Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with services provided to customers in the relevant area. This policy applies to all customers in the area and is intended to comply with the General Data Protection Regulation (GDPR) and applicable local data protection laws. By using our services, customers acknowledge that their personal data may be processed in the ways described below.

1. Data We Collect

We collect only the personal data necessary for legitimate business purposes, service delivery, and legal compliance. Depending on the nature of the relationship, this may include the following categories:

Identity data such as name, title, and customer reference details.
Contact data such as address, email address, and telephone number.
Transaction data such as order history, service usage, payment records, and billing information.
Technical data such as IP address, device information, browser type, and log data.
Communication data such as requests, complaints, feedback, and other correspondence.
Preference data such as language choice, service preferences, and marketing choices.

We do not intentionally collect special category data unless it is strictly required by law or explicitly provided by the individual for a lawful purpose. Where such data is processed, additional safeguards are applied.

2. How We Use Personal Data

Personal data is used for lawful business and operational purposes, including:

providing goods or services requested by customers;
processing payments and managing accounts;
responding to enquiries, requests, and complaints;
maintaining records and improving service quality;
ensuring security, preventing fraud, and detecting misuse;
complying with legal and regulatory obligations;
sending service-related notices and updates;
where permitted, carrying out limited marketing activities.

We do not use personal data in ways that are incompatible with the purposes for which it was collected unless we have a lawful basis to do so.

3. Lawful Basis for Processing

Under GDPR, we process personal data only where a lawful basis applies. The lawful bases used may include:

Contract

We process personal data when it is necessary to enter into or perform a contract with a customer, including account administration, fulfilment, invoicing, and support.

Legal obligation

We may process personal data to comply with legal and regulatory obligations, such as tax, accounting, fraud prevention, and record-keeping requirements.

Legitimate interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the rights and freedoms of the individual. This may include service improvement, internal analytics, security monitoring, and administrative efficiency.

Consent

Where required by law, we rely on consent. For example, certain marketing communications or optional data uses may be based on consent. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

Vital interests and public interest

In limited cases, processing may be necessary to protect vital interests or to perform a task carried out in the public interest, where applicable under law.

4. Data Sharing and Processors

We may share personal data with trusted third parties who act as processors or independent controllers, only where necessary and lawful. Processors are engaged to perform specific services on our behalf and are contractually required to protect personal data and process it only on documented instructions.

Examples of processors may include:

payment service providers;
IT hosting and cloud infrastructure providers;
customer relationship management providers;
analytics and security service providers;
professional advisers such as accountants, auditors, or legal advisers;
delivery or fulfilment partners;
regulatory or public authorities where required by law.

Where personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, such as an adequacy decision, standard contractual clauses, or another lawful transfer mechanism permitted by GDPR.

We do not sell personal data. Any sharing is limited to what is necessary for the purposes described in this policy.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including meeting legal, accounting, contractual, and reporting obligations. Retention periods are determined by the nature of the data, the purpose of processing, and any statutory requirements.

Account and transaction records may be kept for the period required by tax or commercial law.
Customer support records may be retained for a reasonable period after the matter is resolved.
Marketing preferences are retained until consent is withdrawn or the customer opts out.
Technical logs may be retained for a limited time for security and operational purposes.

When personal data is no longer required, it is securely deleted, anonymised, or archived in accordance with our retention practices. Retention periods may vary depending on legal obligations and the specific category of data.

6. Data Security

We take appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, encryption, staff training, secure storage, and monitoring of systems and processes.

Although no system can be guaranteed completely secure, we continuously review our safeguards and aim to maintain a level of protection appropriate to the risk.

7. Your Rights Under GDPR

Individuals whose personal data is processed under this policy have rights under GDPR, subject to certain conditions and exemptions. These rights include:

The right to be informed about how personal data is used.
The right of access to obtain confirmation and a copy of personal data.
The right to rectification of inaccurate or incomplete data.
The right to erasure in certain circumstances, also known as the right to be forgotten.
The right to restrict processing in certain circumstances.
The right to data portability for data provided by the individual and processed by automated means under certain lawful bases.
The right to object to processing based on legitimate interests or for direct marketing.
Rights related to automated decision-making and profiling, where applicable.

Where processing is based on consent, individuals may withdraw consent at any time. Where processing is based on legitimate interests, individuals may object and we will assess whether our grounds override the objection. In some cases, we may need to retain certain information to comply with legal obligations or to establish, exercise, or defend legal claims.

8. Exercising Your Rights

Requests relating to GDPR rights should be made in accordance with the procedures available to customers in the relevant area. We may need to verify identity before responding to protect personal data from unauthorised disclosure. We will respond within the time limits required by law and may extend the period where requests are complex or numerous.

If a request is refused or limited, we will explain the reason where permitted by law.

9. Children’s Data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children without appropriate consent or another lawful basis where required by law. If we become aware that personal data has been collected inappropriately, we will take steps to delete it or otherwise handle it in accordance with legal requirements.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, business operations, or processing practices. Any updated version will apply from the date it is made effective. Customers are encouraged to review this policy periodically to remain informed about how personal data is handled.

11. Summary of Our Commitments

We are committed to processing personal data fairly, lawfully, and transparently. We collect only what is necessary, use it for defined purposes, rely on valid lawful bases, retain it only for as long as needed, and share it only with appropriate processors or where required by law. We also respect the rights of individuals and apply suitable safeguards to protect personal data throughout its lifecycle.

By continuing to use our services, customers in the relevant area acknowledge the terms of this Privacy Policy.