Privacy Policy

This Privacy Policy explains how personal data is collected, used, shared, and protected when services are provided to customers in the relevant area. It applies to all customers in the area and is intended to reflect the principles of the General Data Protection Regulation (GDPR). By using our services or interacting with us, you acknowledge that your personal data may be processed as described below.

1. Data We Collect

We collect only the personal data that is necessary for legitimate business and compliance purposes. Depending on how you interact with us, this may include:

• Identity data: name, title, and similar identifying information.
• Contact data: address, email address, telephone number, and preferred communication details.
• Account and transaction data: service records, payment-related information, order history, and customer service records.
• Technical data: IP address, browser type, device information, operating system, and usage logs.
• Communication data: messages, feedback, complaint details, and correspondence.
• Preference data: service choices, language preferences, and marketing preferences where applicable.

We do not intentionally collect special category data unless it is strictly required, permitted by law, or explicitly provided for a specific purpose. Where such data is processed, we apply enhanced safeguards and process it only when a lawful basis exists.

2. How We Use Personal Data

We use personal data for the following purposes:

• to provide and manage our services;
• to communicate with customers and respond to enquiries;
• to process transactions and maintain records;
• to improve service quality, security, and performance;
• to monitor compliance with legal and contractual obligations;
• to detect, prevent, and investigate fraud, misuse, or security incidents;
• to send essential service-related notices;
• to carry out internal reporting, analytics, and business administration.

We will not use personal data in a manner that is incompatible with the purposes for which it was collected unless we have a lawful basis for doing so.

3. Lawful Basis for Processing

Under GDPR, we process personal data only where a lawful basis applies. Depending on the context, our lawful bases may include:

Contract

We process data where it is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract. This may include delivering services, handling payments, and managing customer accounts.

Legal Obligation

We may process data when necessary to comply with legal and regulatory requirements, including accounting, tax, record-keeping, fraud prevention, and other obligations imposed by applicable law.

Legitimate Interests

We may process data where it is necessary for our legitimate interests, provided that those interests are not overridden by your rights and freedoms. These interests may include improving our services, maintaining system security, preventing fraud, and managing our relationship with customers. Where we rely on this basis, we consider whether the processing is proportionate and whether your privacy expectations are respected.

Consent

Where required, we rely on your consent, for example for certain marketing communications or optional data processing. You may withdraw consent at any time, and this will not affect the lawfulness of processing carried out before withdrawal.

Vital Interests and Public Task

In limited cases, we may process personal data to protect vital interests or where processing is necessary for a task carried out in the public interest, in accordance with applicable law.

4. Data Sharing and Processors

We may share personal data with trusted third parties who act as processors or, where applicable, independent controllers. Processors are only permitted to process data on our instructions and must protect it in line with GDPR requirements.

Examples of processors and recipients may include:

• IT and hosting providers that store and secure data infrastructure;
• payment service providers that handle payment processing;
• customer support tools that help manage communications;
• analytics and monitoring providers that assist with performance and security;
• professional advisers such as auditors, legal advisers, and accountants;
• public authorities where disclosure is required by law or necessary for legal claims.

Whenever processors are engaged, we use appropriate contractual safeguards, including data processing agreements, confidentiality obligations, and security requirements. We do not sell personal data.

5. International Transfers

If personal data is transferred outside the European Economic Area or to a country not deemed adequate by the European Commission, we ensure that appropriate safeguards are in place. These may include standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms permitted under GDPR. We assess transfer risks and apply additional protections where necessary.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. Retention periods depend on the nature of the data, the purpose of processing, and applicable legal obligations.

In general:

• contractual and transactional records are kept for the period required to administer the relationship and meet legal obligations;
• communication records are kept for a reasonable period to manage enquiries, complaints, or disputes;
• technical and security logs are kept for a limited period unless longer retention is needed for investigation or compliance;
• where data is processed on consent, it is retained until consent is withdrawn or the purpose ends.

When data is no longer required, we will delete it or anonymise it securely.

7. Data Security

We implement appropriate technical and organisational measures to protect personal data against accidental loss, unlawful destruction, unauthorised access, alteration, or disclosure. These measures may include access controls, encryption, secure storage, monitoring, staff training, and incident response procedures. While no system can be guaranteed completely secure, we take reasonable steps to protect information in line with the risk involved.

8. Your Rights Under GDPR

Depending on your circumstances and the legal basis for processing, you may have the following rights:

• Right of access: to obtain confirmation and a copy of your personal data;
• Right to rectification: to correct inaccurate or incomplete data;
• Right to erasure: to request deletion of your data in certain circumstances;
• Right to restriction: to request limited processing in certain situations;
• Right to data portability: to receive certain data in a structured, commonly used format;
• Right to object: to object to processing based on legitimate interests or direct marketing;
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time;
• Right not to be subject to automated decision-making: to the extent applicable under GDPR.

We may need to verify your identity before responding to certain requests. In some cases, these rights may be limited by law, for example where retaining data is necessary for compliance, legal claims, or public interest reasons.

9. Children’s Data

Our services are not intended to be directed to children unless stated otherwise by applicable local rules. We do not knowingly collect personal data from children without appropriate authority, consent, or another valid lawful basis where required. If we become aware that data has been collected inappropriately, we will take steps to delete it or obtain the necessary authorisation.

10. Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects unless permitted by law and accompanied by appropriate safeguards. If such processing is used, we will provide meaningful information about the logic involved and your available rights where required.

11. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, processing practices, or service arrangements. When updates are made, the revised version will apply from the date of publication or other stated effective date. We encourage customers to review this policy periodically so they remain informed about how personal data is handled.

12. Key Principles

This policy is built around core GDPR principles, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability. We aim to process personal data in a way that is fair, proportionate, and respectful of individual rights.

Important: This Privacy Policy applies to all customers in the area and governs the processing of personal data in connection with services provided there. By continuing to use the services, you acknowledge that you have read and understood this policy.