Privacy Policy

This Privacy Policy explains how personal data is collected, used, shared, retained, and protected in connection with our services. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using our services, you acknowledge that your personal data may be processed as described in this Policy.

1. Data We Collect

We collect only the data that is necessary for specified and legitimate purposes. Depending on how you interact with us, we may collect the following categories of personal data:

Identity data: name, title, and similar identifiers.
Contact data: address, email address, telephone number, or other communication details.
Account and transaction data: records of purchases, service requests, billing details, and payment-related information.
Technical data: device identifiers, browser type, operating system, IP address, and usage logs.
Service interaction data: preferences, feedback, correspondence, and support-related information.

We do not intentionally collect special category data unless it is required and lawful to do so. If such data is ever collected, it will be handled in accordance with applicable legal safeguards.

2. How We Use Personal Data

We use personal data only for lawful, relevant, and limited purposes. These purposes may include:

providing and managing services;
processing transactions and maintaining records;
communicating with customers about service matters;
improving operations, quality, and user experience;
meeting legal, regulatory, accounting, or tax obligations;
protecting against fraud, misuse, or security incidents;
responding to requests, complaints, or disputes.

We will not use personal data for purposes that are incompatible with the reasons for which it was collected unless we have a valid lawful basis and, where required, your consent.

3. Lawful Basis for Processing

Under GDPR, we process personal data only when we have a valid legal basis. The lawful bases we rely on may include:

Contract

We process data when it is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract.

Legal Obligation

We may process data to comply with legal requirements, including tax, accounting, consumer protection, and regulatory obligations.

Legitimate Interests

We may process data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Examples include service administration, internal reporting, fraud prevention, security, and improvement of services.

Consent

In some circumstances, we may rely on your consent. Where consent is used, it will be informed, specific, freely given, and capable of withdrawal at any time.

Vital Interests

In rare situations, we may process personal data to protect someone’s vital interests.

4. Data Sharing and Processors

We may share personal data with trusted third parties that help us operate our services. These parties act as data processors or, in some cases, independent controllers. We only share data when necessary and require appropriate contractual safeguards.

Processors may include:

IT and hosting providers: for secure storage, infrastructure, and system maintenance;
Payment and billing providers: for transaction processing and financial administration;
Customer service tools: for managing support requests and communications;
Analytics providers: for service performance and usage analysis;
Professional advisers: such as legal, accounting, or audit advisers where necessary;
Authorities and regulators: where disclosure is required by law or to protect rights and safety.

All processors are selected with care and are required to implement appropriate technical and organisational measures to protect personal data. They are not permitted to use the data for their own unrelated purposes.

5. International Transfers

If personal data is transferred outside the European Economic Area, we will ensure that appropriate safeguards are in place. These may include adequacy decisions, Standard Contractual Clauses, or other lawful transfer mechanisms. We take steps to ensure that transferred data receives a level of protection that is essentially equivalent to GDPR standards.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, and reporting requirements. Retention periods vary depending on the type of data and the context of processing.

When determining retention periods, we consider:

the amount, nature, and sensitivity of the data;
the risk of harm from unauthorised use or disclosure;
the purposes of processing and whether they can be achieved by other means;
legal and regulatory obligations;
applicable limitation periods for claims or disputes.

When data is no longer needed, we will securely delete, anonymise, or otherwise dispose of it in accordance with our retention procedures.

7. Your Rights Under GDPR

Subject to legal conditions and exemptions, you have the following rights regarding your personal data:

Right of access: to obtain confirmation and a copy of your personal data.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of data in certain circumstances.
Right to restriction: to request limited processing in specific cases.
Right to data portability: to receive data you provided in a structured, commonly used format and, where feasible, have it transmitted to another controller.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right not to be subject to solely automated decisions: to request human review where applicable.

We may need to verify your identity before responding to a rights request. We aim to respond within the time limits set by GDPR, usually within one month, unless the request is complex or numerous.

8. Security of Personal Data

We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures may include access controls, encryption where appropriate, staff confidentiality obligations, and monitoring of systems. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Children’s Data

Our services are not intended for children unless explicitly stated otherwise. We do not knowingly collect personal data from children without appropriate legal basis and necessary authorisation. If we become aware that data has been collected unlawfully from a child, we will take steps to delete it where required.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our operations, or our data practices. Any updates will take effect when posted or otherwise communicated. We encourage customers to review this Policy periodically to stay informed.

11. Additional GDPR Principles

We are committed to the core principles of GDPR, including lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. We aim to process personal data in a manner that is proportionate, secure, and respectful of individual rights.

12. How This Policy Applies

This Privacy Policy applies to all customers in the area, regardless of whether they interact with us online, by phone, in person, or through any other service channel. It governs the processing of personal data collected in the course of providing services, handling enquiries, maintaining accounts, and supporting customer relationships.

By continuing to use our services, you confirm that you have read and understood this Policy and the ways in which your personal data may be processed. If we need to rely on consent for a particular activity, we will request it separately and clearly.