Privacy Policy -

This Privacy Policy explains how we collect, use, retain and share personal data relating to individuals who are customers in the area. This policy applies to all customers in the area and describes the legal bases on which we process personal data under the General Data Protection Regulation (GDPR). We are committed to protecting your privacy and ensuring that your personal data is processed in a transparent, lawful and secure manner.

1. Scope and Applicability

This Privacy Policy applies to all customers in the area, including prospective, current and former customers, and to personal data collected in connection with our products, services, transactions, support interactions and communications. It covers personal data processed in physical, electronic and verbal formats.

2. Categories of Personal Data We Collect

We collect and process the following categories of personal data as necessary for the provision of our services and for compliance with legal obligations:

Identity and contact data: name, address, email address, telephone number, and other identifiers provided by the customer.
Transactional data: records of products or services purchased, billing and payment details, invoices, and order history.
Financial data: bank account or payment card details where necessary to process payments and refunds.
Technical data: device identifiers, IP addresses, browser and operating system information, and usage logs when using online interfaces.
Customer service data: records of communications with customer support, including emails, chat transcripts and notes.
Marketing and preference data: communication preferences and consent records.
Special categories of data: we do not routinely collect special category data (sensitive data). If we do so in specific circumstances, we will only process it with explicit consent or other lawful basis permitted by law and with appropriate safeguards.

3. Purposes of Processing and Lawful Bases

We process personal data for specific, explicit and legitimate purposes. For each purpose we rely on one or more lawful bases under the GDPR:

To perform and manage contracts: processing necessary to enter into or perform a contract with you (Lawful basis: performance of a contract).
To comply with legal obligations: processing to meet statutory, tax and regulatory requirements (Lawful basis: legal obligation).
For our legitimate interests: processing for fraud prevention, security, internal administration, network and information security and improvement of our products and services, balanced against your rights and freedoms (Lawful basis: legitimate interests).
With your consent: where we ask for consent for marketing communications, cookies or profiling for tailored offers, we rely on your freely given, specific, informed and unambiguous consent (Lawful basis: consent).

Examples of specific purposes

Provision and delivery of products and services, order handling and customer support.
Payment processing, debt recovery and fraud detection.
Compliance with legal obligations such as tax and anti-money laundering rules.
Sending service-related communications and, where consented, marketing communications.
Improving and securing our systems, services and customer experience through analytics and testing.

4. Retention of Personal Data

Retention periods are determined by the purpose for which the data was collected, statutory obligations and legitimate business needs. We retain personal data only as long as necessary for those purposes and to comply with applicable laws.

Transactional and billing records: retained for the period required by applicable tax and accounting laws, and for a reasonable period thereafter to defend legal claims.
Customer account information: retained for the duration of the customer relationship and for a defined period after termination to meet legal or business needs.
Marketing consents and preference records: retained until consent is withdrawn or the record is no longer necessary.
Support and correspondence records: retained to resolve disputes, maintain service history and improve support processes.

When data is no longer required, it will be securely destroyed or anonymized so that identification of an individual is no longer possible.

5. Use of Processors and Third Parties

We may disclose personal data to trusted processors who process data on our behalf to support business operations, including payment processors, cloud hosting providers, data analytics providers, and customer support platforms.

All processors are subject to written contracts that require them to implement appropriate technical and organizational measures to protect personal data and to process data only on our documented instructions.
We maintain oversight of processors and require them to provide sufficient guarantees of GDPR compliance.
Where personal data is transferred outside the European Economic Area, we implement appropriate safeguards such as adequacy decisions, standard contractual clauses or other lawful transfer mechanisms.

International Transfers

If personal data is transferred internationally, we ensure that transfers are subject to suitable safeguards, for example:

Data transfers to countries with an adequacy decision by the European Commission.
Standard Contractual Clauses (SCCs) or equivalent safeguards adopted by the European Commission or other lawful mechanisms.

6. Security Measures

We implement technical and organizational measures to protect personal data from unauthorized access, loss, alteration or disclosure. These measures include encryption, access controls, secure hosting, data minimization, and regular security assessments. Access to personal data is limited to those employees and processors who need the information to perform their job responsibilities.

7. Your Rights Under GDPR

You have the following rights in relation to your personal data, subject to applicable exemptions and limitations:

Right of access: the right to obtain confirmation whether we process your personal data and to request a copy of that data.
Right to rectification: the right to have inaccurate or incomplete data corrected without undue delay.
Right to erasure (right to be forgotten): the right to request deletion of personal data where there is no overriding legitimate ground for its continued processing.
Right to restriction of processing: the right to ask us to suspend processing of your personal data in certain circumstances.
Right to data portability: the right to receive a copy of personal data you have provided in a structured, commonly used and machine-readable format and to transmit it to another controller where technically feasible.
Right to object: the right to object to processing based on legitimate interests, including profiling, and to direct marketing.
Right to withdraw consent: where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
Right to lodge a complaint: you have the right to lodge a complaint with a supervisory authority if you believe that our processing of your personal data infringes applicable data protection law.

To exercise your rights, please refer to the mechanisms available to you through your account settings or service interface. If those mechanisms are not available, you may submit a request through the provided channels in our systems. We will respond to requests in accordance with applicable law and within regulatory timeframes.

8. Automated Decision-Making and Profiling

We may use automated tools to support decision-making or to provide personalized services. Where automated processing results in significant effects on you, we will provide meaningful information about the logic involved and the potential consequences. Where required by law, you will have the right to contest decisions and request human intervention.

9. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or services. Significant changes will be brought to the attention of customers in the area through appropriate notices or updates within our service interfaces.

10. Legal Basis Summary

In summary, we rely on the following lawful bases to process personal data: performance of a contract, compliance with legal obligations, our legitimate interests when balanced against your rights and freedoms, and your consent where required. We process only the categories of data necessary for specified purposes and maintain safeguards to protect that data.

By using our services or interacting with us as a customer in the area, you acknowledge that you have read and understood this Privacy Policy.

Effective Date

This policy is effective as of the date provided in our service interface and is applicable to all customers in the area.