Privacy Policy

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when providing our services to customers in the relevant area. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Scope and Purpose

We value privacy and are committed to handling personal data in a lawful, fair, and transparent manner. This policy describes the categories of data we collect, the reasons for processing, the legal bases we rely on, how long we keep data, the third parties that may process data on our behalf, and the rights individuals have in relation to their personal data.

For the purposes of this policy, personal data means any information relating to an identified or identifiable natural person. This may include names, contact details, account information, technical identifiers, communication records, and other information linked to an individual.

2. Data We Collect

We collect only the data that is necessary for the purposes described in this policy. Depending on the nature of our relationship with you, we may collect the following categories of personal data:

Identity data: name, username, and similar identifiers.
Contact data: address, email address, and telephone number.
Transaction data: details about products or services requested, purchased, or delivered.
Payment-related data: limited payment information required to process transactions, where applicable.
Communication data: records of correspondence, inquiries, complaints, and feedback.
Technical data: internet protocol address, device type, browser type, operating system, and log information.
Usage data: information about how services are accessed and used.
Preference data: communication preferences and service settings.

We generally collect data directly from you when you interact with us, create an account, place an order, submit a request, or communicate with us. We may also receive data from service providers, payment processors, and other entities involved in the delivery of our services, where lawful and appropriate.

3. How We Use Personal Data

We process personal data for legitimate business and service-related purposes. These include:

providing, maintaining, and improving our services;
processing transactions and fulfilling requests;
managing customer relationships and support;
verifying identity and preventing fraud;
ensuring network, information, and physical security;
maintaining records for administrative and legal purposes;
meeting regulatory, tax, accounting, and compliance obligations;
analyzing service performance and usage trends;
sending service messages and, where permitted, relevant updates;
protecting our rights, property, and legitimate interests.

We do not use personal data for purposes that are incompatible with those described here unless we have a valid legal basis to do so.

4. Lawful Basis for Processing

Under GDPR, we must have a lawful basis to process personal data. Depending on the specific activity, we rely on one or more of the following bases:

Performance of a Contract

We process personal data where it is necessary to perform a contract with you or to take steps at your request before entering into a contract. This may include managing your account, providing services, or completing transactions.

Compliance with a Legal Obligation

We may process personal data when necessary to comply with legal obligations, including tax, accounting, consumer protection, and record-keeping requirements.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided these interests are not overridden by your rights and freedoms. Examples include service improvement, security monitoring, fraud prevention, and business administration.

Consent

Where required by law, we rely on your consent. For example, we may ask for consent before sending certain marketing communications or placing non-essential cookies where applicable. You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Vital Interests

In rare cases, we may process personal data to protect someone’s vital interests, such as in an emergency situation.

5. Retention of Personal Data

We keep personal data only for as long as necessary to fulfill the purposes for which it was collected, including meeting legal, accounting, reporting, and contractual requirements. Retention periods vary depending on the type of data and the context of processing.

In general, we consider the following factors when determining retention periods:

the amount, nature, and sensitivity of the data;
the potential risk of harm from unauthorized use or disclosure;
the purposes of processing and whether those purposes can be achieved by other means;
legal and regulatory retention obligations;
whether a dispute, complaint, or investigation is ongoing.

When personal data is no longer required, we will securely delete, anonymize, or archive it in accordance with applicable law and internal retention procedures.

6. Processors and Data Sharing

We may use third-party service providers, also known as processors, to help deliver services and operate our business. These processors act on our instructions and are contractually required to protect personal data and use it only for the agreed purposes.

Categories of processors may include:

IT and cloud hosting providers;
payment and transaction service providers;
customer support platforms;
analytics and reporting tools;
security and fraud detection providers;
administrative, accounting, and document management services.

We may also disclose personal data where necessary to comply with legal obligations, respond to lawful requests, protect our rights, or complete a corporate transaction such as a merger or restructuring. Where data is shared, we take reasonable steps to ensure appropriate safeguards are in place.

If personal data is transferred outside the relevant jurisdiction, we will ensure that appropriate transfer mechanisms and safeguards are used, such as standard contractual clauses or equivalent protections recognized under GDPR.

7. Data Security

We apply appropriate technical and organizational measures to protect personal data against accidental loss, unauthorized access, misuse, alteration, or disclosure. These measures may include access controls, encryption where appropriate, network security, staff training, and regular review of internal practices.

While we work to protect personal data, no method of transmission or storage is completely secure. We therefore cannot guarantee absolute security, but we continuously review and improve our safeguards.

8. Your Rights Under GDPR

Individuals whose personal data is processed under this policy have certain rights under GDPR, subject to applicable legal conditions and exemptions. These rights include:

Right of access: to obtain confirmation of whether personal data is being processed and receive a copy of that data.
Right to rectification: to request correction of inaccurate or incomplete personal data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request limitation of processing in certain situations.
Right to data portability: to receive personal data in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent, to withdraw consent at any time.

You also have the right not to be subject to decisions based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects, except where permitted by law.

To exercise these rights, a request should be made through the appropriate privacy or customer support process made available by the service provider. We may need to verify your identity before responding to a request. We will respond within the time limits required by GDPR, typically within one month, unless the request is complex or numerous.

9. Children’s Data

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children where such collection would violate applicable law. If we become aware that personal data has been collected inappropriately, we will take reasonable steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or operational requirements. When we do, we will revise the policy accordingly. Continued use of the services after changes take effect indicates acknowledgment of the updated policy, to the extent permitted by law.

11. Final Statement

This Privacy Policy is intended to provide clear information about our data practices and the rights available to individuals under GDPR. It applies to all customers in the area and should be read alongside any other notices or terms that may apply to specific services. We are committed to processing personal data with fairness, accountability, and respect for privacy.