Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected. It applies to all customers in the area and reflects the requirements of the General Data Protection Regulation (GDPR). We are committed to handling personal data lawfully, fairly, and transparently, while respecting the rights and freedoms of individuals.

1. Who This Policy Applies To

This Policy applies to all customers in the area, including individuals who interact with our services, make inquiries, purchase products, or otherwise provide personal data in connection with our activities. It also applies to any personal data processed in the course of providing services, managing customer relationships, improving operations, and meeting legal or regulatory obligations.

2. Personal Data We Collect

We may collect and process different categories of personal data depending on the nature of the relationship and the services requested. The types of data may include:

Identity data such as name, title, and date of birth where relevant.
Contact data such as postal address, email address, and telephone number.
Account and transaction data such as purchase history, service records, payment confirmations, and account preferences.
Technical data such as device information, IP address, browser type, and usage data.
Communication data such as messages, requests, feedback, complaints, and correspondence history.
Preference data relating to services, communication choices, and consent settings.

We generally collect personal data directly from individuals. In some cases, data may also be collected from third parties where lawful and appropriate, such as service providers, payment processors, public sources, or partners involved in fulfilling a request.

3. How We Use Personal Data

Personal data is used only where we have a valid legal basis and where the use is necessary for a specific and legitimate purpose. We may process personal data for the following purposes:

To provide, maintain, and manage services or customer accounts.
To process orders, payments, refunds, and related administrative tasks.
To communicate with customers about service updates, requests, or support matters.
To improve service quality, user experience, and internal operations.
To comply with legal obligations, tax rules, and regulatory requirements.
To prevent fraud, misuse, or unauthorized access.
To establish, exercise, or defend legal claims where needed.

We do not use personal data in ways that are incompatible with the original purpose for which it was collected unless a lawful basis applies and individuals are informed where required.

4. Lawful Basis for Processing

Under GDPR, personal data must be processed on a lawful basis. Depending on the circumstances, we rely on one or more of the following legal bases:

Performance of a contract – when processing is necessary to provide a product or service, manage requests, or fulfill contractual obligations.
Legal obligation – when processing is required to meet tax, accounting, consumer protection, or other legal requirements.
Legitimate interests – when processing is necessary for our legitimate business interests, provided those interests are not overridden by the individual’s rights and freedoms. This may include service improvement, fraud prevention, and operational administration.
Consent – when explicit permission is required, such as for certain marketing or optional processing activities. Consent may be withdrawn at any time.
Vital interests – in rare situations where processing is necessary to protect someone’s life or safety.
Public task – where processing is necessary for an official function carried out in the public interest, if applicable.

We will always aim to identify and document the lawful basis before processing personal data.

5. Sharing and Processors

We may share personal data with trusted third parties only where necessary and proportionate. These third parties may act as processors or, in some cases, independent controllers. Processors handle personal data on our behalf and only under documented instructions.

Examples of processors may include:

IT and hosting providers.
Payment processing services.
Customer support systems.
Data storage and backup providers.
Analytics or security service providers.
Professional advisers supporting compliance, finance, or legal matters.

Where processors are engaged, we ensure they are bound by appropriate contractual terms, including obligations to keep data secure, process it only for specified purposes, and support compliance with GDPR. We do not permit processors to use personal data for their own unrelated purposes.

In limited circumstances, personal data may also be shared with public authorities, regulators, law enforcement, or courts where required by law or where disclosure is necessary to protect rights, safety, or legitimate interests.

6. International Transfers

If personal data is transferred outside the European Economic Area, we will ensure appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, or other legally recognized mechanisms. The goal is to maintain a level of protection equivalent to that required under GDPR.

7. Data Retention

We retain personal data only for as long as necessary to achieve the purposes for which it was collected, including satisfying legal, accounting, reporting, or dispute-resolution obligations. Retention periods are determined by considering the type of data, the purpose of processing, the nature of the relationship, legal requirements, and the risks associated with keeping the data longer than needed.

In practice, this means that data may be kept for the duration of a customer relationship and for a reasonable period afterward to meet statutory obligations or defend legal claims. When personal data is no longer required, it will be securely deleted, anonymized, or otherwise disposed of in a safe and lawful manner.

We apply retention limits so that personal data is not held indefinitely without purpose.

8. Security of Personal Data

We use appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff confidentiality obligations, and regular review of security practices.

Although no system can be guaranteed to be completely secure, we take reasonable steps to reduce risk and respond promptly to incidents affecting personal data.

9. Your Rights Under GDPR

Individuals whose data is processed under this Policy have rights under GDPR. Depending on the circumstances, these may include:

The right to be informed – to know how personal data is collected and used.
The right of access – to request confirmation and a copy of personal data held about you.
The right to rectification – to request correction of inaccurate or incomplete data.
The right to erasure – to request deletion of personal data in certain situations.
The right to restrict processing – to limit how data is used in certain cases.
The right to data portability – to receive certain data in a structured, commonly used format and, where feasible, have it transmitted to another controller.
The right to object – to object to processing based on legitimate interests or direct marketing.
Rights related to automated decision-making – to not be subject to decisions based solely on automated processing where such rights apply.

Where processing is based on consent, individuals also have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

We may need to verify identity before responding to rights requests to help protect personal data.

10. Exercising Your Rights

Requests to exercise data protection rights will be handled in accordance with GDPR. We will respond within the legal timeframes and may extend the period where requests are complex or multiple. If a request cannot be fully fulfilled, we will explain the reason where permitted by law.

There is usually no fee for making a rights request unless it is manifestly unfounded, excessive, or repetitive. We may request additional information to confirm identity and ensure the request is properly directed.

11. Children’s Data

Where services are not intended for children, we do not knowingly collect personal data from children without appropriate authorization or legal basis. If we become aware that data has been collected inappropriately, we will take steps to delete it or obtain the necessary permissions where lawful.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service arrangements. When changes are made, the updated version will replace the previous one from the effective date onward. We encourage individuals to review this Policy periodically to remain informed about how personal data is handled.

Summary of Our Commitment

We only process personal data when we have a lawful basis, we limit retention to what is necessary, we use processors carefully, and we respect the rights of individuals. This Policy is designed to ensure GDPR-compliant handling of personal data for all customers in the area.