Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, disclosed, and protected when customers use our services. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using our services, customers acknowledge that their personal data will be processed in accordance with this Policy.

1. Scope of This Policy

This Policy applies to personal data relating to identified or identifiable individuals. It covers data that customers provide directly, data that is collected automatically through use of our services, and data received from third parties where lawful to do so. It does not apply to anonymised information that can no longer be linked to a person.

Personal data means any information relating to an identified or identifiable natural person. This may include names, contact details, account information, transaction records, device information, and other information reasonably associated with a customer.

2. Data We Collect

We only collect personal data that is relevant, limited, and necessary for the purposes described in this Policy. Depending on the nature of the relationship, the categories of data we may collect include:

Identity data: name, username, and similar identifiers.
Contact data: address, email address, and telephone number.
Transaction data: records of purchases, services requested, payment status, and related communications.
Technical data: device type, operating system, browser type, log data, and usage information.
Profile and preference data: customer choices, service preferences, and history of interactions.
Communication data: records of correspondence and support-related messages.

We do not intentionally collect special category data unless it is strictly necessary and a valid legal condition applies. If such data is ever collected, it will be processed with additional safeguards and only where permitted by law.

3. How We Use Personal Data

Personal data is processed for specific and legitimate purposes. These include:

providing and delivering services;
managing customer accounts and requests;
processing payments and maintaining financial records;
responding to enquiries and support requests;
improving service quality, performance, and user experience;
detecting, preventing, and investigating fraud, misuse, or security incidents;
meeting legal, regulatory, tax, and accounting obligations;
where permitted, sending relevant service communications and updates.

We will not use personal data in a way that is incompatible with the original purpose for which it was collected unless a valid legal basis exists and customers are informed where required.

4. Lawful Basis for Processing

Under GDPR, personal data must be processed on one or more lawful bases. We rely on the following bases depending on the context:

4.1 Contract

We process personal data when it is necessary to perform a contract with a customer or to take steps at the customer’s request before entering into a contract. This includes fulfilling services, handling transactions, and managing related communications.

4.2 Legal Obligation

We may process personal data where necessary to comply with legal obligations, such as tax rules, accounting requirements, consumer law, or lawful requests from public authorities.

4.3 Legitimate Interests

We may process data where it is necessary for our legitimate interests, provided those interests are not overridden by the customer’s rights and freedoms. Legitimate interests may include service improvement, operational security, fraud prevention, and internal administration.

4.4 Consent

In limited cases, we rely on consent. Where consent is used, it will be informed, specific, freely given, and unambiguous. Customers may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4.5 Vital Interests and Public Task

These bases are unlikely to apply in normal service activities, but where relevant, processing may take place to protect vital interests or where necessary for a task carried out in the public interest under applicable law.

5. Retention of Personal Data

We keep personal data only for as long as necessary for the purposes set out in this Policy, or as required by law. The retention period depends on the type of data, the purpose of processing, and any applicable legal requirement.

Service and account data are retained for the duration of the customer relationship and for a reasonable period afterwards.
Transaction and financial records may be retained for longer periods to satisfy accounting and tax obligations.
Support and communication records are kept only as long as needed to resolve the issue and maintain an appropriate audit trail.
Security and log data are retained for a limited time unless an investigation or legal obligation requires longer storage.

When data is no longer required, it will be deleted, anonymised, or securely archived in accordance with our retention practices. We apply data minimisation and storage limitation principles throughout the retention lifecycle.

6. Data Processors and Third Parties

We may engage third-party service providers, known as processors, to help deliver our services. These processors act only on our documented instructions and must protect personal data in accordance with GDPR requirements.

Typical processors may include:

IT hosting and infrastructure providers;
payment and billing service providers;
customer support and communication tools;
analytics or system monitoring providers;
professional advisers, such as auditors or legal advisers, where necessary.

We require processors to implement appropriate technical and organisational measures, maintain confidentiality, and process data only for authorised purposes. Where personal data is shared with independent controllers, such as regulators or law enforcement, that sharing will occur only when lawful and necessary.

If personal data is transferred outside the European Economic Area, safeguards required by GDPR will be used, such as adequacy decisions, standard contractual clauses, or equivalent lawful transfer mechanisms.

7. Security of Personal Data

We use reasonable and appropriate security measures to protect personal data from unauthorised access, disclosure, alteration, loss, or destruction. These measures may include access controls, encryption where appropriate, staff training, and regular review of our security practices.

Although no system can be guaranteed to be completely secure, we are committed to maintaining a level of protection proportionate to the nature of the data and the risks involved.

8. User Rights Under GDPR

Customers have rights in relation to their personal data. Subject to legal conditions and exemptions, these rights include:

Right of access: to obtain confirmation of whether data is processed and to receive a copy of that data.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of data in certain circumstances.
Right to restriction: to request limited processing in defined situations.
Right to data portability: to receive data in a structured, commonly used, machine-readable format where applicable.
Right to object: to object to processing based on legitimate interests or direct marketing, where applicable.
Right to withdraw consent: where processing is based on consent, it may be withdrawn at any time.
Right not to be subject to solely automated decisions: where such decisions have legal or similarly significant effects, subject to legal exceptions.

To protect privacy, we may request information needed to verify identity before responding to a rights request. Requests will be handled within the time limits required by GDPR, and we will explain if any restriction or exemption applies.

9. Children’s Data

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children without appropriate consent or another valid legal basis where required by law. If we become aware that such data has been collected improperly, we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. Any revised version will apply from the date it is published or otherwise communicated. Customers are encouraged to review this Policy periodically to remain informed about how personal data is processed.

11. General Statement

This Privacy Policy applies to all customers in the area and governs the processing of personal data in connection with our services. We are committed to processing data lawfully, fairly, and transparently, and to respecting the rights and freedoms of every customer. The guiding principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality are central to our approach.

Strong protection of personal data is essential to maintaining trust. We therefore review our practices regularly and seek to ensure that our processing remains consistent with GDPR requirements and the expectations of our customers.