Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected in connection with our services. It applies to all customers in the area, regardless of how they access or use our services. We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Data We Collect

We collect only the personal data that is necessary for defined and legitimate purposes. Depending on your relationship with us, we may collect the following categories of information:

Identification data such as name, title, and customer reference details;
Contact data such as address, email address, and telephone number;
Account and transaction data such as service usage, order history, billing records, and payment status;
Technical data such as device type, browser type, IP address, log information, and interaction data;
Communication data such as messages, inquiries, complaints, and feedback;
Preference data such as service settings, consent choices, and communication preferences.

We do not intentionally collect special category data unless it is strictly necessary and permitted by law. If such data is required, we will ensure an appropriate lawful basis and additional safeguards are in place.

2. How We Use Personal Data

We use personal data for specific, explicit, and legitimate purposes. These include:

Providing and managing our services;
Processing transactions and maintaining records;
Communicating with customers and responding to requests;
Improving service quality, functionality, and user experience;
Detecting, preventing, and investigating fraud, abuse, or security incidents;
Meeting legal, accounting, and regulatory obligations;
Managing business operations, internal reporting, and audits;
Sending service-related notices and, where permitted, other relevant communications.

We will not use personal data in ways that are incompatible with these purposes unless we have a valid legal basis and, where required, inform you accordingly.

3. Lawful Basis for Processing

We process personal data only where a lawful basis under GDPR applies. Depending on the context, our lawful bases may include:

Performance of a Contract

We process data where it is necessary to enter into or perform a contract with you, such as providing services, handling orders, or managing your account.

Legal Obligation

We may process personal data to comply with legal and regulatory requirements, including tax, accounting, consumer protection, and recordkeeping obligations.

Legitimate Interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. Examples include fraud prevention, service improvement, security monitoring, and internal administration. Where required, we conduct a balancing test to ensure this processing is justified.

Consent

Where required by law, we rely on your consent. If we process data based on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

4. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including satisfying legal, accounting, reporting, and contractual requirements. Retention periods vary depending on the type of data and the reason for processing.

Customer and account records are kept for the duration of the business relationship and for a reasonable period afterward;
Transaction and billing records are retained in line with statutory tax and accounting obligations;
Communications and support records are retained for quality assurance, dispute handling, and service continuity;
Technical logs are retained for security, troubleshooting, and operational purposes for limited periods.

When personal data is no longer needed, we will delete, anonymize, or securely archive it in accordance with our internal retention practices and applicable law.

5. Data Sharing and Processors

We may share personal data with trusted third parties that help us operate our services. These parties act either as independent controllers or as processors acting on our behalf. We require all processors to process personal data only under our instructions and to implement appropriate technical and organizational security measures.

IT and hosting providers for infrastructure, storage, and system support;
Payment and financial service providers for transaction handling and fraud prevention;
Customer support tools for case management and communication;
Analytics and performance providers for service monitoring and improvement;
Professional advisers such as legal, accounting, or audit services;
Authorities and regulators when disclosure is required by law or necessary to protect rights, safety, or security.

We do not sell personal data. Where international transfers occur, we ensure appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms.

6. Security Measures

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures may include access controls, encryption, network protection, staff training, confidentiality obligations, and regular review of internal security practices. However, no system is completely secure, and we cannot guarantee absolute security.

7. Your Rights Under GDPR

Subject to legal conditions and limitations, you have the following rights regarding your personal data:

Right of access – to obtain confirmation of whether we process your data and receive a copy of it;
Right to rectification – to request correction of inaccurate or incomplete data;
Right to erasure – to request deletion of your data where lawful grounds apply;
Right to restriction – to request limited processing in certain circumstances;
Right to data portability – to receive data you provided in a structured, commonly used format;
Right to object – to object to processing based on legitimate interests or direct marketing;
Right to withdraw consent – where processing is based on consent;
Right not to be subject to automated decision-making – including profiling, where it produces legal or similarly significant effects, unless permitted by law.

You may also have the right to lodge a complaint with your local data protection authority if you believe your rights have been infringed.

8. Children’s Data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children without appropriate authorization and safeguards where required by law.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. The updated version will apply from the date it takes effect. We encourage customers to review this policy periodically to stay informed about how personal data is handled.

10. Scope of Application

This Privacy Policy applies to all customers in the area and governs the processing of personal data related to their use of our services, communications, transactions, and interactions with us. By using our services, you acknowledge that your personal data will be processed in accordance with this policy and applicable data protection law.

Summary of principles: we collect only necessary data, process it on a valid legal basis, retain it for defined periods, share it only with authorized processors and recipients, and respect your GDPR rights. We are committed to ensuring that personal data is handled lawfully, transparently, and securely at all times.