Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It is designed to reflect the requirements of the General Data Protection Regulation (GDPR) and applies to all customers in the area where our services are offered. By using our services, customers acknowledge that their personal data may be processed as described in this Policy.

1. Introduction

We are committed to handling personal data in a fair, lawful, transparent, and secure manner. Privacy is an important part of our operations, and we take appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. This Policy applies to personal data collected from customers, potential customers, website visitors, and other individuals who interact with our services in the applicable area.

Personal data means any information relating to an identified or identifiable natural person. This may include names, contact details, account information, payment-related information, usage data, and other identifiers that can directly or indirectly identify a person.

2. Data We Collect

We may collect and process the following categories of personal data:

Identity data: name, title, username, or other identifiers.
Contact data: email address, telephone number, postal address, and similar details.
Account data: account credentials, service preferences, purchase history, and profile settings.
Transaction data: records of services purchased, payment status, invoices, and related administrative information.
Technical data: device type, browser type, operating system, IP address, and log data.
Usage data: information about how services are accessed and used, including interactions and activity patterns.
Communication data: details provided in correspondence, support requests, feedback, or complaints.
Marketing preferences: choices about receiving promotional communications where applicable.

We generally collect personal data directly from the individual, but we may also receive data from third parties where permitted by law, such as service providers, payment processors, fraud prevention partners, or publicly available sources.

3. How We Use Personal Data

We use personal data only where we have a valid legal reason to do so. The main purposes for processing include:

providing and administering our services;
creating and managing customer accounts;
processing transactions and keeping financial records;
communicating service updates, notices, and administrative messages;
responding to enquiries, complaints, and support requests;
maintaining security, preventing fraud, and detecting misuse;
meeting legal, regulatory, tax, and accounting obligations;
improving service quality, performance, and customer experience;
sending marketing communications where lawful and where consent is required or legitimate interests apply in accordance with applicable law.

We will not use personal data for purposes that are incompatible with the reasons it was collected unless we have a valid legal basis to do so.

4. Lawful Basis for Processing

Under GDPR, we rely on one or more of the following lawful bases:

Contract: processing is necessary to enter into or perform a contract with a customer, or to take steps at the request of the customer before entering into a contract.
Legal obligation: processing is necessary to comply with laws and regulations, including recordkeeping, taxation, and accounting requirements.
Legitimate interests: processing is necessary for our legitimate business interests, such as improving services, ensuring security, or preventing fraud, provided those interests are not overridden by the rights and freedoms of the individual.
Consent: processing is carried out based on freely given, specific, informed, and unambiguous consent, where required by law. Consent may be withdrawn at any time.
Vital interests: in exceptional cases, processing may be necessary to protect someone’s life.
Public task: where applicable, processing may be necessary for tasks carried out in the public interest or in the exercise of official authority.

Where we rely on legitimate interests, we assess the impact on individuals and ensure that appropriate safeguards are in place.

5. Data Retention

We keep personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the performance of any contract, legal compliance, dispute resolution, and enforcement of agreements. Retention periods may vary depending on the type of data and the context in which it is processed.

In general, retention is determined by the following factors:

the duration of the customer relationship;
legal, tax, and accounting requirements;
the need to resolve disputes or prevent fraud;
the sensitivity and volume of the data;
the risk of harm from unauthorized use or disclosure.

When personal data is no longer required, it will be securely deleted, anonymized, or otherwise disposed of in a safe manner.

6. Data Sharing and Processors

We may share personal data with third parties that assist us in operating our services. These third parties act as processors when they process personal data on our behalf and under our instructions. We require such processors to use appropriate safeguards and to process personal data only for permitted purposes.

Categories of processors may include:

IT hosting and infrastructure providers;
payment service providers;
customer relationship and support platforms;
analytics and performance service providers;
security and fraud prevention partners;
professional advisers, including legal, accounting, or compliance advisers.

We may also disclose personal data to independent third parties where required by law, where necessary to protect rights or property, or in connection with lawful requests from public authorities. If personal data is transferred outside the European Economic Area, appropriate transfer safeguards will be implemented in accordance with GDPR, such as standard contractual clauses or equivalent measures where applicable.

7. Security Measures

We use technical and organizational measures designed to protect personal data. These may include access controls, encryption, secure storage, logging, backup procedures, staff confidentiality obligations, and periodic review of security practices. While no system can be guaranteed to be completely secure, we continuously work to reduce risks and protect data against unauthorized access or accidental loss.

8. User Rights Under GDPR

Individuals whose personal data is processed under this Policy have the following rights, subject to legal limitations and exemptions:

Right of access: to obtain confirmation of whether personal data is processed and to receive a copy of that data.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request that processing be limited in certain situations.
Right to data portability: to receive personal data in a structured, commonly used, machine-readable format and, where feasible, to have it transmitted to another controller.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: to withdraw consent at any time where processing is based on consent.
Right not to be subject to solely automated decision-making: to request human review where applicable.

Requests relating to these rights will be handled in accordance with applicable data protection law. We may need to verify identity before responding to a request, and we may retain certain information where required or permitted by law.

9. Children’s Data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children in a manner that would violate applicable law. If we become aware that data has been collected improperly from a child, we will take appropriate steps to remove or protect that information.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service developments. Any revised version will apply from the date it becomes effective. We encourage customers to review this Policy periodically to remain informed about how personal data is processed.

11. Governing Principles

We process personal data in line with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. These principles guide how we collect and use information and help ensure that privacy is respected throughout the processing lifecycle.

By using our services in the applicable area, customers agree that their personal data may be processed in accordance with this Privacy Policy and the GDPR principles described above. This Policy applies to all customers in the area where the services are made available.