Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when individuals interact with our services. It applies to all customers in the area where our services are offered and is intended to meet the requirements of the General Data Protection Regulation (GDPR). By using our services, customers acknowledge that their personal data may be processed in accordance with this policy and applicable data protection law.

1. Scope of this Policy

This policy applies to personal data relating to customers, prospective customers, and other individuals whose information is processed in connection with our business activities. It covers data collected through direct interactions, automated technologies, service usage, and information received from third parties where permitted by law.

Personal data means any information relating to an identified or identifiable natural person. This may include direct identifiers such as a name or contact details, as well as indirect identifiers such as online identifiers, transaction history, or usage patterns.

2. Data Collection

We collect only the personal data that is necessary and relevant for the purposes described in this policy. Data may be collected in the following ways:

Information provided by the customer: data submitted when creating an account, placing an order, making an inquiry, or communicating with us.
Information collected automatically: technical and usage data such as device type, browser information, IP address, log data, and interaction history.
Information from third parties: data obtained from service providers, payment processors, fraud-prevention partners, or publicly available sources where lawful.

The categories of personal data may include:

Identification details, such as name or customer reference number
Contact details, such as email address, postal address, or telephone number
Transaction and payment-related information
Communication records and support requests
Technical, device, and usage information

We do not intentionally collect special category data unless it is necessary for a specific lawful purpose and subject to additional safeguards.

3. Purposes of Processing

Personal data is processed only for defined and legitimate purposes, including:

Providing, managing, and improving our services
Processing transactions and fulfilling requests
Maintaining customer records and service history
Communicating important updates and service-related information
Preventing fraud, misuse, or unauthorized access
Complying with legal, tax, accounting, and regulatory obligations
Ensuring network, system, and information security

We will not process personal data in a manner that is incompatible with these purposes.

4. Lawful Basis for Processing

Under GDPR, personal data may only be processed where a lawful basis applies. Depending on the context, we rely on one or more of the following lawful bases:

Performance of a contract: processing is necessary to provide services, manage customer accounts, or carry out obligations before entering into a contract.
Legal obligation: processing is required to comply with applicable laws and regulatory requirements.
Legitimate interests: processing is necessary for our legitimate business interests, such as improving services, ensuring security, and preventing fraud, provided these interests are not overridden by the customer’s rights and freedoms.
Consent: in limited cases, we may rely on freely given, specific, informed, and unambiguous consent. Where consent is used, it may be withdrawn at any time.

Where we rely on legitimate interests, we conduct an assessment to ensure the processing is proportionate and respectful of data protection principles.

5. Data Sharing and Processors

We may share personal data with trusted third parties that process data on our behalf or for independent legal reasons. These recipients may include:

Processors: service providers that act under our instructions, such as hosting providers, IT support providers, cloud service providers, analytics providers, and administrative support services.
Payment and financial service providers: where necessary to complete payment-related transactions.
Professional advisers: such as legal, compliance, or accounting advisers where required.
Public authorities: where disclosure is required by law or necessary for regulatory, tax, or legal proceedings.

Processors are contractually required to protect personal data, process it only on our documented instructions, and apply appropriate technical and organizational security measures. They are not permitted to use personal data for their own purposes unless separately authorized by law.

Where personal data is transferred outside the European Economic Area, appropriate safeguards will be used, such as adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms.

6. Retention of Personal Data

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including for legal, accounting, audit, or reporting requirements. The retention period depends on the type of data and the reason for processing.

Data used for contractual performance is kept for the duration of the relationship and for an additional period where needed to handle claims or disputes.
Data required by law, including tax or financial records, is retained for the period mandated by applicable legislation.
Data processed on the basis of consent is retained until consent is withdrawn or until it is no longer needed for the stated purpose.
Technical and security logs are kept for a limited period necessary to maintain security and investigate incidents.

When personal data is no longer required, it is securely deleted, anonymized, or otherwise rendered inaccessible in accordance with our retention and disposal procedures.

7. Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption where appropriate, system monitoring, data minimization, and staff confidentiality obligations.

While no system can be guaranteed to be completely secure, we regularly review and improve safeguards in line with the nature of the data and associated risks.

8. User Rights

Individuals whose personal data is processed under this policy have rights under GDPR. Subject to legal limitations, these rights include:

Right of access: to obtain confirmation and a copy of personal data being processed.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request limited processing in specific situations.
Right to data portability: to receive data in a structured, commonly used, machine-readable format where applicable.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: to withdraw consent at any time where processing is based on consent.
Right to lodge a complaint: to submit a complaint to the relevant supervisory authority if they believe their data protection rights have been infringed.

Requests related to these rights should be handled within the time limits required by GDPR. Before acting on a request, reasonable steps may be taken to verify identity to protect personal data from unauthorized disclosure.

9. Data Minimization and Accuracy

We aim to collect only the personal data that is necessary for the relevant purpose and to keep it accurate and up to date. Customers are encouraged to notify us of any changes to their information so that records remain correct and processing remains reliable.

10. Children’s Data

Our services are not intended for children unless explicitly stated otherwise. We do not knowingly collect personal data from children where doing so would require parental consent or other special safeguards under applicable law.

11. Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects unless such processing is lawful, necessary, and accompanied by appropriate safeguards. Where automated tools are used, they are designed to support, not replace, meaningful human oversight when required.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service developments. Any revised version will apply from the date it becomes effective. Continued use of the services after changes take effect indicates acknowledgment of the updated policy.

Summary of Key Commitments

Transparency: we explain what data is collected and why.
Lawfulness: processing is based on a valid GDPR lawful basis.
Retention control: data is kept only as long as necessary.
Processor oversight: third parties are bound by contractual safeguards.
Rights respect: customer rights are recognized and supported.

Important: This policy applies to all customers in the area and is intended to ensure personal data is handled fairly, securely, and in accordance with GDPR principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.