Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when providing services to all customers in the area. It is written to align with the General Data Protection Regulation (GDPR) and applies to all individuals whose personal data is processed in connection with those services. By using the services, customers acknowledge that their personal data may be handled as described in this policy.

1. Data We Collect

We collect only the personal data that is necessary for legitimate business purposes and lawful processing. Depending on the interaction, this may include the following categories:

Identity data such as name, title, or customer reference information.
Contact data such as address, email address, and telephone number.
Transaction data such as payment status, purchase history, service records, and billing details.
Technical data such as device type, browser type, IP address, log files, and usage patterns.
Communication data such as correspondence, complaints, feedback, and support requests.
Preference data such as service choices, language settings, and marketing preferences.

We do not intentionally collect special category data unless it is strictly necessary and a valid legal basis exists. Where such data is involved, it will be processed with additional safeguards and only when permitted by law.

2. How We Use Personal Data

Personal data is used for clearly defined and limited purposes. These include:

providing and managing services;
processing transactions and maintaining records;
responding to inquiries and support requests;
improving service quality, performance, and security;
meeting legal, regulatory, accounting, and tax obligations;
sending relevant service messages and, where permitted, marketing communications;
preventing fraud, misuse, and unauthorized access.

We will not use personal data in a manner that is incompatible with the purposes for which it was collected, unless a new lawful basis applies and appropriate notice is given where required.

3. Lawful Basis for Processing

Under GDPR, every processing activity must have a lawful basis. We rely on one or more of the following:

Contract

We process personal data where it is necessary to perform a contract with the customer or to take steps at the customer’s request before entering into a contract. This includes delivering services, issuing invoices, and managing account-related matters.

Legal Obligation

We may process personal data when required to comply with legal obligations, such as tax reporting, regulatory requirements, fraud prevention, or record-keeping duties.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the customer’s rights and freedoms. Examples include service improvement, security monitoring, business administration, and limited direct marketing where permitted by law.

Consent

Where consent is required, we will obtain it in a clear and informed manner. Customers may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Vital Interests and Public Interest

In exceptional circumstances, we may process personal data to protect vital interests or where processing is necessary for tasks carried out in the public interest, where applicable under the law.

4. Sharing and Processors

We may share personal data with trusted third parties that act as processors on our behalf. Processors are only permitted to process personal data according to our instructions and must implement appropriate security measures. These may include providers of hosting, IT maintenance, payment handling, communications, analytics, archiving, and administrative support.

Where required, personal data may also be disclosed to professional advisers, auditors, regulators, law enforcement bodies, or other authorities. Such disclosures are limited to what is necessary and permitted by law.

We ensure that all processors are subject to contractual obligations designed to protect personal data, including confidentiality, security, limited use, and assistance with data subject rights. We do not permit processors to sell personal data.

5. International Transfers

If personal data is transferred outside the European Economic Area or the United Kingdom, we will ensure that appropriate safeguards are in place. These safeguards may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms recognized under GDPR. Customers may request information about the relevant transfer safeguards where applicable.

6. Retention of Personal Data

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, including to satisfy legal, accounting, or reporting requirements. Retention periods depend on the type of data, the nature of the relationship, and legal obligations.

In general:

account and transaction records are retained for the period required by law and business necessity;
customer service records are retained for a limited period after the issue is resolved;
marketing preference data is retained until consent is withdrawn or the customer opts out;
technical logs are retained for security, troubleshooting, and system integrity purposes for a limited duration.

When personal data is no longer needed, it will be securely deleted, anonymized, or otherwise irreversibly removed from active use, subject to any legal retention requirements.

7. Security of Personal Data

We use appropriate technical and organizational measures to protect personal data against accidental loss, unlawful destruction, unauthorized access, alteration, disclosure, or misuse. These measures may include access controls, encryption, secure storage, staff confidentiality obligations, and regular review of security practices. While no system can be guaranteed completely secure, we aim to maintain a level of protection that is proportionate to the risks involved.

8. User Rights

Customers in the area have rights under GDPR in relation to their personal data. These rights may be exercised subject to legal conditions and limitations:

Right of access – to obtain confirmation of whether personal data is being processed and to receive a copy of that data.
Right to rectification – to request correction of inaccurate or incomplete personal data.
Right to erasure – to request deletion of personal data in certain circumstances, also known as the right to be forgotten.
Right to restriction – to request limited processing in specific situations.
Right to data portability – to receive personal data in a structured, commonly used, machine-readable format and to request transfer where technically feasible.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent, to withdraw it at any time.
Right to lodge a complaint – to raise concerns with the relevant supervisory authority if the customer believes data protection law has been breached.

Requests relating to these rights will be handled in accordance with GDPR timelines and requirements. We may need to verify identity before responding to a request, especially where access or deletion is sought.

9. Marketing Preferences

Where permitted, we may send limited marketing communications that are relevant to our services. Customers can object to direct marketing at any time. If consent has been used as the basis for marketing, it may also be withdrawn at any point. Once an objection or withdrawal is received, we will update preferences and cease the relevant processing unless there is another lawful basis.

10. Automated Decision-Making

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on customers, unless such processing is lawfully permitted and appropriate safeguards are provided. If automated decision-making is introduced, customers will be informed about the logic involved and the significance of the processing.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or technical changes. Any revised version will continue to apply to all customers in the area from the effective date stated in the updated policy. Customers are encouraged to review the policy periodically so they remain informed about how personal data is handled.

12. Scope of This Policy

This policy applies to all customers in the area and covers personal data processed in connection with service delivery, administration, support, security, compliance, and related operations. It does not apply to data that has been anonymized so that individuals are no longer identifiable.

By continuing to use the services, customers acknowledge that they have read and understood this Privacy Policy and the ways in which personal data may be processed in line with GDPR requirements.