Privacy Policy

This Privacy Policy explains how personal data is collected, used, shared, stored, and protected in connection with our services. It applies to all customers in the relevant area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using our services, you acknowledge that your personal data may be processed as described in this Policy.

1. Data We Collect

We may collect and process different categories of personal data depending on how you interact with us. The types of data we collect may include:

Identity data such as your name, username, or similar identifiers.
Contact data such as billing address, delivery address, email address, or telephone number.
Transaction data such as details of services purchased, payments made, and related records.
Technical data such as device type, browser type, internet protocol address, and system settings.
Usage data such as information about how you use our services, pages visited, and interaction patterns.
Communication data such as records of inquiries, requests, complaints, or feedback.

We may also collect limited sensitive data only where necessary and where permitted by law. If such data is collected, we will apply additional safeguards and process it only in accordance with GDPR requirements.

2. How We Use Personal Data

We use personal data for legitimate business and operational purposes, including to:

provide, manage, and improve our services;
process transactions and administer accounts;
respond to inquiries and provide customer support;
maintain security, prevent fraud, and detect misuse;
comply with legal obligations and enforce our policies;
analyse service performance and improve user experience;
send administrative notices and service-related communications.

Where permitted by law, we may also use personal data for internal reporting, auditing, troubleshooting, and business planning. We only process personal data in ways that are compatible with the purposes stated in this Policy.

3. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for each processing activity. Depending on the context, we may process personal data on the following bases:

Performance of a contract

We process data when it is necessary to enter into or perform a contract with you, including delivering requested services, managing billing, or handling account-related matters.

Legal obligation

We may process data to comply with legal and regulatory requirements, such as tax, accounting, consumer protection, fraud prevention, or recordkeeping obligations.

Legitimate interests

We may process data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Examples include service improvement, security monitoring, internal administration, and fraud detection. We assess these interests carefully and apply appropriate safeguards.

Consent

In certain situations, we may rely on your consent, for example where required for specific optional processing. Where consent is used, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Vital interests and public task

In rare cases, we may process personal data to protect someone’s vital interests or where processing is necessary for a task carried out in the public interest, if applicable under local law.

4. Data Sharing and Processors

We may share personal data with carefully selected third parties that assist us in operating our services. These third parties act as processors when they handle personal data on our behalf and under our instructions. They are required to maintain appropriate security and confidentiality measures.

Processors may include providers of:

payment processing;
information technology and hosting;
security and fraud prevention tools;
analytics and reporting services;
customer support systems;
document management and administrative services.

We may also disclose personal data where necessary to comply with legal obligations, respond to lawful requests by public authorities, protect our rights, or prevent harm. If a third party receives data as an independent controller, it will process the data in accordance with its own privacy obligations and applicable law.

We require our processors to enter into data processing agreements that include GDPR-compliant safeguards. These agreements define the purpose, scope, and duration of processing, as well as confidentiality, security, and sub-processing controls.

5. International Transfers

If personal data is transferred outside the European Economic Area, we will ensure that appropriate safeguards are in place. These safeguards may include adequacy decisions, Standard Contractual Clauses, or other lawful transfer mechanisms recognized under GDPR. We take reasonable steps to ensure that transferred data remains protected to a standard consistent with European data protection requirements.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, reporting, and operational requirements. The retention period may vary depending on the type of data, the reason for processing, and any applicable legal obligations.

In general, retention is determined by:

the length of our relationship with you;
whether legal or regulatory obligations require longer storage;
whether the data is needed for dispute resolution or enforcement;
whether the data is required for security, auditing, or fraud prevention.

When data is no longer needed, we will delete, anonymise, or securely archive it in accordance with our retention practices. We do not keep personal data indefinitely unless required by law or a valid business need.

7. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures may include access controls, encryption where appropriate, secure storage practices, staff confidentiality obligations, and regular security reviews.

While no system can be guaranteed to be completely secure, we work to maintain a level of security appropriate to the risk presented by the processing of personal data.

8. Your Rights Under GDPR

Depending on your location and the applicable law, you may have the following rights regarding your personal data:

Right of access – to request confirmation of whether we process your data and to obtain a copy of it.
Right to rectification – to correct inaccurate or incomplete data.
Right to erasure – to request deletion of your data in certain circumstances.
Right to restriction – to request limited processing in specific situations.
Right to data portability – to receive certain data in a structured, commonly used, machine-readable format and to request transmission to another controller where feasible.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

You also have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been infringed. If you exercise any of your rights, we may need to verify your identity before responding.

9. Cookies and Similar Technologies

Where applicable, we may use cookies or similar technologies to support essential functions, improve performance, and understand service usage. Any such use will be limited to what is lawful and necessary, and where required, we will rely on consent or other lawful grounds as appropriate.

Some technologies may be essential for service operation, while others may be used for analytics or functionality enhancement. You may be able to manage such settings through your browser or device preferences.

10. Children

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children in a manner that would violate applicable law. If we become aware that data has been collected from a child without a lawful basis, we will take steps to delete it or obtain the necessary authorisation where permitted.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our processing practices. Any updated version will take effect when made available. We encourage you to review this Policy periodically so that you remain informed about how we process personal data.

12. Scope of This Policy

This Privacy Policy applies to all customers in the relevant area and covers the personal data processed in connection with our services, operations, and legal obligations. It is intended to provide transparent information about how we handle personal data in a manner that is fair, lawful, and accountable.

Summary of principles:

we only collect data necessary for legitimate and lawful purposes;
we process data on an identified lawful basis;
we limit retention to what is necessary;
we use processors under appropriate safeguards;
we respect your rights under GDPR.

This Policy should be read as a general statement of privacy practices and does not override mandatory rights granted to you under applicable data protection law.