Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected in connection with our services. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and applicable local data protection laws. We are committed to processing personal data fairly, transparently, and only for lawful purposes.

1. Scope of This Policy

This policy applies to personal data relating to identified or identifiable individuals, including customers, prospective customers, and other persons who interact with our services. It covers data collected through direct interactions, automated technologies, and information received from third parties where permitted by law. The policy also explains the rights available to individuals under GDPR.

This policy applies to all customers in the area, regardless of whether the data is collected online, offline, or through customer support and operational channels.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

• Identity data such as name, title, and any account or customer identifier.
• Contact data such as address, email address, and telephone number.
• Transaction data such as payment records, service history, and purchase details.
• Technical data such as device type, browser information, log files, and usage patterns.
• Communication data such as messages, inquiries, feedback, and support records.
• Preference data such as language choice, marketing preferences, and service settings.

We do not intentionally collect more data than is necessary for the purposes described in this policy. Where special category data is not required, we do not seek to process it. If such data is ever processed, it will only be done where a specific legal basis applies and additional safeguards are in place.

3. How We Use Personal Data

Personal data is used only for specified, explicit, and legitimate purposes. These purposes may include:

• providing and managing services;
• processing transactions and maintaining records;
• responding to inquiries and support requests;
• operating, maintaining, and improving our systems and services;
• ensuring security, fraud prevention, and abuse detection;
• meeting legal and regulatory obligations;
• sending relevant updates or service notices where permitted;
• analyzing service performance and customer trends.

We use data minimization principles and only process data that is relevant and necessary for the intended purpose. Where possible, we aggregate or pseudonymize data to reduce privacy risks.

4. Lawful Basis for Processing

We process personal data under one or more of the lawful bases permitted by GDPR:

• Contract — where processing is necessary to enter into or perform a contract with you.
• Legal obligation — where processing is necessary to comply with a legal or regulatory requirement.
• Legitimate interests — where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.
• Consent — where you have given clear consent for a specific purpose, such as certain marketing activities.
• Vital interests — in rare situations where processing is necessary to protect someone’s life.
• Public task — where applicable law permits processing for a task carried out in the public interest.

When we rely on consent, you may withdraw it at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

5. Retention of Personal Data

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including any legal, accounting, reporting, or audit requirements. Retention periods are determined by considering:

• the nature and sensitivity of the data;
• the purpose of processing;
• legal and regulatory obligations;
• the risk of harm from unauthorized use or disclosure;
• whether the data is needed to establish, exercise, or defend legal claims.

When personal data is no longer required, it is securely deleted, anonymized, or archived in line with applicable legal requirements. In some cases, records may be retained for longer where law requires it or where a legitimate legal purpose exists.

6. Data Sharing and Processors

We may share personal data with third parties only where necessary and consistent with this policy. Such recipients may include processors acting on our behalf, and in limited cases, independent controllers such as regulatory authorities or professional advisors.

Processors may provide services such as:

• IT hosting and infrastructure;
• system maintenance and technical support;
• payment processing;
• analytics and reporting;
• communication tools and customer service platforms;
• document storage and archival services.

All processors are required to handle personal data under written agreements that include GDPR-compliant safeguards, confidentiality obligations, security measures, and restrictions on using the data for their own purposes. We only engage processors that provide sufficient guarantees to implement appropriate technical and organizational measures.

We may also disclose personal data where required by law, court order, or lawful request from a public authority, or where disclosure is necessary to protect rights, safety, or property.

7. International Transfers

If personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, or other legally recognized transfer mechanisms. Where required, additional technical or organizational measures may also be used to protect the data during transfer and processing.

8. Security Measures

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, destruction, or disclosure. These measures may include access controls, encryption, secure storage, logging, staff confidentiality obligations, and regular security reviews.

While no system can be guaranteed to be completely secure, we take reasonable and proportionate steps to reduce risk and respond appropriately to incidents. In the event of a personal data breach, we will assess the situation and notify supervisory authorities and affected individuals where required by law.

9. Your Rights Under GDPR

Subject to applicable legal conditions and exemptions, individuals have the following rights regarding their personal data:

• Right of access — to request confirmation of whether personal data is being processed and to obtain a copy.
• Right to rectification — to request correction of inaccurate or incomplete data.
• Right to erasure — to request deletion of personal data in certain circumstances.
• Right to restriction — to request limitation of processing in certain situations.
• Right to data portability — to receive data in a structured, commonly used, machine-readable format where applicable.
• Right to object — to object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent — where processing is based on consent.
• Right not to be subject to solely automated decisions — where applicable, with certain exceptions.

We will respond to rights requests within the timeframe required by GDPR, usually within one month, unless the request is complex or numerous. In such cases, the response period may be extended in accordance with the law.

10. Data Subject Requests

To exercise your rights, you may submit a request through the channels made available for customer support or privacy matters. We may need to verify your identity before completing a request to protect your data from unauthorized access. If a request is unfounded, repetitive, or excessive, we may refuse it or charge a reasonable fee where permitted by law.

You also have the right to lodge a complaint with a supervisory authority if you believe your personal data has been processed unlawfully. We encourage individuals to raise concerns with us first so that we may address them promptly and appropriately.

11. Cookies and Similar Technologies

Where applicable, we may use cookies or similar technologies for essential functionality, performance analysis, and preference storage. Non-essential technologies will be used only where lawful, such as with consent where required. You can manage browser settings or other available controls to limit certain technologies, though some features may not function properly if disabled.

12. Children’s Data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children without appropriate legal basis and, where relevant, parental consent or other lawful authorization. If we become aware that personal data has been collected unlawfully from a child, we will take appropriate steps to delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. When changes are made, the updated version will apply from the stated effective date. We encourage individuals to review the policy periodically to stay informed about how personal data is handled.

14. Principles We Follow

Our approach to privacy is based on the GDPR principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. These principles guide our collection, use, sharing, and retention of personal data. We aim to ensure that processing is always proportionate and respectful of individual rights.

By using our services, you acknowledge that personal data may be processed as described in this Privacy Policy, subject to your rights under applicable law.