Privacy Policy

This Privacy Policy explains how we collect, use, store, and protect personal data in connection with our services. It applies to all customers in the area where our services are offered and to all users whose personal data is processed in that context. We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR).

1. Scope of This Policy

This policy applies to personal data processed when individuals interact with our services, whether as customers, prospective customers, or other data subjects whose information we process for operational, contractual, or legal purposes. It covers both digital and offline data processing where relevant. For the avoidance of doubt, this policy applies to all customers in the area served by our organization.

2. Data We Collect

We collect only the personal data necessary for specified and legitimate purposes. Depending on how you interact with us, we may collect the following categories of information:

Identity data such as name, title, or similar identifiers.
Contact data such as address, email address, telephone number, or billing details.
Account data such as login credentials, profile preferences, and service history.
Transaction data such as payment records, purchase history, and invoices.
Technical data such as device information, browser type, operating system, and usage logs.
Communication data such as correspondence and service-related inquiries.
Legal and compliance data where required to meet regulatory or contractual obligations.

We do not intentionally collect special category data unless it is strictly necessary and a valid legal basis applies. If such data is ever processed, we will do so only in compliance with GDPR requirements and additional safeguards.

3. How We Use Personal Data

We use personal data for clear and limited purposes, including:

Providing and managing services.
Processing transactions and fulfilling contractual obligations.
Managing customer relationships and responding to requests.
Maintaining records and service quality.
Ensuring security, preventing fraud, and detecting misuse.
Meeting legal, accounting, and regulatory obligations.
Improving services through analysis of usage patterns in an aggregated or pseudonymized form where appropriate.

We will not use personal data for purposes that are incompatible with the original purpose for which it was collected, unless we have a lawful basis and, where required, have informed you of the change.

4. Lawful Basis for Processing

We process personal data only where one or more lawful bases under the GDPR apply. The lawful basis depends on the specific purpose of processing. These may include:

Contract

We process data when it is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract.

Legal Obligation

We may process data when necessary to comply with legal obligations, including tax, accounting, consumer protection, or other regulatory requirements.

Legitimate Interests

We may process data for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. Such interests may include service administration, security, fraud prevention, and internal recordkeeping.

Consent

Where required by law, we rely on your consent. If we process personal data on the basis of consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Vital Interests and Public Interest

In limited cases, we may process personal data to protect vital interests or where processing is necessary for tasks carried out in the public interest, if applicable.

5. Data Sharing and Processors

We may share personal data with trusted service providers that act as processors on our behalf. These processors are only permitted to process personal data according to our documented instructions and are bound by contractual obligations to maintain confidentiality and security.

Examples of processor functions may include:

IT hosting and infrastructure services.
Payment processing and financial administration.
Customer support tools and communication systems.
Data storage, backup, and security services.
Analytics and reporting services where properly configured and lawful.

We may also disclose personal data to professional advisers, regulatory authorities, law enforcement, courts, or other parties when required by law or necessary to protect rights, safety, or property. Where we use third-party processors, we ensure appropriate safeguards, including data processing agreements and, where relevant, transfer mechanisms for international data transfers.

6. International Transfers

If personal data is transferred outside the European Economic Area or to a jurisdiction with different data protection standards, we will ensure that appropriate safeguards are in place. These safeguards may include adequacy decisions, standard contractual clauses, or equivalent measures permitted under GDPR. We take steps to ensure that transferred data remains protected to a standard consistent with applicable law.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting obligations. Retention periods are determined by the nature of the data and the purpose of processing.

In general:

Contract and transaction records are retained for the duration of the relationship and for the legally required period afterward.
Support communications are retained for as long as needed to resolve requests and maintain service records.
Technical logs are retained for a limited period for security, performance, and diagnostic purposes.
Data processed on the basis of consent is retained until consent is withdrawn or the purpose ends, unless another legal basis applies.

When personal data is no longer needed, we will delete it or anonymize it securely. Retention decisions are reviewed periodically to ensure they remain appropriate and compliant.

8. Security Measures

We implement appropriate technical and organizational measures to protect personal data against accidental loss, unauthorized access, alteration, disclosure, or destruction. These measures may include access controls, encryption where suitable, secure storage, staff confidentiality obligations, and regular review of security practices. While no system is completely secure, we work to minimize risk and respond promptly to suspected incidents.

9. Your Rights Under GDPR

Depending on your circumstances and the legal basis for processing, you may have the following rights:

Right of access to obtain confirmation and a copy of your personal data.
Right to rectification to correct inaccurate or incomplete data.
Right to erasure in certain circumstances, also known as the right to be forgotten.
Right to restriction of processing in certain situations.
Right to data portability for data you provided to us, where applicable.
Right to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent at any time where processing relies on consent.
Right not to be subject to solely automated decisions that produce legal or similarly significant effects, where applicable.

We will respond to valid rights requests within the timeframes required by law and may ask for information necessary to verify your identity. In some cases, rights may be limited where necessary to comply with legal obligations or protect the rights of others.

10. Cookies and Similar Technologies

Where used, cookies and similar technologies may support essential functions, security, preferences, and performance measurement. Any non-essential processing will only occur where allowed by law and, if required, with consent. You can manage browser settings to control some tracking technologies, though certain features may not function properly if cookies are disabled.

11. Children's Data

Our services are not intended to collect personal data from children without appropriate authorization or legal basis. Where children’s data is processed, we take additional care to ensure compliance with applicable legal requirements and to protect the rights and interests of minors.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or operational needs. When we make material changes, we will revise the policy accordingly. We encourage you to review this policy periodically so that you remain informed about how your personal data is handled.

13. Additional Information

This policy is intended to provide a clear overview of our privacy practices. It should be read together with any service-specific terms or notices that may apply to particular processing activities. If there is a conflict between this policy and a mandatory legal requirement, the legal requirement will prevail. We aim to uphold the principles of data minimization, purpose limitation, accuracy, storage limitation, integrity, confidentiality, and accountability in all personal data processing activities.

By using our services, you acknowledge that your personal data may be processed as described in this policy and in accordance with applicable data protection law.