Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area where our services are offered, and it is intended to meet the requirements of the General Data Protection Regulation (GDPR) and related data protection laws.

We are committed to handling personal data fairly, lawfully, transparently, and securely. This policy should be read carefully to understand what data we collect, why we collect it, how long we keep it, who may process it on our behalf, and what rights individuals have in relation to their data.

1. Data Collection

We may collect and process personal data directly from you, automatically through your use of our services, or from third parties where permitted by law. The types of personal data we may collect include:

Identity data such as your name, title, and similar identifiers.
Contact data such as address, email address, and telephone number.
Account data such as login details, account settings, and service preferences.
Transaction data such as details about services purchased, payment status, and records of requests.
Technical data such as device information, browser type, IP address, and usage logs.
Communication data such as correspondence, feedback, and support requests.
Usage data such as how you interact with our services and content.

We do not intentionally collect special category data unless it is necessary and we have an appropriate legal basis for doing so. Special category data may include information about health, religion, political opinions, or similar sensitive data. Where such data is required, we will only process it with enhanced safeguards and in compliance with applicable law.

We may also collect data via cookies or similar technologies where allowed by law. Such technologies may be used for service functionality, analytics, or security purposes. Any processing of this kind will be limited to what is necessary and proportionate.

2. Lawful Basis for Processing

We process personal data only when we have a valid lawful basis under GDPR. Depending on the context, we may rely on one or more of the following bases:

Contract: processing is necessary to provide our services, manage accounts, fulfil requests, or perform obligations arising from an agreement.
Legal obligation: processing is required to comply with applicable laws, regulations, tax rules, accounting obligations, or lawful requests from authorities.
Legitimate interests: processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include service improvement, fraud prevention, network security, and administrative management.
Consent: where required, we will rely on your consent for specific activities, such as certain communications or optional data uses. You may withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal.
Vital interests: in rare cases, processing may be necessary to protect someone’s life or physical safety.
Public interest or official authority: where applicable, processing may be carried out for tasks in the public interest or under official authority.

We aim to ensure that any processing based on legitimate interests is carefully assessed and balanced against the rights of individuals. Where required, we will provide further information about the specific lawful basis relevant to a particular activity.

3. Purpose of Processing

We use personal data for the following purposes:

To provide and operate our services.
To manage user accounts and customer relationships.
To process transactions and maintain records.
To communicate about service updates, changes, and support matters.
To improve service quality, performance, and user experience.
To maintain safety, prevent fraud, and protect against misuse.
To comply with applicable legal and regulatory obligations.

We will only use personal data for the purposes described in this policy or for compatible purposes permitted by law. If we need to use personal data for a new purpose that is not compatible with the original purpose, we will explain the legal basis and, where necessary, obtain consent.

4. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Retention periods vary depending on the nature of the data, the purpose of processing, and applicable legal obligations.

In general, we consider the following factors when determining retention periods:

The length of our relationship with you.
Any legal obligations requiring retention.
Limitation periods for potential claims.
Business or operational needs, including audit and security requirements.

When personal data is no longer needed, we will delete it securely or anonymise it so that it can no longer identify an individual. If deletion is not immediately possible due to legal or technical reasons, we will ensure the data is securely stored and isolated until deletion can take place.

5. Processors and Sharing of Data

We may share personal data with trusted third parties that process data on our behalf as processors. These processors are only allowed to act on our instructions and must implement appropriate technical and organisational measures to protect personal data.

Examples of processors may include:

IT and hosting providers.
Payment processing services.
Customer support tools and service management systems.
Analytics and performance monitoring providers.
Security, fraud prevention, and compliance service providers.

Where required by law, we may also share data with independent controllers such as regulators, law enforcement authorities, professional advisers, or other entities that have a lawful right to receive the data.

We take steps to ensure that any processor engaged by us provides sufficient guarantees regarding data protection, confidentiality, and security. All processors are assessed before engagement and monitored as appropriate.

If personal data is transferred outside the European Economic Area or the United Kingdom, we will ensure that appropriate safeguards are in place, such as standard contractual clauses or other lawful transfer mechanisms recognised under GDPR.

6. Data Security

We use suitable technical and organisational measures to protect personal data against accidental loss, unauthorised access, unlawful use, alteration, and disclosure. These measures may include access controls, encryption, secure storage, staff confidentiality obligations, and internal policies designed to limit access on a need-to-know basis.

Although we take reasonable steps to secure data, no system is completely secure. We therefore cannot guarantee absolute security, but we continually review and improve our safeguards to reduce risk.

7. User Rights Under GDPR

Individuals whose personal data is processed under this policy have rights under GDPR. Subject to legal limitations, these rights may include:

Right of access: the right to obtain confirmation about whether we process personal data and to request a copy of that data.
Right to rectification: the right to request correction of inaccurate or incomplete personal data.
Right to erasure: the right to request deletion of personal data in certain circumstances.
Right to restrict processing: the right to request limited processing in certain situations.
Right to data portability: the right to receive certain data in a structured, commonly used, machine-readable format and to transmit it to another controller where applicable.
Right to object: the right to object to processing based on legitimate interests or direct marketing, where applicable.
Right to withdraw consent: where processing is based on consent, the right to withdraw that consent at any time.
Right not to be subject to automated decision-making: the right not to be subject to decisions based solely on automated processing, including profiling, where such decisions have legal or similarly significant effects, except as permitted by law.

We will respond to valid requests within the timeframes required by law and may ask for information to verify identity before acting on a request. Requests may be limited where necessary to protect the rights and freedoms of others or to comply with legal obligations.

8. Children’s Data

Our services are not intended for children unless explicitly stated otherwise. We do not knowingly collect personal data from children without appropriate legal grounds and, where required, parental or guardian consent. If we become aware that data has been collected inappropriately, we will take reasonable steps to delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or data processing practices. Any updated version will apply from the date it takes effect. We encourage individuals to review this policy periodically so they remain informed about how their data is handled.

10. Additional Information

We only process personal data to the extent necessary for the purposes outlined in this policy. Where processing is optional, we will provide clear choices and respect those decisions.

This Privacy Policy applies to all customers in the area. It governs personal data processed in connection with the services provided within that area, subject to any additional local legal requirements that may apply.

By using our services, you acknowledge that your personal data may be processed in accordance with this policy and applicable data protection law. If any part of this policy is found to be invalid or unenforceable, the remaining provisions will continue in effect.