Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, and shared in connection with our services. It applies to all customers in the area where our services are offered. We are committed to protecting personal data and handling it in a lawful, fair, and transparent manner in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

1. Data We Collect

We may collect and process the following categories of personal data, depending on how you interact with us and the services you use:

Identity data: name, title, and similar identifiers.
Contact data: address, email address, telephone number, and other communication details.
Transaction data: records of services purchased, orders placed, payments made, and related billing details.
Technical data: IP address, device type, browser type, operating system, and other technology identifiers.
Usage data: information about how you use our services, preferences, and interaction history.
Communication data: messages, requests, complaints, and any correspondence you send to us.
Marketing preferences: your choices regarding receiving promotional communications.

We do not intentionally collect special category data unless it is necessary for a specific lawful purpose and permitted by law. Where such data is required, we will only process it with an appropriate lawful basis and additional safeguards.

2. How We Use Personal Data

We use personal data for the following purposes:

to provide and manage our services;
to process transactions and deliver requested products or services;
to communicate with customers about accounts, orders, or service updates;
to improve our services, systems, and customer experience;
to maintain security, prevent fraud, and detect misuse;
to comply with legal and regulatory obligations;
to send marketing information where permitted and where you have the right to opt out;
to resolve disputes and enforce our terms and agreements.

We only process personal data when we have a valid lawful basis to do so.

3. Lawful Basis for Processing

Under GDPR, we rely on one or more of the following lawful bases:

Performance of a Contract

We process personal data where it is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract. This includes providing services, processing orders, and managing customer accounts.

Legal Obligation

We may process personal data where it is necessary to comply with legal or regulatory requirements, such as accounting, tax, consumer protection, or record-keeping obligations.

Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests and where those interests are not overridden by your rights and freedoms. Examples include service improvement, fraud prevention, network and information security, and business administration. When relying on legitimate interests, we assess the impact on your privacy and apply appropriate safeguards.

Consent

We may rely on your consent for certain activities, such as sending optional marketing communications or using non-essential cookies or similar technologies where required by law. Where consent is used, you may withdraw it at any time without affecting the lawfulness of processing based on consent before withdrawal.

4. Sharing and Processors

We may share personal data with trusted third parties that act as processors on our behalf. These processors only process data according to our instructions and are required to protect it appropriately. Examples of processors may include:

payment service providers;
IT hosting and cloud service providers;
customer support tools;
analytics and performance providers;
professional advisers such as auditors, lawyers, or accountants;
delivery or logistics providers where relevant to service fulfilment.

We may also disclose personal data if required by law, court order, or a competent authority, or where necessary to protect our rights, users, staff, or the public. If personal data is transferred outside the European Economic Area, we will ensure appropriate safeguards are in place, such as standard contractual clauses or equivalent legal mechanisms.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for legal, accounting, or reporting requirements. Retention periods vary depending on the type of data and the reason for processing.

In general, we consider the following when determining retention periods:

the duration of our relationship with you;
the nature and sensitivity of the data;
applicable legal or regulatory retention requirements;
the need to resolve disputes or enforce agreements;
whether the data is needed for security, audit, or fraud prevention.

When personal data is no longer required, it will be securely deleted, anonymised, or archived in a manner that prevents use for active business purposes. We do not keep data longer than necessary.

6. Your Rights Under GDPR

Depending on the legal basis for processing and your location, you may have the following rights in relation to your personal data:

Right of access: you may request confirmation of whether we process your data and receive a copy of it.
Right to rectification: you may ask us to correct inaccurate or incomplete data.
Right to erasure: you may ask us to delete your data in certain circumstances.
Right to restriction: you may ask us to limit processing in certain cases.
Right to data portability: you may request your data in a structured, commonly used, machine-readable format where applicable.
Right to object: you may object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent: where processing is based on consent, you may withdraw consent at any time.
Right not to be subject to automated decisions: you may have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise your rights, you may submit a request through the relevant service channels provided to you. We may need to verify your identity before responding. We aim to respond within the time limits required by law.

7. Security of Personal Data

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, misuse, alteration, or disclosure. These measures may include access controls, encryption, staff training, secure storage, and monitoring procedures. While we work to protect your data, no system is completely secure, and we cannot guarantee absolute security.

8. Children’s Data

Our services are not intended for children unless explicitly stated otherwise. We do not knowingly collect personal data from children without lawful authority or the required parental or guardian consent where applicable. If we become aware that data has been collected unlawfully, we will take appropriate steps to delete it.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or how we process personal data. The updated version will apply from the date it is published or otherwise communicated. We encourage you to review this policy periodically to remain informed about how we protect your data.

10. Scope and Applicability

This Privacy Policy applies to all customers in the area served by our operations, regardless of how the services are accessed or purchased. By using our services, you acknowledge that your personal data may be processed in accordance with this policy and applicable law.

Summary of key commitments:

we collect only the data needed for lawful business purposes;
we process data under valid GDPR lawful bases;
we share data only with authorised processors and where legally required;
we retain data only as long as necessary;
we respect and support your data protection rights.

By continuing to use our services, you acknowledge the processing practices described in this Privacy Policy, subject always to your rights under applicable data protection law.