Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected in connection with our services. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR). By using our services, customers acknowledge that their personal data may be processed as described in this policy.

1. Scope of this Policy

This policy applies to all customers in the area, including individuals who use, purchase, access, or otherwise interact with our services. It covers personal data collected through direct interactions, automated technologies, service usage, and communications related to service delivery and administration.

We are committed to handling personal data fairly, lawfully, and transparently. We process only the data that is relevant and necessary for specified purposes and maintain appropriate safeguards to protect it.

2. Data Collection

We may collect the following categories of personal data:

Identity data such as name, title, and identifiers used to distinguish a customer.
Contact data such as address, email address, and phone number.
Transaction data such as records of purchases, service requests, billing details, and payment status.
Technical data such as device information, browser type, IP address, and usage logs.
Profile data such as preferences, feedback, service interests, and communication choices.
Correspondence data such as information provided in messages, inquiries, complaints, or support requests.

Personal data may be provided directly by customers or collected indirectly when services are used. In some cases, data may also be obtained from business partners, service providers, or publicly available sources where permitted by law.

We do not intentionally collect more information than is needed for the intended purpose.

3. Purposes of Processing

Personal data may be processed for the following purposes:

to provide, maintain, and improve services;
to manage customer accounts and transactions;
to communicate service updates, notices, and administrative information;
to respond to questions, requests, and complaints;
to comply with legal, regulatory, and accounting obligations;
to protect the security, integrity, and availability of our services;
to prevent fraud, misuse, or other harmful activities;
to analyse usage patterns and improve customer experience.

Personal data will not be used for incompatible purposes without a valid legal basis.

4. Lawful Basis for Processing

Under GDPR, we rely on one or more of the following lawful bases when processing personal data:

Contract

We process personal data where it is necessary to perform a contract with a customer or to take steps at the customer’s request before entering into a contract.

Legal Obligation

We may process personal data where necessary to comply with applicable laws, court orders, tax requirements, or other legal duties.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by the rights and freedoms of the customer. Legitimate interests may include service improvement, fraud prevention, internal administration, and safeguarding systems.

Consent

In certain situations, we may rely on consent, especially where the law requires it. Where consent is used as the basis for processing, customers may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Vital Interests

In rare cases, processing may be necessary to protect the vital interests of a customer or another person.

5. Disclosure and Processors

We may share personal data with third parties only when necessary and lawful. These third parties act either as processors or independent controllers depending on the circumstances.

Processors may include:

IT hosting and cloud service providers;
payment and billing providers;
customer relationship and support tools;
analytics and reporting services;
security and fraud prevention providers;
professional advisers and auditors where required.

Where a processor acts on our behalf, we ensure that appropriate contractual safeguards are in place. These safeguards require the processor to process data only on our instructions, maintain confidentiality, implement security measures, and assist us in responding to data protection obligations where applicable.

We may also disclose personal data where required by law, to respond to lawful requests from public authorities, or to protect rights, property, or safety.

We do not sell personal data as a general practice.

6. International Transfers

If personal data is transferred outside the European Economic Area or the United Kingdom, we will ensure that appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms recognised under GDPR.

Where such transfers occur, we take reasonable steps to ensure that the transferred data continues to receive a level of protection that is essentially equivalent to that required under applicable data protection law.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, accounting, tax, or reporting requirements.

Retention periods may depend on the nature of the data and the purpose of processing. In general, we consider the following factors when deciding how long to keep data:

the duration of the customer relationship;
statutory limitation periods;
legal and regulatory obligations;
the need to resolve disputes or enforce agreements;
the sensitivity and volume of the information.

When personal data is no longer required, it will be securely deleted, anonymised, or otherwise disposed of in a manner that prevents unauthorised use.

Retention is kept to the minimum period necessary for lawful and operational purposes.

8. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental loss, unlawful destruction, alteration, unauthorised access, or disclosure. These measures may include access controls, encryption, secure storage, role-based permissions, and monitoring of systems and records.

Although no system can be guaranteed to be fully secure, we continually review and improve our safeguards to reduce risk and protect customer information.

9. User Rights

Customers have rights under GDPR in relation to their personal data. Subject to legal conditions and exceptions, these rights include:

The right of access to obtain confirmation about whether personal data is processed and to receive a copy of that data.
The right to rectification to request correction of inaccurate or incomplete information.
The right to erasure to request deletion of personal data in certain circumstances.
The right to restrict processing to limit how personal data is used in particular situations.
The right to data portability to receive data in a structured, commonly used, machine-readable format and, where feasible, transmit it to another controller.
The right to object to processing based on legitimate interests or direct marketing, where applicable.
The right to withdraw consent where processing relies on consent.
The right not to be subject to automated decision-making where such processing produces legal or similarly significant effects, unless permitted by law.

Customers may also have the right to lodge a complaint with the relevant data protection authority if they believe their rights have been violated.

We encourage customers to review the information provided and exercise their rights where appropriate.

10. Data Accuracy and Customer Responsibilities

Customers should provide accurate and up-to-date personal data and inform us of changes where necessary. Maintaining correct information helps us deliver services efficiently and reduce errors.

Where customers submit information on behalf of others or provide references to third parties, they should ensure that they have the necessary authority and that any disclosure is lawful.

11. Children’s Data

Our services are not directed at children, and we do not knowingly collect personal data from children without appropriate legal basis and consent where required. If we become aware that personal data has been collected unlawfully from a child, we will take steps to delete it or otherwise handle it in accordance with legal obligations.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our processing activities, or operational requirements. Any revised version will apply from the date it is made effective. Customers are encouraged to review the policy periodically to remain informed about how personal data is handled.

13. Final Statement

This Privacy Policy is intended to provide a clear and lawful explanation of how personal data is handled for all customers in the area. We are committed to respecting privacy, using data responsibly, and complying with GDPR principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

By continuing to use our services, customers acknowledge that their personal data may be processed in accordance with this Privacy Policy and applicable law.