Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected. It applies to all customers in the area and is intended to reflect key requirements of the General Data Protection Regulation (GDPR). By using our services, customers acknowledge that their personal data may be processed in accordance with this Policy and applicable data protection law.

1. Data We Collect

We collect only the personal data that is necessary for specified, explicit, and legitimate purposes. Depending on how you interact with us, we may collect the following categories of data:

Identity data: such as your name or similar identifiers.
Contact data: such as address, email address, or phone number where relevant.
Transaction data: details about products, services, payments, and related records.
Service usage data: information about how you access or use our services.
Technical data: device information, log data, browser type, and similar technical information.
Communication data: records of correspondence and service-related interactions.

We do not intentionally collect special category data unless it is strictly necessary and permitted by law. Where such information is processed, additional safeguards and legal conditions will apply.

2. How We Use Personal Data

Personal data is used only for lawful and relevant business purposes. These may include:

Providing and managing services for customers in the area.
Processing transactions and maintaining business records.
Responding to customer requests and supporting service delivery.
Improving service quality, safety, and operational performance.
Meeting legal, regulatory, accounting, and tax obligations.
Protecting against fraud, misuse, security incidents, or unlawful activity.

We will not use personal data in ways that are incompatible with the purposes for which it was collected, unless we have a valid lawful basis to do so.

3. Lawful Basis for Processing

Under GDPR, we must identify a lawful basis for each processing activity. Depending on the context, we may rely on one or more of the following:

Contract

We process personal data when it is necessary to enter into or perform a contract with a customer, including delivering services, handling payments, and managing related communications.

Legal Obligation

Some data must be processed to comply with legal duties, such as recordkeeping, tax obligations, fraud prevention, or regulatory requirements.

Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests, provided that those interests are not overridden by the rights and freedoms of the individual. Examples may include service improvement, internal administration, risk management, and security monitoring.

Consent

Where required by law, we will seek your consent before processing your personal data. When consent is used, it will be informed, specific, freely given, and capable of being withdrawn at any time.

Important: Where we rely on consent, you may withdraw it without affecting the lawfulness of processing carried out before withdrawal.

4. Retention of Personal Data

We retain personal data only for as long as necessary for the purposes for which it was collected, or for as long as required by law. Retention periods vary depending on the type of data and the reason for processing.

Contract and service records are kept for the duration of the relationship and for a reasonable period afterward.
Financial and accounting records are retained in line with legal and tax obligations.
Communication records are retained as needed to manage queries, disputes, or service matters.
Security and system logs are retained for a limited period for monitoring and protection purposes.

When data is no longer required, it will be deleted, anonymised, or securely destroyed. In some cases, data may be retained longer where necessary to comply with legal claims, investigations, or regulatory requirements.

5. Processors and Data Sharing

We may share personal data with trusted third parties that act as data processors or, where applicable, independent controllers. Processors only handle personal data on our documented instructions and are required to maintain appropriate security and confidentiality measures.

Typical categories of processors may include:

IT and hosting providers
Payment and transaction service providers
Administrative and operational support providers
Security, backup, and data storage providers
Professional advisers, where needed for legal, accounting, or compliance purposes

We may also disclose personal data where required by law, court order, regulatory request, or to protect our rights, users, customers, or the public. Any international transfer of personal data will be subject to appropriate safeguards where required by GDPR.

6. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures may include access controls, encryption where appropriate, monitoring, and staff confidentiality obligations.

However, no method of storage or transmission is completely secure. While we work to protect personal data, we cannot guarantee absolute security. If a personal data breach occurs, we will act in accordance with applicable law, including assessment, mitigation, and notification where required.

7. Your Rights Under GDPR

Individuals whose personal data is processed under this Policy have the following rights, subject to applicable legal limits and exemptions:

Right of access: to request confirmation of whether personal data is being processed and to obtain a copy.
Right to rectification: to correct inaccurate or incomplete personal data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request limited use of personal data in certain situations.
Right to data portability: to receive certain data in a structured, commonly used, machine-readable format and transmit it where legally applicable.
Right to object: to object to processing based on legitimate interests or direct marketing, where applicable.
Right to withdraw consent: where processing is based on consent, you may withdraw that consent at any time.

If you exercise a right, we may need to verify your identity before responding. We will respond within the time limits required by applicable law unless an extension is lawfully permitted due to complexity or volume of requests.

8. Automated Decision-Making

We do not use personal data for decisions based solely on automated processing that produce legal or similarly significant effects unless permitted by law and appropriate safeguards are in place. If this changes, we will provide clear information about the logic involved and the rights available to affected individuals.

9. Children’s Data

Our services are intended for customers in the area and are not directed at children unless stated otherwise. We do not knowingly collect personal data from children where such collection would require special consent or additional protections. If we become aware that data has been collected in breach of this Policy, we will take reasonable steps to remove or secure it in line with legal requirements.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, business practices, or service operations. Updated versions will apply from the date they take effect. We encourage customers to review this Policy periodically to remain informed about how personal data is handled.

11. General Principles

We are committed to the GDPR principles of lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. This means we aim to process only what is necessary, keep data accurate, limit retention, and protect data throughout its lifecycle.

Where appropriate, we may also apply privacy by design and by default so that data protection is considered from the start of any service, system, or process. We will continue to review our practices to ensure that personal data is handled responsibly and in accordance with applicable law.

12. Scope of This Policy

This Privacy Policy applies to all customers in the area and covers personal data processed in connection with our services, operations, and legal obligations. By engaging with our services, customers acknowledge that their personal data may be processed as described above and in a manner consistent with GDPR requirements.