Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when services are provided to customers in the relevant area. It applies to all customers in the area and is intended to meet the requirements of applicable data protection laws, including the General Data Protection Regulation (GDPR). By using the services or interacting with the organization, customers acknowledge the practices described in this policy.

1. Data We Collect

We collect only the personal data necessary for lawful, specified, and legitimate purposes. Depending on the service relationship, we may collect the following categories of data:

Identity data: name, title, username, or similar identifiers.
Contact data: address, email address, telephone number, and similar details.
Transactional data: records of services requested, purchases, billing details, and related communications.
Technical data: device information, IP address, browser type, operating system, and usage logs.
Communication data: messages, feedback, complaints, and service-related correspondence.
Preference data: communication choices, language preferences, and service settings.

We do not seek to collect special category data unless it is required by law or is strictly necessary for a specific service and a valid legal basis exists. Where such data is collected, it is handled with enhanced safeguards and only for a clearly defined purpose.

2. How We Use Personal Data

Personal data is used for operational, legal, and security purposes. Typical uses include:

providing and managing services;
processing transactions and maintaining records;
responding to inquiries, complaints, and requests;
verifying identity and preventing fraud;
meeting legal, regulatory, accounting, and tax obligations;
improving service quality, performance, and customer experience;
maintaining system security and preventing unauthorized access.

We will not use personal data in a manner that is incompatible with the purpose for which it was collected, unless another lawful basis applies and the processing is otherwise permitted by law.

3. Lawful Basis for Processing

Under GDPR, we must have a valid lawful basis before processing personal data. Depending on the context, we rely on one or more of the following:

Contract

We process personal data where it is necessary to enter into, perform, or manage a contract with a customer. This may include service delivery, billing, account administration, and customer support.

Legal Obligation

We may process personal data to comply with legal requirements, including tax laws, financial recordkeeping, consumer protection rules, and lawful requests from public authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the rights and freedoms of the individual. Examples include fraud prevention, network security, internal reporting, and service improvement. When relying on legitimate interests, we assess whether the processing is necessary and proportionate.

Consent

In some cases, we rely on consent, particularly where the law requires it. When consent is used, it will be freely given, specific, informed, and unambiguous. Customers may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

4. Retention of Personal Data

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, and reporting obligations. Retention periods are determined by considering the nature of the data, the purpose of processing, legal requirements, and the risk associated with continued storage.

When personal data is no longer required, it will be securely deleted, anonymized, or irreversibly destroyed. In some cases, data may be retained for a longer period if required to resolve disputes, enforce agreements, or comply with a legal obligation. Storage limitation is applied so that data is not kept indefinitely without justification.

5. Sharing of Personal Data and Processors

We may share personal data with trusted third parties where necessary for business operations, legal compliance, or service delivery. These third parties may act as processors or independent controllers depending on the circumstances.

Processors may include:

IT hosting and cloud service providers;
payment processing providers;
customer support and communication tools;
security and fraud prevention vendors;
professional advisers such as auditors, legal counsel, or accountants;
analytics or system maintenance providers, where appropriate.

Where processors are used, they are only permitted to process personal data on documented instructions, must keep data secure, and must not use it for their own unrelated purposes. Appropriate contractual measures are applied to ensure GDPR-compliant handling, confidentiality, and data protection safeguards.

We may also disclose personal data if required by law, court order, or lawful request from a public authority, or where disclosure is necessary to protect rights, safety, or security.

6. International Transfers

If personal data is transferred outside the European Economic Area, we will ensure that adequate safeguards are in place. These safeguards may include an adequacy decision, standard contractual clauses, or other lawful transfer mechanisms permitted under GDPR. Customers may request information about the safeguards used where relevant and permitted by law.

7. Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures may include access controls, encryption where appropriate, secure storage, staff confidentiality obligations, and regular review of security practices.

No system is completely secure, but we work to maintain a level of protection that is appropriate to the risks presented by the processing. Any suspected data breach will be handled in accordance with applicable legal requirements, including assessment and notification where required.

8. User Rights Under GDPR

Customers in the relevant area have several rights concerning their personal data. Subject to legal limitations, these rights include:

Right of access: to obtain confirmation and a copy of the personal data we hold.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request limited processing in certain situations.
Right to data portability: to receive data in a structured, commonly used, machine-readable format where applicable.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent.
Right to lodge a complaint: with the relevant supervisory authority if you believe your data protection rights have been violated.

We may need to verify identity before responding to a rights request in order to protect personal data from unauthorized disclosure. Responses will be provided within the time limits required by law, unless an extension is permitted due to complexity or volume of requests.

9. Children’s Data

Our services are not intended for children unless explicitly stated otherwise. We do not knowingly collect personal data from children where such collection is not appropriate or lawful. If we become aware that personal data has been collected from a child without a valid basis, we will take steps to delete it or obtain appropriate authorization where permitted.

10. Updates to This Policy

We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. When updates are made, the revised policy will apply from the date it takes effect. Customers should review this policy periodically to remain informed about how their personal data is processed.

11. General Principles We Follow

We are committed to the core GDPR principles of lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. These principles guide how personal data is handled throughout the service lifecycle.

In practice, this means we collect only what is necessary, use it only for clear and legitimate purposes, protect it with suitable safeguards, and retain it only for as long as needed. We also ensure that processing is reviewed regularly so that customer rights remain respected and data protection remains built into our operations.

This Privacy Policy applies to all customers in the area and is intended to provide a clear, fair, and GDPR-compliant explanation of our data practices.