Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected for all customers in the area. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using our services, customers acknowledge that their personal data may be processed in accordance with this Policy.

1. Data We Collect

We may collect and process different types of personal data depending on how customers interact with our services. The categories of data we collect may include:

Identity data: name, title, and similar identifiers.
Contact data: billing address, delivery address, email address, and telephone number.
Transaction data: details of purchases, payments, invoices, refunds, and service history.
Technical data: internet protocol (IP) address, login information, browser type, device identifiers, and usage data.
Profile data: preferences, feedback, communications, and behavioral information related to use of our services.
Marketing and communication data: customer choices regarding receiving communications and related preferences.

We may also receive data indirectly from third parties where this is necessary to provide our services, complete transactions, comply with legal obligations, or prevent fraud. Where possible, we only collect data that is relevant, adequate, and limited to what is necessary for the purposes described in this Policy.

2. How We Use Personal Data

Personal data is used for legitimate business and operational purposes, including:

providing products and services to customers in the area;
processing orders, payments, and related administrative tasks;
managing customer accounts and service requests;
communicating about updates, notices, or changes to services;
improving service quality, performance, and user experience;
maintaining security, preventing misuse, and detecting fraudulent activity;
meeting legal, regulatory, tax, and accounting obligations;
responding to complaints, disputes, and enforcement requests.

We do not use personal data in ways that are incompatible with the purposes for which it was collected, unless required or permitted by law.

3. Lawful Basis for Processing

We only process personal data when we have a lawful basis under GDPR. Depending on the specific activity, the lawful bases may include:

Performance of a Contract

We process personal data when it is necessary to enter into or perform a contract with a customer, such as fulfilling orders, delivering services, managing payments, or responding to service-related requests.

Legal Obligation

We may process personal data where necessary to comply with legal obligations, including tax reporting, accounting requirements, consumer protection laws, and lawful requests from public authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the rights and freedoms of the individual. Such interests may include fraud prevention, service improvement, internal administration, and securing our systems.

Consent

Where required by law, we rely on consent for certain activities, such as specific marketing communications or optional data collection. When processing is based on consent, customers may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Vital Interests and Public Interest

In limited situations, we may process personal data where necessary to protect vital interests or where processing is carried out in the public interest, in accordance with applicable law.

4. Data Sharing and Processors

We may share personal data with trusted third parties acting as processors or, where applicable, independent controllers. Processors only process personal data on our documented instructions and are required to protect the data and maintain confidentiality.

Examples of processors may include:

IT and cloud hosting providers;
payment processing services;
customer support and communication tools;
accounting, audit, and administrative service providers;
security and fraud prevention providers;
data storage and backup providers.

We may also disclose personal data where necessary to comply with legal obligations, defend legal claims, protect rights, or support a business reorganization, merger, or transfer of assets. Any third party receiving personal data is expected to implement appropriate technical and organizational security measures.

5. International Transfers

If personal data is transferred outside the European Economic Area or the United Kingdom, we take steps to ensure that adequate safeguards are in place. These safeguards may include the use of standard contractual clauses, adequacy decisions, or other legally recognized transfer mechanisms. Transfers will only be made where appropriate protections are available.

6. Data Retention

We keep personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. The retention period depends on the type of data, the purpose of processing, and any legal obligations that apply.

In general, we consider the following factors when determining retention periods:

the duration of our relationship with the customer;
the need to resolve disputes or enforce agreements;
statutory retention requirements;
the sensitivity and volume of the data;
the risk of unauthorized use or disclosure.

When personal data is no longer required, we will securely delete, anonymize, or otherwise irreversibly remove it from our systems, unless retention is required by law.

7. Security of Personal Data

We use reasonable technical and organizational measures to protect personal data against accidental loss, unlawful destruction, unauthorized access, disclosure, alteration, or misuse. These measures may include access controls, encryption, secure storage, staff training, and monitoring of systems and networks. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. User Rights Under GDPR

Customers in the area have rights regarding their personal data. Subject to legal limitations, these rights may include:

Right of access: to obtain confirmation of whether we process personal data and to receive a copy of that data.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request that processing be limited in specific situations.
Right to data portability: to receive certain data in a structured, commonly used, machine-readable format and, where feasible, have it transmitted to another controller.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time.
Right not to be subject to automated decision-making: to avoid decisions based solely on automated processing that produce legal or similarly significant effects, unless lawful exceptions apply.

Requests concerning these rights will be handled in accordance with GDPR. We may need to verify identity before responding to a request. If a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee or refuse to act where permitted by law.

9. Marketing Communications

Where allowed, we may send customers information about services, updates, or promotions. Customers may opt out of marketing communications at any time. When a customer objects to direct marketing, we will stop using their personal data for that purpose.

10. Children’s Data

Our services are not intended for children where consent is required by law without appropriate authorization. We do not knowingly collect personal data from children in circumstances where such collection is prohibited. If we become aware that such data has been collected without a valid legal basis, we will take appropriate steps to delete it.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, business practices, or service offerings. Any updated version will apply from the date it is made effective. Customers are encouraged to review this Policy periodically so they remain informed about how personal data is processed.

12. General Statement for Customers in the Area

This Privacy Policy applies to all customers in the area, regardless of whether services are received online, in person, or through another channel. By continuing to use the services, customers acknowledge that their personal data may be handled in accordance with this Policy and applicable data protection laws.

Important: This Policy is intended to provide transparency about our data processing practices and the rights available under GDPR. It does not remove or limit any rights granted by law.