Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with the services offered to all customers in the area. It applies to all customers in area and is intended to reflect the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using the services, customers acknowledge that their personal data may be processed in accordance with this policy.

1. Data We Collect

We may collect and process various categories of personal data depending on the nature of the interaction and the services used. The data collected is limited to what is necessary, relevant, and proportionate for the purposes described in this policy.

Categories of Data

Identification data: name, title, and similar identifiers.
Contact data: address, email address, telephone number, and other communication details.
Account and transaction data: customer account information, records of purchases, service history, payment-related records, and billing details where applicable.
Technical data: device information, browser type, IP address, operating system, and usage logs.
Preference data: communication choices, service interests, and consent records.
Correspondence data: information included in messages, requests, complaints, feedback, or other communications.

We do not intentionally collect special category data unless it is strictly necessary and a valid legal basis exists. Where such information is processed, additional safeguards are applied in line with GDPR requirements.

2. How Data Is Collected

Personal data may be collected directly from customers when they register, place an order, make an enquiry, submit forms, or otherwise interact with the services. Data may also be collected indirectly through automated technologies, including logs, cookies, and similar tools, where permitted by law and subject to any required consent. In some cases, data may be received from third parties such as payment providers, service partners, or public sources when relevant and lawful.

3. Purposes of Processing

We process personal data only for specified, explicit, and legitimate purposes. These may include:

providing and managing services;
creating and maintaining customer records;
processing payments and transactions;
delivering customer support and responding to enquiries;
improving service quality and user experience;
maintaining security, preventing fraud, and detecting misuse;
meeting legal, regulatory, accounting, and tax obligations;
communicating service updates, notices, and administrative information;
handling complaints, disputes, and claims;
where permitted, carrying out analytics and reporting based on legitimate business needs.

We will not process personal data in a way that is incompatible with these purposes unless required or permitted by law.

4. Lawful Basis for Processing

Under GDPR, each processing activity must have a lawful basis. Depending on the context, we rely on one or more of the following:

Consent

Where required, we process personal data based on the individual’s consent. This may apply to certain marketing or optional data uses. Consent can be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

Contract

We process data when it is necessary to enter into or perform a contract with a customer, or to take steps at the customer’s request before entering into a contract.

Legal Obligation

Some data must be processed to comply with legal obligations, including tax, accounting, regulatory, or consumer protection requirements.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the rights and freedoms of the individual. Legitimate interests may include service improvement, security, fraud prevention, and internal administration. Where we rely on this basis, we consider the nature of the data, the purpose of the processing, and the potential impact on the individual.

5. Data Sharing and Processors

We may share personal data with third parties when necessary for the operation of the services, to meet legal obligations, or where otherwise lawful. Some third parties act as processors and process data on our behalf under written agreements that require them to act only on our instructions and to implement appropriate security measures.

Typical Processor Categories

IT hosting and infrastructure providers;
payment processing services;
customer relationship and support tools;
data storage and backup providers;
analytics and reporting services;
document management and administrative service providers;
professional advisors acting under confidentiality obligations.

Where personal data is transferred to a processor outside the relevant jurisdiction, we ensure appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, or another legally recognized transfer mechanism. Data may also be disclosed to public authorities, courts, or regulators where required by law.

6. Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, reporting, and dispute-resolution requirements. Retention periods vary depending on the type of data and the applicable legal obligations.

Retention Principles

data used for contractual purposes is kept for the duration of the relationship and for a reasonable period afterwards;
data required for legal compliance is retained for the period required by law;
data used for customer service and operational records is retained for as long as needed to manage the relationship and resolve issues;
data no longer needed is securely deleted, anonymized, or archived in a manner that prevents further identification.

When retention is based on legitimate interests, we balance those interests against the rights of the individual and apply deletion or anonymization once the purpose no longer applies.

7. Security Measures

We use appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, unlawful destruction, alteration, or disclosure. These measures may include access controls, encryption where suitable, secure storage, staff confidentiality obligations, and regular review of internal procedures. While no system can be guaranteed as completely secure, we take reasonable steps to reduce risk and respond appropriately to any incident.

8. User Rights Under GDPR

Individuals whose personal data is processed under this policy have the rights provided by GDPR, subject to applicable legal limits and exceptions. These rights include:

Right of access: to request confirmation of whether data is being processed and obtain a copy of it;
Right to rectification: to request correction of inaccurate or incomplete data;
Right to erasure: to request deletion of personal data in certain circumstances;
Right to restriction: to request limited processing in certain situations;
Right to data portability: to receive certain data in a structured, commonly used, machine-readable format and, where feasible, to have it transmitted to another controller;
Right to object: to object to processing based on legitimate interests or direct marketing;
Right to withdraw consent: to withdraw consent at any time where processing is based on consent;
Right related to automated decision-making: to not be subject to decisions based solely on automated processing where those decisions produce legal or similarly significant effects, unless permitted by law and subject to safeguards.

Requests relating to these rights will be assessed in accordance with applicable law. We may need to verify identity before responding to ensure that personal data is disclosed only to the correct person.

9. International Transfers

Where personal data is transferred outside the European Economic Area or another region with equivalent protections, we take steps to ensure that the transfer is lawful and that the data remains protected to an appropriate standard. Such steps may include contractual protections, transfer impact assessments, and supplementary safeguards where required.

10. Children’s Data

The services are not intended for children unless explicitly stated otherwise. We do not knowingly collect personal data from children without appropriate authorization where required by law. If it becomes apparent that such data has been collected without a valid basis, reasonable steps will be taken to delete it.

11. Changes to This Policy

This Privacy Policy may be updated from time to time to reflect changes in legal requirements, operational practices, or service developments. Any revised version will apply from the date it is made effective. Continued use of the services after changes take effect indicates acceptance of the updated policy, to the extent permitted by law.

12. How This Policy Applies

This policy applies to all customers in area and governs the processing of personal data connected with the services provided there. It is intended to ensure transparency, fairness, and accountability in the handling of personal data. We are committed to processing information lawfully, fairly, and transparently, and to respecting the rights of all individuals whose data is processed under this policy.

By using the services, customers acknowledge that they have read and understood this Privacy Policy.