Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in relation to services provided to customers in the relevant area. It applies to all customers in the area and is intended to reflect the requirements of the General Data Protection Regulation (GDPR) and applicable local data protection laws. By using the services, customers acknowledge that their personal data may be processed as described in this Policy.

1. Data We Collect

We may collect and process various categories of personal data depending on how customers interact with the services. The types of data collected may include:

Identity data such as name, username, or similar identifiers;
Contact data such as email address, billing details, or other communication details;
Transaction data such as records of services purchased or requested;
Technical data such as device information, IP address, browser type, operating system, and usage logs;
Usage data such as information about how customers access and use the services;
Preference data such as communication preferences and service settings;
Correspondence data such as records of support requests, complaints, or other communications.

In limited cases, we may also process special category data if it is voluntarily provided by the customer and if there is a valid legal basis under GDPR. Such data is processed only where strictly necessary and with appropriate safeguards.

2. How We Use Personal Data

Personal data is processed for specific, explicit, and legitimate purposes. These purposes may include:

Providing and maintaining the services;
Managing customer accounts and requests;
Processing payments, invoices, and refunds;
Communicating service updates, notices, and administrative information;
Improving service performance, quality, and user experience;
Detecting, investigating, and preventing fraud, misuse, or security incidents;
Complying with legal obligations and regulatory requirements;
Establishing, exercising, or defending legal claims.

We do not use personal data for purposes that are incompatible with those described in this Policy unless required or permitted by law.

3. Lawful Basis for Processing

Under GDPR, personal data must be processed on a valid lawful basis. We rely on the following lawful bases where applicable:

3.1 Performance of a Contract

We process personal data where it is necessary to enter into or perform a contract with a customer, or to take steps at the customer’s request before entering into a contract. This includes providing services, managing accounts, and completing transactions.

3.2 Legal Obligation

We may process personal data where needed to comply with a legal obligation, including tax, accounting, consumer protection, or data protection requirements.

3.3 Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided that those interests are not overridden by the customer’s rights and freedoms. Legitimate interests may include service improvement, security, fraud prevention, internal administration, and operational management.

3.4 Consent

In certain circumstances, we may rely on consent. Where consent is used, it will be obtained in a clear and informed manner. Customers may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

3.5 Vital Interests and Public Interest

Although less common, we may also process personal data where necessary to protect vital interests or where processing is carried out in the public interest or under official authority, if applicable.

4. Data Sharing and Processors

We may share personal data with trusted third parties acting as processors or, in some cases, independent controllers, only where necessary and in accordance with GDPR. These parties may process data on our behalf for the purposes set out in this Policy.

Categories of processors may include:

IT and hosting providers that support service infrastructure and data storage;
Payment service providers that process transactions securely;
Customer support tools used to manage inquiries and service communication;
Analytics providers that help us understand service use and performance;
Security and fraud prevention providers that help protect systems and customers;
Professional advisers such as auditors, legal counsel, or accountants, where necessary.

All processors are required to act only on our instructions, to implement appropriate technical and organisational security measures, and to respect confidentiality obligations. We do not sell personal data.

5. International Transfers

If personal data is transferred outside the European Economic Area or the United Kingdom, such transfer will be carried out only where adequate safeguards are in place. These safeguards may include adequacy decisions, standard contractual clauses, or other approved legal mechanisms. Appropriate protection is applied to ensure that personal data remains protected to the standard required by GDPR.

6. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including the purposes of satisfying legal, accounting, tax, or reporting obligations. Retention periods vary depending on the type of data and the context in which it was collected.

When determining retention, we consider:

The nature and sensitivity of the data;
The potential risk of harm from unauthorised use or disclosure;
The purposes of processing and whether those purposes can be achieved by other means;
Legal and regulatory requirements;
Whether a legal claim may arise or be defended.

Once data is no longer needed, it is securely deleted, anonymised, or otherwise disposed of in a controlled manner.

7. Security of Personal Data

We implement appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, unlawful use, alteration, or disclosure. These measures may include access controls, encryption, monitoring, backup procedures, and staff confidentiality obligations. While no system can be guaranteed completely secure, we continuously work to improve our safeguards.

8. User Rights Under GDPR

Customers whose personal data is processed under this Policy have certain rights under GDPR. Subject to legal limits and verification of identity, these rights may include:

Right of access – to obtain confirmation of whether personal data is processed and to receive a copy of that data;
Right to rectification – to request correction of inaccurate or incomplete data;
Right to erasure – to request deletion of personal data in certain circumstances;
Right to restriction of processing – to request limitation of how data is used in certain cases;
Right to data portability – to receive data in a structured, commonly used, machine-readable format and to transmit it where applicable;
Right to object – to object to processing based on legitimate interests or direct marketing;
Right to withdraw consent – where processing is based on consent, to withdraw that consent at any time;
Right not to be subject to automated decision-making – including profiling, where such decisions produce legal or similarly significant effects, subject to lawful exceptions.

Customers may also have the right to lodge a complaint with their local data protection authority if they believe their rights have been infringed. We encourage customers to raise concerns so they can be addressed promptly and fairly.

9. Children’s Data

The services are not directed to children unless expressly stated otherwise. We do not knowingly collect personal data from children without appropriate lawful basis and, where required, parental or guardian authorisation. If we become aware that personal data has been collected from a child in error, we will take reasonable steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, business practices, or service operations. Any revised version will apply from the date it becomes effective. Customers are encouraged to review the Policy periodically to remain informed about how personal data is processed.

11. Scope and Application

This Privacy Policy applies to all customers in the area and governs the processing of personal data in connection with the services described here. By using the services, customers confirm that they understand how their data is collected and used in accordance with this Policy and with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

Summary of commitments:

We collect only data needed to provide and improve services;
We process data on valid lawful bases under GDPR;
We use processors only under contractual and security safeguards;
We retain data only as long as necessary;
We respect and support customer rights.

This Policy is designed to provide clear and transparent information about personal data processing and to uphold the rights and freedoms of every customer in the area.