Privacy Policy. Where possible, we apply the principle of data minimisation so that only the data needed for a specific purpose is processed.

2. How We Use Personal Data

We use personal data for the following purposes:

To provide, operate, and maintain our services;
To process transactions and manage accounts;
To communicate with customers about services, updates, or support;
To improve service quality, performance, and user experience;
To monitor security, detect fraud, and prevent misuse;
To comply with legal obligations and regulatory requirements;
To establish, exercise, or defend legal claims where necessary.

We will not use personal data for purposes that are incompatible with those listed above unless we have a valid lawful basis or are otherwise permitted by law.

3. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for each processing activity. Depending on the context, we may rely on one or more of the following lawful bases:

Contract

We process personal data where it is necessary to perform a contract with you or to take steps at your request before entering into a contract. This includes providing services, managing accounts, and handling payments.

Legal Obligation

We may process personal data when needed to comply with legal or regulatory obligations, such as tax, accounting, record-keeping, or lawful disclosure requirements.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. Legitimate interests may include preventing fraud, securing systems, improving services, and maintaining business operations. When relying on this basis, we consider whether the processing is proportionate and whether your privacy expectations are respected.

Consent

In limited situations, we may process personal data based on your consent. Where consent is used, you have the right to withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

4. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for legal, accounting, reporting, or dispute-resolution purposes. The retention period depends on several factors, including:

The nature and sensitivity of the data;
The purpose for which it was collected;
Whether legal or regulatory obligations require a longer retention period;
Whether the data is needed to establish, exercise, or defend legal claims.

When personal data is no longer required, it will be deleted, anonymised, or securely archived in accordance with applicable retention rules. We apply storage limitation principles and do not keep personal data indefinitely without a lawful reason.

5. Processors and Third-Party Sharing

We may share personal data with third-party service providers acting as processors on our behalf. These processors are bound by contractual obligations to process personal data only according to our instructions and to implement appropriate technical and organisational safeguards.

Processors may include providers that support:

Payment processing;
IT hosting and cloud infrastructure;
Customer support tools;
Analytics and performance monitoring;
Security, fraud prevention, and authentication services;
Administrative and operational functions.

We may also disclose personal data to independent controllers where required by law, where necessary to protect our rights, or in connection with legal proceedings. In such cases, the receiving party determines its own purposes and means of processing, and its own privacy practices may apply.

Where personal data is transferred outside the European Economic Area or other regions with equivalent protections, we will take appropriate measures to ensure that the data remains protected in accordance with applicable data protection law, such as relying on standard contractual clauses or equivalent safeguards where legally required.

6. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, encryption where appropriate, monitoring, backups, and internal policies governing data handling.

Although we take reasonable steps to safeguard personal data, no system can be guaranteed to be entirely secure. We therefore encourage users to take care when sharing information and to use secure credentials where applicable.

7. Your Rights Under GDPR

Subject to legal limitations, you have the following rights regarding your personal data:

Right of access: you may request confirmation of whether we process your data and obtain a copy of that data.
Right to rectification: you may request correction of inaccurate or incomplete data.
Right to erasure: you may request deletion of your data in certain circumstances, such as when it is no longer needed.
Right to restriction: you may request that processing be restricted in certain situations.
Right to data portability: you may request a copy of certain data in a structured, commonly used, machine-readable format.
Right to object: you may object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe your rights have been violated. Exercising your rights will not usually result in any penalty or reduction in the quality of service, although some requests may affect our ability to provide certain features or services.

8. Automated Decision-Making

We do not rely on solely automated decision-making that produces legal or similarly significant effects on individuals unless permitted by law and subject to required safeguards. If such processing is introduced, we will provide appropriate notice and information about the logic involved, the significance, and the possible consequences for you.

9. Children’s Data

Our services are not directed to children unless expressly stated otherwise. We do not knowingly collect personal data from children in a manner that would require parental consent under applicable law. If we become aware that personal data has been collected unlawfully from a child, we will take reasonable steps to delete it.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. The most current version will apply to the processing of personal data. Where changes are material, we will take appropriate steps to make the updated policy known to affected users.

11. Scope of Application

This Privacy Policy applies to all customers in the area and governs the processing of personal data related to the services provided there. It is designed to ensure that customer information is handled fairly, lawfully, and transparently. We are committed to processing personal data in a manner that respects privacy rights and supports accountability, integrity, and lawful processing at every stage.

Summary of principles: we collect only necessary data, process it on a valid lawful basis, retain it only as long as needed, share it with processors under contract, and uphold user rights under GDPR.