Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected in connection with services offered to customers in the relevant area. It applies to all customers in that area, regardless of whether they access the service directly, create an account, make a purchase, or otherwise interact with the service. We are committed to handling personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR), and to processing data in a fair, transparent, and secure manner.

1. Scope and purpose

This policy describes the categories of personal data we may process, the purposes for which we use that data, the legal bases on which we rely, how long we retain it, the categories of recipients and processors that may handle it on our behalf, and the rights available to individuals under data protection law. It is intended to provide clear information about our privacy practices in a concise and accessible format.

2. Data we collect

We may collect and process personal data that you provide directly, data generated through your use of our services, and data obtained from third parties where permitted by law. The types of data may include:

Identification data, such as name or user identifier;
Contact data, such as postal address or email-related identifiers used for service administration;
Transaction data, including records of purchases, payments, refunds, and service requests;
Technical data, such as device type, browser information, IP address, and log data;
Usage data, including how you interact with our services, features used, and preferences;
Communication data, such as information included in support inquiries, complaints, or feedback;
Consent records, where we are required to document your choices regarding certain processing activities.

We do not intentionally collect special categories of personal data unless this is necessary for a specific lawful purpose and permitted by law. Where such processing is required, additional safeguards will be applied.

3. How we use personal data

Personal data may be used for the following purposes:

To provide, operate, and maintain services;
To process transactions and manage billing or account administration;
To communicate service-related information and respond to inquiries;
To improve service performance, usability, and security;
To detect and prevent fraud, abuse, or unauthorized activity;
To comply with legal, regulatory, and contractual obligations;
To establish, exercise, or defend legal claims;
To send non-marketing or, where permitted, marketing communications;
To analyse trends and support internal reporting.

We will only process personal data where such processing is necessary and proportionate to the stated purpose. Where possible, data is minimised to the smallest amount needed.

4. Lawful basis for processing

Under GDPR, we must have a valid lawful basis for each processing activity. Depending on the circumstances, we may rely on one or more of the following bases:

Performance of a contract — where processing is necessary to provide services, fulfil obligations, or take steps at your request before entering into a contract;
Legal obligation — where processing is required to comply with applicable laws, tax rules, accounting obligations, or lawful requests from public authorities;
Legitimate interests — where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Examples may include service improvement, security, fraud prevention, and internal administration;
Consent — where you have given clear permission for specific processing, such as certain marketing or optional data uses. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
Vital interests — in rare cases where processing is necessary to protect someone’s life;
Public task — where applicable and relevant to services carried out in the public interest.

When we rely on legitimate interests or consent, we aim to ensure that individuals are given clear notice and, where required, meaningful choices.

5. Retention of personal data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting, tax, reporting, and dispute-resolution requirements. Retention periods may vary depending on the type of data and the reason for processing.

Retention criteria

Contractual necessity: data is kept for the duration of the contractual relationship and for a reasonable period afterwards;
Legal requirements: some records must be retained for statutory periods;
Operational needs: certain technical and security logs may be retained for shorter periods to maintain system integrity;
Dispute handling: records may be kept longer where needed to resolve complaints, claims, or litigation;
Consent-based processing: data processed on the basis of consent is retained until consent is withdrawn or the purpose ends, unless longer retention is required by law.

When personal data is no longer needed, it is securely deleted, anonymised, or otherwise rendered unreadable.

6. Processors and recipients

We may share personal data with trusted third parties that act as processors or, in some cases, as independent controllers. Processors only process data on our documented instructions and are contractually required to maintain confidentiality and implement appropriate technical and organisational security measures.

Categories of processors may include:

IT and hosting providers, including cloud infrastructure and data storage services;
Payment service providers, where payment processing is required;
Customer support tools, used to manage service requests and communications;
Analytics and reporting providers, used to measure service performance and improve operations;
Security and fraud prevention providers, used to help protect systems and users;
Professional advisers, such as legal, audit, or accounting advisers, where necessary;
Public authorities, where disclosure is required by law or a lawful request.

Where personal data is transferred outside the European Economic Area or the United Kingdom, appropriate safeguards will be used, such as standard contractual clauses or other legally recognized transfer mechanisms.

7. Data security

We apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures may include access controls, encryption, monitoring, secure storage, and staff training. While no system is completely secure, we continuously review and improve our safeguards to reduce risk.

8. Your rights under GDPR

Depending on your circumstances and the legal basis for processing, you may have the following rights:

Right of access — to obtain confirmation and a copy of your personal data;
Right to rectification — to correct inaccurate or incomplete data;
Right to erasure — to request deletion of personal data in certain situations;
Right to restriction — to limit how data is processed in certain cases;
Right to data portability — to receive certain data in a structured, commonly used, machine-readable format and, where feasible, have it transferred to another controller;
Right to object — to object to processing based on legitimate interests and to direct marketing at any time;
Right to withdraw consent — where processing is based on consent;
Right not to be subject to automated decision-making — including profiling, where such decisions produce legal or similarly significant effects, except where permitted by law.

You also have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been infringed. Exercising your rights will not usually result in any charge, although requests that are manifestly unfounded or excessive may be limited in accordance with applicable law.

9. Children’s data

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children without appropriate authorisation or consent where required by law. If we become aware that personal data has been collected from a child in breach of applicable requirements, we will take steps to delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect legal, operational, or technological changes. When changes are made, the updated version will apply to all customers in the relevant area from the effective date shown in the revised policy. Continued use of the services after an update indicates acknowledgment of the current version, to the extent permitted by law.

Last updated: This policy should be reviewed periodically to ensure it remains accurate, complete, and aligned with GDPR requirements.