Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected in connection with our services. It applies to all customers in the area where our services are offered, and it is intended to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using our services, you acknowledge that your personal data may be processed as described in this Policy.

1. Data We Collect

We may collect and process different categories of personal data depending on how you interact with us. The data we collect may include:

Identification data such as your name, username, or customer reference number.
Contact data such as your email address, billing address, and other service-related communication details.
Transaction data such as information about purchases, service requests, and payment status.
Technical data such as device type, browser type, operating system, IP address, and log information.
Usage data such as interactions with our services, preferences, and activity records.
Communication data such as messages, feedback, complaints, and support requests.

We may also collect limited data from third parties where permitted by law, such as service providers, payment processors, or publicly available sources. Where required, we will inform you when data is collected directly from another source.

2. How We Use Your Data

We use personal data only for specific, explicit, and legitimate purposes. These purposes may include:

Providing and managing our services.
Processing transactions and fulfilling requests.
Maintaining records and internal administration.
Improving service quality, performance, and user experience.
Managing customer support and responding to inquiries.
Ensuring security, preventing fraud, and detecting misuse.
Complying with legal and regulatory obligations.

We do not use personal data for purposes that are incompatible with the original reason for collection unless we have a valid legal basis and provide appropriate notice where required.

3. Lawful Basis for Processing

Under GDPR, we process personal data only when we have a lawful basis to do so. Depending on the activity, our lawful bases may include:

a. Performance of a Contract

We process data when it is necessary to provide services, fulfill orders, manage accounts, or take steps requested before entering into a contract.

b. Legal Obligation

We process data when required to comply with applicable law, tax rules, accounting obligations, or regulatory requirements.

c. Legitimate Interests

We may process data for our legitimate business interests, such as improving services, securing systems, preventing fraud, or maintaining business records, provided those interests are not overridden by your rights and freedoms.

d. Consent

Where required by law, we rely on your consent to process certain data. If we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

e. Vital Interests and Public Interest

In rare cases, we may process data to protect vital interests or to perform tasks carried out in the public interest, where permitted by law.

4. Data Retention

We retain personal data only for as long as necessary to achieve the purposes for which it was collected, including satisfying legal, accounting, reporting, and operational requirements. Retention periods vary depending on the type of data, the reason for processing, and applicable legal obligations.

When determining retention periods, we consider:

The amount, nature, and sensitivity of the data.
The potential risk of harm from unauthorized use or disclosure.
The purposes for which we process the data and whether those purposes can be achieved elsewhere.
Legal obligations requiring retention for a specified period.

When personal data is no longer needed, we will securely delete, anonymize, or irreversibly archive it in a manner consistent with applicable law.

5. Processors and Sharing of Data

We may use third-party service providers, also known as processors, to perform functions on our behalf. These processors process personal data only under our instructions and are required to implement appropriate technical and organizational safeguards.

Examples of processors may include:

IT hosting and infrastructure providers.
Payment and transaction processing services.
Customer support and communication tools.
Analytics and performance monitoring providers.
Security and fraud prevention services.

We may also share personal data where necessary with professional advisers, auditors, regulators, or public authorities when required by law or when reasonably necessary to protect our rights, users, or operations. Any such sharing will be limited to what is necessary and lawful.

Where personal data is transferred outside the European Economic Area, we will ensure appropriate safeguards are in place, such as standard contractual clauses or other lawful transfer mechanisms recognized under GDPR.

6. Data Security

We take appropriate technical and organizational measures to protect personal data against accidental loss, unauthorized access, alteration, disclosure, or destruction. These measures may include access controls, encryption, secure storage, staff training, and regular review of our security practices.

Although no system can be guaranteed completely secure, we continuously work to reduce risk and to safeguard data in line with industry standards and legal requirements.

7. Your Rights Under GDPR

Subject to legal conditions and limitations, you have the following rights regarding your personal data:

Right of access – to obtain confirmation about whether we process your data and to receive a copy of it.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of your data in certain circumstances.
Right to restriction – to request limited processing in specific situations.
Right to data portability – to receive data in a structured, commonly used, machine-readable format where applicable.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent.

You also have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated. We encourage you to raise any concerns so we can address them promptly.

8. Children’s Data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children without appropriate authorization where required by law. If we become aware that data has been collected inappropriately, we will take reasonable steps to remove it.

9. Automated Decision-Making

We do not use personal data to make decisions solely by automated means that produce legal or similarly significant effects on you, unless this is permitted by law and appropriate safeguards are in place. If such processing is introduced, we will provide clear information and meaningful options as required.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any revised version will apply from the effective date stated in the updated policy. We recommend reviewing this Policy periodically to remain informed about how personal data is handled.

11. Scope and Application

This Privacy Policy applies to all customers in the area in which our services are made available. It governs all personal data processed in connection with those services, regardless of the channel through which the data is collected. If a local law provides greater protection than this Policy, we will follow the law that offers the higher level of protection.

12. Final Statement

We are committed to respecting your privacy and handling personal data in a lawful, fair, and transparent manner. We aim to collect only the data that is necessary, use it only for legitimate purposes, retain it only as long as needed, and protect it with appropriate safeguards. Your trust matters to us, and we will continue to review our practices to ensure that they remain compliant with applicable privacy laws.