Privacy Policy -

This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected in connection with the services offered to all customers in the area. It is intended to be GDPR-compliant and to provide clear information about the rights and choices available to individuals whose data is processed. By using the services, customers acknowledge that personal data may be processed in accordance with this Policy and applicable data protection laws.

1. Scope of this Privacy Policy

This Policy applies to all customers in the area, including prospective customers, active customers, and former customers whose personal data may be retained for legal, accounting, or operational purposes. It covers personal data collected through direct interactions, service use, account management, communications, payment-related activities, customer support, and other business operations.

For the purposes of this Policy, personal data means any information relating to an identified or identifiable natural person. This may include names, contact details, account identifiers, transaction details, service preferences, and any other information that can reasonably be linked to a person. Special category data is not intentionally collected unless strictly necessary and permitted by law.

2. Data We Collect

We may collect and process different categories of personal data depending on the nature of the relationship and the services provided. The main categories include:

2.1 Information provided directly by customers

Identification data: name, title, and other basic identity details.
Contact data: address, telephone number, and email address where provided.
Account and service data: account preferences, service requests, and customer records.
Communication data: messages, complaints, feedback, survey responses, and support interactions.
Payment and transaction data: invoicing details, payment status, and transaction references where applicable.

2.2 Information collected automatically

Technical data: device type, browser type, operating system, and connection information.
Usage data: records of interactions with services, pages viewed, features used, and timestamps.
Security data: logs and system events used for fraud prevention, troubleshooting, and security monitoring.

2.3 Information from third parties

We may receive personal data from service providers, payment handlers, public sources, verification partners, or other third parties where lawful and appropriate. Such data may be used to verify identity, complete transactions, prevent fraud, comply with legal obligations, or improve service delivery. We only collect data from third parties where there is a lawful basis and where the transfer is permitted by applicable law.

3. How We Use Personal Data

Personal data is processed for specific, explicit, and legitimate purposes. These may include:

providing and managing services to customers;
creating and maintaining customer records;
processing transactions and related administrative tasks;
responding to enquiries, complaints, and support requests;
ensuring security, preventing fraud, and detecting misuse;
complying with legal, regulatory, and tax obligations;
performing internal reporting, auditing, and business administration;
sending service-related notices and important updates;
improving service quality, operations, and customer experience.

We do not process personal data in a way that is incompatible with the original purpose unless such further processing is lawful under the GDPR and applicable local requirements.

4. Lawful Basis for Processing

Under the GDPR, every processing activity must rely on a lawful basis. Depending on the context, we may process personal data on one or more of the following bases:

Contract: processing is necessary to enter into or perform a contract with a customer.
Legal obligation: processing is necessary to comply with legal or regulatory requirements.
Legitimate interests: processing is necessary for our legitimate business interests, provided these interests are not overridden by the customer’s rights and freedoms. This may include fraud prevention, security, and service improvement.
Consent: where required, processing is based on freely given, specific, informed, and unambiguous consent. Customers may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Vital interests: in rare cases, processing may be necessary to protect someone’s vital interests.

Where we rely on legitimate interests, we balance those interests against the privacy impact on individuals and limit processing to what is necessary and proportionate.

5. Data Sharing and Processors

We may share personal data with carefully selected processors and other recipients only where necessary and lawful. Processors act on our instructions and are bound by contracts that require them to protect personal data, process it only for specified purposes, and implement appropriate security measures.

Examples of processors or service categories may include:

IT and cloud hosting providers;
payment and billing service providers;
customer support and communication platforms;
security, fraud-prevention, and monitoring services;
professional advisers such as auditors, legal advisers, or accountants where necessary.

We may also disclose personal data where required by law, court order, lawful request from public authorities, or to establish, exercise, or defend legal claims. Where personal data is transferred outside the European Economic Area, appropriate safeguards will be used in accordance with the GDPR, such as adequacy decisions, standard contractual clauses, or other permitted transfer mechanisms.

6. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, accounting, and reporting requirements. Retention periods vary depending on the type of data, the nature of the relationship, and any statutory obligations.

In determining retention periods, we consider:

the duration of the customer relationship;
legal limitation periods;
tax and accounting requirements;
security and fraud-prevention needs;
whether data is needed for dispute resolution or regulatory compliance.

When personal data is no longer required, it will be securely deleted, anonymised, or archived in a manner that prevents further identification, unless continued retention is required by law. Retention is always limited to what is necessary and proportionate.

7. Data Security

Appropriate technical and organisational measures are used to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff training, monitoring, and periodic review of security practices. Although no system can be guaranteed to be completely secure, reasonable steps are taken to reduce risk and protect customer data.

8. User Rights Under GDPR

Individuals whose data is processed have a number of rights under the GDPR. These rights apply subject to legal limitations and may depend on the specific circumstances of the processing. Customers may have the right to:

Access personal data and receive information about how it is processed;
Rectification of inaccurate or incomplete data;
Erasure of personal data in certain situations, also known as the right to be forgotten;
Restriction of processing in specific circumstances;
Data portability for data provided by the individual and processed by automated means on the basis of consent or contract;
Object to processing based on legitimate interests and to direct marketing where applicable;
Withdraw consent at any time where consent is the lawful basis;
Not be subject to solely automated decision-making that has legal or similarly significant effects, where applicable.

To exercise these rights, individuals may make a request using the channels provided by the organisation. We may need to verify identity before responding. Requests are handled within the timeframes required by the GDPR, generally within one month, unless an extension is permitted due to complexity or number of requests.

9. Complaints and Supervisory Authority

If an individual believes that personal data has been processed unlawfully or that their rights have not been respected, they may lodge a complaint with the relevant data protection authority in their country of residence, place of work, or place of the alleged infringement. They may also seek further remedies under applicable law. We encourage individuals to raise concerns so that we can address them promptly and fairly.

10. Updates to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in legal requirements, operational practices, or service offerings. Any revised version will apply from the date it is published or otherwise communicated. Customers are encouraged to review this Policy periodically to remain informed about how personal data is protected and processed.

In summary: personal data is collected only for legitimate and lawful purposes, processed under an appropriate lawful basis, retained only as long as necessary, shared only with compliant processors or where legally required, and protected with appropriate safeguards. This Policy applies to all customers in the area and is designed to support transparency, fairness, and accountability under the GDPR.