Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area where our services are provided and is intended to reflect applicable data protection requirements, including the principles of the General Data Protection Regulation (GDPR).

1. Introduction

We are committed to handling personal data lawfully, fairly, and transparently. We only collect information that is necessary for specified purposes and we take appropriate technical and organizational measures to safeguard it. This policy describes the categories of data we may process, the legal grounds on which we rely, how long we keep data, the types of third parties that may process data on our behalf, and the rights available to individuals under applicable law.

2. Personal Data We Collect

We may collect and process the following categories of personal data, depending on how an individual interacts with our services:

Identity information: name, title, and similar identifiers.
Contact information: address, email address, telephone number, and other communication details.
Transaction information: records of services requested, purchased, or delivered, including billing and payment-related details.
Account and service information: preferences, settings, and records of interactions with our services.
Technical information: IP address, device identifiers, browser type, log data, and usage patterns.
Location information: approximate location derived from technical data or information voluntarily provided.
Communication records: messages, inquiries, complaints, and feedback.

We do not intentionally collect special category data unless it is necessary for a lawful purpose and permitted by law. If such data is provided, it will be processed only with an appropriate legal basis and suitable safeguards.

3. How We Use Personal Data

Personal data is processed for the following purposes:

To provide and manage our services.
To verify identity and maintain security.
To process transactions, payments, and service requests.
To communicate about updates, support, and administrative matters.
To improve service performance, quality, and user experience.
To analyze trends, monitor usage, and detect fraud or misuse.
To comply with legal, regulatory, tax, accounting, and recordkeeping obligations.
To establish, exercise, or defend legal claims.

We will only use personal data in ways that are compatible with the purposes described in this policy, unless we have a valid legal basis for a new use.

4. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for each processing activity. Depending on the context, we may rely on one or more of the following grounds:

4.1 Performance of a Contract

Where processing is necessary to perform a contract with an individual or to take steps at the individual’s request before entering into a contract, we process personal data to provide services, manage accounts, complete transactions, and deliver support.

4.2 Legal Obligation

We may process personal data where necessary to comply with a legal obligation, such as accounting rules, tax requirements, anti-fraud obligations, or lawful requests from public authorities.

4.3 Legitimate Interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the individual’s rights and freedoms. Examples include service improvement, security monitoring, fraud prevention, internal administration, and defending legal claims. Where required, we conduct a balancing test to assess these interests.

4.4 Consent

In some situations, we rely on consent to process personal data, especially where the law requires prior permission. Individuals may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

5. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including any legal, accounting, or reporting requirements. Retention periods may vary depending on the type of data and the purpose of processing.

Contract and transaction records are generally kept for the duration of the relationship and for a period afterward to satisfy legal and operational needs.
Communication records may be retained for a reasonable period to support service continuity, quality assurance, and dispute resolution.
Technical and security logs are retained for the period needed to maintain system integrity and detect misuse.
Where data is no longer required, we will delete, anonymize, or securely archive it in accordance with applicable law.

Retention decisions are reviewed regularly to ensure that data is not kept longer than necessary.

6. Sharing and Processors

We may share personal data with carefully selected third parties that process data on our behalf or independently where legally permitted. These third parties may include:

Service providers and processors: entities that support hosting, IT infrastructure, data storage, communications, analytics, security, and administrative functions.
Payment and financial service providers: entities that facilitate payment processing, fraud prevention, and related financial operations.
Professional advisers: accountants, auditors, lawyers, and other advisers where necessary for compliance or legitimate business purposes.
Public authorities or regulators: where disclosure is required by law or necessary to protect rights, safety, or legal interests.

Where a third party acts as a processor, it will process personal data only on documented instructions, apply appropriate safeguards, and not use the data for its own unrelated purposes. We require processors to implement security measures and confidentiality obligations that are appropriate to the risk involved.

7. International Transfers

If personal data is transferred outside the European Economic Area or another jurisdiction with similar protections, we will ensure that appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms recognized by GDPR.

8. Data Security

We use reasonable technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction. Such measures may include access controls, encryption where appropriate, security monitoring, staff confidentiality obligations, and restricted retention practices. While no system can be guaranteed entirely secure, we continuously review and improve our safeguards.

9. User Rights

Individuals whose data is processed under this policy have rights under GDPR and other applicable laws. Subject to legal conditions and exemptions, these rights may include:

Right of access: to obtain confirmation of whether personal data is being processed and to receive a copy of that data.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request limited processing in specific situations.
Right to data portability: to receive data in a structured, commonly used, machine-readable format where applicable.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent, to withdraw it at any time.
Right not to be subject to automated decision-making: including profiling, where such decisions produce legal or similarly significant effects, unless permitted by law.

We may need to verify identity before responding to a rights request. Responses will be provided within the timeframes required by law unless the request is complex or numerous.

10. Children’s Data

Our services are not intended to be used by children unless specifically stated otherwise. If we learn that personal data has been collected from a child without appropriate authorization, we will take steps to delete or otherwise handle the data in accordance with legal requirements.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or operational needs. The updated version will apply from the date of publication or as otherwise stated. Individuals are encouraged to review this policy periodically to remain informed about how personal data is handled.

12. Governing Principles

We process personal data in line with the core principles of GDPR, including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. We aim to ensure that all processing remains proportionate to the purposes for which data is collected and that individuals can exercise meaningful control over their information.

By using our services, individuals acknowledge that this Privacy Policy applies to all customers in the area and describes how personal data is handled in a GDPR-compliant manner.