Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when services are provided to customers in the relevant area. It applies to all customers in that area and is intended to comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Who this policy applies to

This policy applies to all customers in the area where the services are offered. It covers personal data processed in connection with inquiries, account creation, service delivery, communications, billing, support, and any related interactions. By using the services or otherwise providing personal data, individuals acknowledge that their data may be processed as described in this policy.

2. Personal data we collect

We may collect and process different categories of personal data depending on how a person interacts with the services. The data collected may include:

• Identity data such as name, username, or similar identifiers
• Contact data such as address, email address, telephone number, or delivery details
• Transaction data such as payment status, invoices, order details, and service records
• Technical data such as device information, IP address, browser type, operating system, and log data
• Usage data such as service interactions, preferences, and activity history
• Communication data such as messages, feedback, complaints, and support requests
• Profile data such as preferences, account settings, and service history

We generally collect data directly from the individual, but we may also receive data from third parties, business partners, payment providers, analytics tools, and service processors where permitted by law.

3. How we use personal data

Personal data is processed for lawful, specific, and legitimate purposes. These may include:

• providing, operating, and managing services
• creating and administering customer accounts
• processing payments, invoices, and refunds
• responding to inquiries and support requests
• personalizing the customer experience
• maintaining records and internal administration
• detecting, preventing, and investigating fraud or misuse
• complying with legal, regulatory, and tax obligations
• improving service quality, security, and performance
• sending service-related notices and updates

Where required, we will seek consent before using personal data for optional purposes such as certain marketing activities. Any consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Lawful basis for processing

Under GDPR, every processing activity must have a lawful basis. We rely on one or more of the following:

Performance of a contract

We process personal data where it is necessary to enter into or perform a contract with a customer, including service delivery, account management, billing, and support.

Legal obligation

We may process personal data to meet legal obligations, including accounting, tax, consumer protection, recordkeeping, and regulatory compliance.

Legitimate interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the individual’s rights and freedoms. This may include service improvement, security monitoring, fraud prevention, and internal administration.

Consent

In limited situations, we rely on consent. Where consent is the lawful basis, individuals have the right to withdraw it at any time. Withdrawal does not affect processing already carried out.

Vital interests and public interest

In rare cases, processing may be necessary to protect someone’s vital interests or to perform a task carried out in the public interest, where applicable.

5. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, and reporting requirements. Retention periods depend on the type of data, the purpose of processing, and any legal obligations that apply.

In general, data is retained for the duration of the customer relationship and for a reasonable period afterward to allow for administration, dispute resolution, and compliance. When personal data is no longer needed, it is securely deleted, anonymized, or otherwise rendered inaccessible in accordance with our retention practices.

Retention principles include:

• keeping data only as long as necessary
• reviewing data periodically for deletion or anonymization
• retaining records required by law for the mandated period
• restricting access to archived information

6. Sharing and processors

We may share personal data with trusted third parties where necessary to provide services, comply with legal obligations, or support operations. Such third parties may act as processors or independent controllers depending on the circumstances.

Processors may include providers of hosting, cloud storage, payment processing, analytics, customer support tools, communication systems, document management, and security services. These processors are only permitted to process personal data on our instructions and are required to maintain appropriate confidentiality, security, and data protection measures.

Where personal data is shared with independent controllers, such as auditors, legal advisers, regulators, or payment institutions, those parties determine their own processing purposes and are responsible for their own compliance.

We require, where appropriate, that processors use appropriate technical and organizational measures to protect personal data. These measures may include access controls, encryption, secure storage, logging, backups, and incident response procedures.

7. International transfers

If personal data is transferred outside the European Economic Area or another jurisdiction with comparable data protection rules, appropriate safeguards will be used where required. These may include standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms recognized under GDPR. Any such transfer will be managed to ensure an adequate level of protection for personal data.

8. Data security

We use reasonable and appropriate measures to protect personal data against accidental loss, unauthorized access, misuse, alteration, or disclosure. Security controls may include limited access, authentication measures, secure storage, monitoring, and staff training. However, no method of transmission or storage is completely secure, and while we take care to protect data, absolute security cannot be guaranteed.

9. User rights under GDPR

Individuals whose personal data is processed under this policy have rights under GDPR. Subject to legal limitations and verification of identity, these rights may include:

• Right of access – to obtain confirmation and a copy of personal data being processed
• Right to rectification – to correct inaccurate or incomplete data
• Right to erasure – to request deletion of personal data in certain circumstances
• Right to restriction – to limit processing in certain situations
• Right to data portability – to receive certain data in a structured, commonly used format and transfer it where applicable
• Right to object – to object to processing based on legitimate interests or direct marketing
• Right to withdraw consent – where processing is based on consent
• Right not to be subject to solely automated decision-making – where applicable and legally relevant

Requests to exercise rights may be subject to verification and may not always be granted where exemptions or legal obligations apply. Responses will be provided within the timeframes required by law.

10. Children’s data

The services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children in a manner that would violate applicable law. If we become aware that personal data has been collected unlawfully from a child, we will take appropriate steps to delete it or obtain valid authorization where permitted.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in law, operational practices, or service requirements. The revised policy will apply from the effective date stated in the updated version. Continued use of the services after changes take effect indicates acknowledgment of the updated policy, subject to applicable law.

12. General principles

We are committed to processing personal data in accordance with the core principles of GDPR, including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. Personal data is processed only where necessary and only for clearly defined purposes.

By using the services, customers in the relevant area understand that their personal data may be processed in line with this Privacy Policy.