Privacy Policy

This Privacy Policy explains how personal data is collected, used, shared, retained, and protected in connection with our services. It applies to all customers in area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws. Please read this policy carefully to understand how we handle your information and what rights you have.

1. Introduction

We are committed to respecting your privacy and protecting the personal data you provide to us. Personal data means any information relating to an identified or identifiable person, such as a name, email address, identification number, location data, or online identifier. This policy describes the types of data we may collect, the reasons for processing it, the legal grounds on which we rely, how long we keep it, and the circumstances in which it may be shared with third parties.

By using our services, you acknowledge that your personal data may be processed as described in this policy. We only process personal data when there is a lawful basis to do so and only for clear, legitimate purposes.

2. Data Collection

We may collect personal data directly from you, automatically from your device, or from third parties where permitted by law. The exact data collected depends on how you interact with us and the services you use.

Categories of personal data we may collect

Identity data: name, username, title, and similar identifying information.
Contact data: address, email address, and telephone number.
Transaction data: payment-related details, records of purchases, and service history.
Technical data: internet protocol address, browser type, device identifiers, operating system, and log information.
Usage data: information about how you use our services, pages viewed, and interaction patterns.
Communication data: messages, inquiries, complaints, and feedback you submit.
Preference data: communication preferences and marketing choices.

We may also collect limited data through cookies and similar technologies where necessary for functionality, analytics, or security. Where required by law, we will obtain your consent before placing non-essential cookies.

3. Purposes of Processing

We process personal data for specific and legitimate purposes, including:

providing and managing our services;
creating and maintaining customer accounts;
processing transactions and fulfilling requests;
communicating with you about service updates, support, and administrative matters;
ensuring security, preventing fraud, and detecting misuse;
improving our services, systems, and user experience;
meeting legal, tax, regulatory, and accounting obligations;
handling disputes, complaints, or claims;
sending marketing communications where permitted by law and, if required, with consent.

We do not process personal data in a way that is incompatible with these purposes unless we are otherwise permitted or required to do so by law.

4. Lawful Basis for Processing

Under GDPR, every processing activity must have a lawful basis. Depending on the context, we rely on one or more of the following legal grounds:

Performance of a contract: where processing is necessary to provide services or take steps at your request before entering into a contract.
Legal obligation: where processing is required to comply with applicable laws, regulations, or official requests.
Legitimate interests: where we process data for our legitimate business interests, provided these interests are not overridden by your rights and freedoms. Examples include service improvement, fraud prevention, network security, and internal administration.
Consent: where you have given clear consent for a specific purpose, such as certain marketing activities or non-essential cookies. You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
Vital interests: in rare cases where processing is necessary to protect someone’s life or physical safety.

When we rely on legitimate interests, we assess the impact on your rights and ensure appropriate safeguards are in place. Where consent is required, it will be freely given, specific, informed, and unambiguous.

5. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, reporting, and dispute-resolution requirements. The retention period varies depending on the type of data, the reason for processing, and any legal obligations that apply.

In general:

account and service data are retained for the duration of the customer relationship and for a reasonable period thereafter;
transaction records may be retained for tax and accounting purposes for the period required by law;
communications and support records may be kept to resolve queries and maintain service history;
technical and security logs are retained for a limited period unless longer retention is necessary for security or legal reasons.

When data is no longer required, we will delete it, anonymise it, or securely archive it in accordance with our retention procedures. We do not retain personal data indefinitely.

6. Processors and Data Sharing

We may share personal data with trusted third parties acting as data processors or, in some cases, as independent controllers. Processors only process personal data on our instructions and are bound by written agreements requiring them to protect data appropriately and process it only for specified purposes.

Types of processors we may use

IT and hosting providers: to store and support systems and infrastructure.
Payment service providers: to process payments and related financial transactions.
Customer support tools: to manage communications and service requests.
Analytics providers: to help us understand service usage and performance.
Security providers: to detect threats, prevent fraud, and protect systems.
Professional advisers: such as lawyers, auditors, and accountants where necessary.

We may also disclose personal data where required by law, court order, or regulatory request, or where necessary to establish, exercise, or defend legal claims. If personal data is transferred outside the European Economic Area, we will ensure appropriate safeguards are in place, such as an adequacy decision or standard contractual clauses, and we will assess the transfer risks as required.

7. Security Measures

We take appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, encryption, monitoring, secure storage, staff training, and regular reviews of our security practices. While no system can be guaranteed completely secure, we work to maintain a level of protection that is appropriate to the risks involved.

8. Your Rights Under GDPR

Subject to legal limitations, you have the following rights regarding your personal data:

Right of access: to obtain confirmation about whether we process your data and receive a copy of it.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to ask us to delete data in certain circumstances, also known as the right to be forgotten.
Right to restriction: to request limited processing in certain situations.
Right to data portability: to receive data in a structured, commonly used, machine-readable format and, where technically feasible, have it transferred to another controller.
Right to object: to object to processing based on legitimate interests or to direct marketing at any time.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
Right not to be subject to automated decision-making: to avoid decisions based solely on automated processing where such decisions have legal or similarly significant effects, unless permitted by law.

To exercise your rights, you may submit a request using the available channels for customer support or data protection enquiries. We may need to verify your identity before responding to ensure your data is not disclosed to the wrong person. We will respond within the time limits required by GDPR, normally within one month, unless an extension is lawfully justified.

9. Marketing Preferences

Where permitted by law, we may send marketing communications about services, offers, or updates that may be of interest to you. You can opt out of marketing at any time, and we will honour your preferences promptly. Even if you opt out of marketing, we may still send essential service or transactional communications where necessary.

10. Children’s Data

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children without appropriate authorisation or consent where required by law. If we become aware that children’s data has been collected inappropriately, we will take steps to delete it or obtain the necessary authorisation.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, technical, or business developments. Any updated version will take effect when published or otherwise communicated. We encourage you to review this policy periodically so that you remain informed about how we protect your data.

12. Final Statement

This Privacy Policy is designed to provide transparent information about our data practices and your rights under GDPR. We are committed to processing personal data fairly, lawfully, and securely, and to ensuring that all customers in area receive the same high standard of data protection. Your privacy matters, and we will continue to safeguard your personal data with care and accountability.