Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, retained, and protected when customers use our services. It applies to all customers in the relevant area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using our services, you acknowledge that your personal data may be processed in accordance with this Policy.

1. Data We Collect

We collect only the personal data that is necessary for the purposes described in this Policy. Depending on how you interact with us, we may collect the following categories of data:

Identity data such as your name, username, or similar identifier.
Contact data such as your email address, billing address, or delivery address.
Transaction data such as details about services purchased, payment status, and related records.
Technical data such as IP address, browser type, device identifiers, operating system, and usage logs.
Communication data such as messages, requests, complaints, or other correspondence.
Preference data such as service settings, language preferences, and marketing choices.

We do not intentionally collect special category data unless it is strictly necessary and permitted by law. If such information is ever required, we will process it only where a valid legal ground exists and where appropriate safeguards are in place.

2. How We Use Personal Data

We use personal data for legitimate business and operational purposes, including to:

provide and manage our services;
process transactions and maintain records;
communicate with customers about service matters;
improve service performance, security, and functionality;
detect, prevent, and investigate fraud or misuse;
meet legal, regulatory, accounting, and tax obligations;
send optional marketing communications where permitted;
respond to queries, complaints, and support requests.

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another compatible purpose and that further use is lawful.

3. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for each type of processing activity. We may rely on one or more of the following bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes providing services, managing accounts, and handling payment-related activities.

Legal obligation

We process personal data where required to comply with legal or regulatory duties, such as tax, accounting, fraud prevention, or lawful requests from authorities.

Legitimate interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. Examples include service improvement, security monitoring, and internal administration.

Consent

We may rely on your consent for certain activities, such as receiving specific marketing messages or using optional data collection features where consent is required. When we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Vital interests and public interest

In limited circumstances, we may process personal data where necessary to protect vital interests or where processing is required for tasks carried out in the public interest or in the exercise of official authority, as permitted by law.

4. Disclosure of Personal Data

We may share personal data with selected third parties where necessary for the purposes described in this Policy. Such disclosures are made only on a need-to-know basis and subject to appropriate contractual and security safeguards.

Service providers and processors who support hosting, payment processing, analytics, customer management, communications, and security.
Professional advisers such as legal, accounting, or audit firms where necessary for compliance or advice.
Regulators, courts, or law enforcement when disclosure is required by law or needed to protect rights, safety, or property.
Business transferees in the event of a reorganization, merger, acquisition, or similar corporate transaction, subject to confidentiality protections.

We do not sell personal data. Any sharing will be limited to what is necessary and lawful.

5. Processors and Data Handling

Where we use external service providers to process personal data on our behalf, they act as data processors under GDPR. Processors are permitted to handle personal data only in accordance with our instructions and may not use it for their own purposes.

We require processors to implement appropriate technical and organizational measures to protect personal data, including confidentiality controls, access restrictions, encryption where suitable, and incident reporting procedures. We also seek assurances that any international data transfers are supported by lawful transfer mechanisms and adequate protections.

Our choice of processors is based on their reliability, security standards, and ability to assist with compliance. We remain responsible for ensuring that processing is carried out lawfully and transparently.

6. International Data Transfers

If personal data is transferred outside the European Economic Area or to a jurisdiction that does not provide an adequate level of protection, we will ensure that appropriate safeguards are in place. These safeguards may include standard contractual clauses, adequacy decisions, or other legally recognized transfer mechanisms. Where required, supplementary measures may be applied to strengthen protection.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, regulatory, and reporting requirements. Retention periods may vary depending on the nature of the data and the reason for processing.

In determining retention periods, we consider the following:

the amount, nature, and sensitivity of the data;
the risk of harm from unauthorized use or disclosure;
the purposes of processing and whether they can be achieved by other means;
applicable legal or regulatory retention duties;
whether a legal claim may arise or be defended.

When personal data is no longer needed, we will delete it securely or anonymize it so that it can no longer be linked to an identifiable person. Where deletion is not immediately possible, data will be isolated and retained only for the minimum period required.

8. Security Measures

We take appropriate technical and organizational measures to protect personal data against accidental loss, unauthorized access, alteration, disclosure, or destruction. These measures may include access controls, authentication procedures, monitoring, secure storage, staff confidentiality duties, and regular review of security practices.

However, no system can be guaranteed to be completely secure. If a personal data breach occurs, we will assess the risk and, where required by law, notify the relevant supervisory authority and affected individuals without undue delay.

9. Your Rights Under GDPR

Subject to the conditions and exemptions set out in GDPR, you have the following rights regarding your personal data:

Right of access – to request confirmation of whether we process your data and to obtain a copy of it.
Right to rectification – to ask us to correct inaccurate or incomplete data.
Right to erasure – to request deletion of your data in certain circumstances.
Right to restriction – to request that we limit processing in certain situations.
Right to data portability – to receive data you provided to us in a structured, commonly used, machine-readable format and, where feasible, have it transmitted to another controller.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.
Right not to be subject to solely automated decisions – to object to decisions made entirely by automated means where legally applicable.

To protect your privacy, we may need to verify your identity before fulfilling a rights request. We will respond within the time limits set by law and will inform you if additional time is needed due to complexity or volume.

10. Complaints

If you believe that we have not handled your personal data in accordance with this Policy or applicable law, you have the right to lodge a complaint with the relevant supervisory authority in your area. We encourage you to raise concerns so that we may address them promptly and fairly.

11. Children’s Data

Our services are not intended for children unless clearly stated otherwise. We do not knowingly collect personal data from children without appropriate authorization where required by law. If we become aware that such data has been collected without proper consent or legal basis, we will take steps to delete it or otherwise handle it lawfully.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any updated version will apply from the date it becomes effective. We encourage customers to review this Policy periodically to remain informed about how personal data is handled.

By continuing to use our services, you confirm that you have read and understood this Privacy Policy.