Privacy Policy

This Privacy Policy explains how personal data is collected, used, shared, retained, and protected when services are provided to customers in the relevant area. It applies to all customers in that area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and applicable local privacy laws.

1. Scope of this Policy

This Policy applies to all customers in the area who use, request, or otherwise interact with the services covered by this Policy. It also applies to individuals acting on behalf of a customer, including authorized representatives, where personal data is processed in connection with the services.

For the purposes of this Policy, personal data means any information relating to an identified or identifiable natural person. This may include names, contact details, account information, transaction records, technical identifiers, and communications content where relevant.

2. Data We Collect

We collect personal data only to the extent necessary for legitimate and lawful business purposes. Depending on the nature of the relationship and the services provided, we may collect the following categories of information:

Identity data: name, title, date of birth, and similar identifying details.
Contact data: address, email address, telephone number, and billing or delivery details.
Account data: account identifiers, usernames, authentication details, and profile information.
Transaction data: records of services requested, purchases, payments, invoices, and related history.
Technical data: device type, browser information, log data, IP address, and usage records.
Communication data: messages, inquiries, service requests, complaints, and feedback.
Compliance data: records needed for legal, regulatory, fraud-prevention, or audit purposes.

We do not intentionally collect special category personal data unless it is required by law, explicitly provided by the individual, or necessary for a specific lawful purpose with appropriate safeguards.

3. How We Use Personal Data

Personal data is used for the following purposes:

providing and managing services;
processing requests and transactions;
maintaining customer records and accounts;
communicating about service updates, notices, and support matters;
ensuring security, fraud prevention, and system integrity;
meeting legal, tax, accounting, and regulatory obligations;
improving service quality and internal operations;
resolving disputes and enforcing agreements.

We will only use personal data in ways that are compatible with the original purpose for which it was collected, unless another lawful basis applies.

4. Lawful Basis for Processing

Under GDPR, we process personal data only where we have a valid lawful basis. Depending on the context, we may rely on one or more of the following:

Performance of a Contract

We process personal data when it is necessary to enter into or perform a contract with a customer, including delivering services, managing accounts, and handling payments.

Legal Obligation

We may process personal data to comply with laws and regulations, including obligations related to taxation, accounting, consumer protection, recordkeeping, anti-fraud, or lawful requests from public authorities.

Legitimate Interests

We may process personal data when it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the individual’s rights and freedoms. This may include service improvement, business administration, security monitoring, internal analytics, and fraud detection. Where legitimate interests are relied upon, we assess the impact on privacy and apply safeguards where appropriate.

Consent

In limited cases, we may rely on consent, especially where it is required by law or where there is no other suitable lawful basis. When consent is used, it will be informed, specific, freely given, and capable of withdrawal at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Vital Interests and Public Interest

In rare circumstances, processing may be necessary to protect vital interests of a person or to carry out tasks in the public interest or under official authority, where applicable.

5. Sharing and Processors

We may share personal data with trusted third parties where necessary for the purposes described in this Policy. These third parties act as processors or independent controllers depending on the service they provide. We require appropriate contractual safeguards and only share the minimum data necessary.

Processors may include:

IT hosting and infrastructure providers;
customer support and communication platforms;
payment and billing service providers;
security and fraud-prevention service providers;
analytics and reporting providers;
professional advisers, such as auditors or legal advisers, where necessary.

Where processors act on our behalf, they are required to process personal data only in accordance with our instructions, to maintain confidentiality, and to implement appropriate technical and organizational security measures.

We may also disclose personal data where required by law, to protect our rights, to investigate misuse, or in connection with a corporate transaction such as a merger or restructuring, subject to applicable legal safeguards.

6. International Transfers

If personal data is transferred outside the European Economic Area or other regions with equivalent protections, we ensure that appropriate safeguards are in place. These may include adequacy decisions, Standard Contractual Clauses, binding corporate rules, or other lawful transfer mechanisms recognized under GDPR. Additional measures may be used where needed to protect the data.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, tax, reporting, and dispute-resolution requirements. Retention periods are determined by the type of data, the nature of the service, legal obligations, and the need to establish or defend legal claims.

When data is no longer required, we will securely delete, destroy, or anonymize it where feasible. In some cases, we may keep limited records for a longer period if required by law or if needed to resolve disputes, enforce agreements, or protect against fraud.

8. Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, misuse, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff confidentiality obligations, monitoring, and regular review of security practices.

While no system can be guaranteed to be completely secure, we continuously work to improve our safeguards and to maintain a level of security appropriate to the risk.

9. User Rights Under GDPR

Individuals have rights concerning their personal data, subject to legal limits and exceptions. These rights include:

Right of access: to obtain confirmation of whether personal data is being processed and to receive a copy of that data.
Right to rectification: to request correction of inaccurate or incomplete personal data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request limitation of processing in certain cases.
Right to data portability: to receive personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where applicable.
Right to object: to object to processing based on legitimate interests or to direct marketing, where applicable.
Right to withdraw consent: where processing is based on consent, it may be withdrawn at any time.
Right not to be subject to solely automated decisions: to not be subject to decisions based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects, except where permitted by law.

Requests relating to these rights will be handled in accordance with GDPR. We may need to verify identity before responding to ensure personal data is protected. Some rights may be limited where necessary to comply with legal obligations or protect the rights of others.

10. Children’s Data

Our services are not directed to children unless explicitly stated otherwise. We do not knowingly collect personal data from children without appropriate legal basis and safeguards. If we become aware that personal data has been collected inappropriately, we will take steps to delete it or otherwise handle it in accordance with applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, operational practices, or service requirements. Any revised version will apply from the date it becomes effective. Customers are encouraged to review this Policy periodically to remain informed about how personal data is handled.

12. General Statement

This Privacy Policy is intended to provide a clear and transparent explanation of our data processing practices. We are committed to processing personal data fairly, lawfully, and securely, and to respecting the rights and freedoms of individuals. Where GDPR applies, all processing will be carried out in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability.

By using the relevant services in the area, customers acknowledge that their personal data may be processed as described in this Policy, subject always to applicable law and their rights under GDPR.