Privacy Policy

This Privacy Policy explains how we collect, use, disclose, and protect personal data in connection with our services. It applies to all customers in the area where our services are offered, regardless of whether the interaction takes place online, in person, or through any other service channel. We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with the General Data Protection Regulation (GDPR).

1. Data We Collect

We may collect and process the following categories of personal data:

• Identity data: name, title, and similar identifiers.
• Contact data: address, email address, telephone number, and billing or delivery details.
• Account and transaction data: service history, purchase records, payment status, and related communications.
• Technical data: device type, browser type, IP address, login data, and usage information.
• Preference data: communication preferences, service choices, and customer settings.
• Correspondence data: information provided when you contact us or respond to our communications.

We generally collect personal data directly from you when you provide it to us. In some cases, we may also receive data from third parties, for example from payment providers, delivery partners, or service platforms used in the course of providing our services.

2. How We Use Personal Data

We use personal data only where we have a lawful basis to do so. The main purposes for processing are:

• to provide and manage our services;
• to process transactions and maintain records;
• to communicate with customers about services, updates, or changes;
• to handle enquiries, complaints, and support requests;
• to improve service quality, operations, and customer experience;
• to maintain security, prevent fraud, and protect our systems;
• to comply with legal and regulatory obligations.

We will not use personal data for purposes that are incompatible with the original reason for collection unless we have a valid legal basis and have informed you where required.

3. Lawful Basis for Processing

Under GDPR, we rely on one or more of the following lawful bases:

3.1 Performance of a Contract

We process personal data where it is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract. This includes processing needed to deliver services, manage payments, and fulfil customer requests.

3.2 Legal Obligation

We may process personal data where necessary to comply with legal obligations, such as record-keeping, tax rules, accounting requirements, or lawful requests from public authorities.

3.3 Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided that those interests are not overridden by your rights and freedoms. Examples include service improvement, fraud prevention, business administration, network and information security, and internal reporting.

3.4 Consent

In certain limited circumstances, we may rely on your consent. Where we do, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

4. Sharing and Processors

We may share personal data with trusted third parties who act as processors on our behalf. These processors are required to process personal data only according to our instructions and to implement appropriate technical and organisational security measures.

Processors may include:

• IT and hosting providers supporting storage, infrastructure, and system maintenance;
• payment service providers handling financial transactions;
• customer support tools assisting with service management and communication;
• analytics and reporting providers helping us understand usage trends and improve services;
• professional advisers such as accountants, auditors, or legal advisers where necessary;
• delivery, logistics, or operational partners involved in service fulfilment.

We may also disclose personal data when required by law, in response to lawful requests, or to protect our rights, users, staff, or property. If a third party acts as an independent controller, their own privacy terms may also apply.

5. International Transfers

Where personal data is transferred outside the European Economic Area, we will ensure that appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms permitted under GDPR. We take reasonable steps to ensure that any such transfer maintains an adequate level of protection.

6. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, regulatory, or reporting requirements. Retention periods depend on the type of data, the reason for processing, and any applicable legal obligation.

In general:

• Contract and transaction records are retained for the period needed to manage the customer relationship and comply with legal obligations.
• Support and correspondence records are retained for a reasonable period to resolve enquiries and maintain service history.
• Technical and security logs are retained for a limited time unless a longer period is required for investigation or legal compliance.

When personal data is no longer required, we will delete it, anonymise it, or securely archive it in accordance with our retention procedures.

7. Security of Personal Data

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures may include access controls, encryption, secure storage, staff training, and regular security reviews. However, no method of transmission or storage is completely secure.

8. Your Rights Under GDPR

Subject to applicable legal conditions, you have the following rights regarding your personal data:

• Right of access: you may request confirmation of whether we process your data and obtain a copy of it.
• Right to rectification: you may ask us to correct inaccurate or incomplete data.
• Right to erasure: you may request deletion of your data in certain circumstances.
• Right to restriction: you may request limitation of processing in specific situations.
• Right to data portability: you may request your data in a structured, commonly used format where applicable.
• Right to object: you may object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

You also have the right to raise concerns with a relevant supervisory authority if you believe your data has been processed unlawfully. Exercising your rights will not usually result in any charge, although we may refuse or charge a reasonable fee where a request is manifestly unfounded, repetitive, or excessive, in line with GDPR.

9. Children’s Data

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children in a way that would require additional consent or legal protection under applicable law. If we become aware that we have collected data inappropriately, we will take appropriate steps to delete it or obtain valid authorisation where necessary.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service operations. Any updated version will apply from the date it takes effect. We encourage customers to review this policy periodically so they remain informed about how personal data is handled.

11. General Statement

This Privacy Policy applies to all customers in the area and is intended to ensure that personal data is handled in a lawful, transparent, and secure manner. We respect your privacy and aim to process only the data that is necessary for legitimate, defined purposes. Where required, we will use clear, specific, and understandable language when explaining our data practices.

By using our services, you acknowledge that personal data may be processed in accordance with this Privacy Policy and the applicable provisions of GDPR.