Privacy Policy
This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when customers use our services in the area. It applies to all customers in area and is designed to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable privacy laws. By using our services, you acknowledge that you have read this policy and understand how your information is handled.
1. Who We Are
For the purposes of data protection law, we act as the data controller for the personal data described in this Privacy Policy. This means we determine the purposes and means of processing personal data in connection with our services. Where we engage third parties to process data on our behalf, they act as data processors and are required to process personal data only according to our instructions and applicable law.
2. Information We Collect
We collect only the information that is necessary for providing, improving, and securing our services. Depending on how you interact with us, the categories of personal data we may collect include:
- Identity data: name, title, and similar identifiers.
- Contact data: address, email address, telephone number, and communication preferences.
- Transaction data: details about purchases, payments, invoices, and service history.
- Technical data: IP address, browser type, device identifiers, operating system, and log information.
- Usage data: information about how you use our services, including pages viewed, features used, and interaction patterns.
- Customer support data: communications, complaints, feedback, and records of assistance provided.
- Compliance data: information necessary to verify identity, satisfy legal obligations, or prevent fraud.
We do not intentionally collect special category data unless it is required by law, necessary for a specific service, or you choose to provide it. When special category data is processed, it will be handled with enhanced safeguards and only where a lawful basis permits such processing.
3. How We Use Personal Data
We use personal data for the following purposes:
- to provide and deliver our services;
- to manage accounts, orders, or service requests;
- to communicate with customers about service-related matters;
- to process payments, refunds, and billing matters;
- to maintain security, prevent abuse, and detect fraud;
- to comply with legal and regulatory obligations;
- to improve service quality, performance, and user experience;
- to establish, exercise, or defend legal claims;
- to send non-marketing operational notices and updates where relevant.
We will not use your personal data for purposes that are incompatible with the original purpose for which it was collected unless we have a valid lawful basis and, where required, informed you about the new purpose.
4. Lawful Basis for Processing
We process personal data only where a lawful basis under GDPR applies. Depending on the context, our lawful bases may include:
4.1 Contract
We process data where it is necessary to perform a contract with you or to take steps at your request before entering into a contract. This includes fulfilling orders, providing services, managing accounts, and handling payments.
4.2 Legal Obligation
We may process personal data to comply with legal obligations, such as tax, accounting, consumer protection, anti-fraud, or record-keeping requirements.
4.3 Legitimate Interests
We may process data where it is necessary for our legitimate interests or those of a third party, provided that those interests are not overridden by your rights and freedoms. Examples include securing our systems, preventing fraud, improving services, and administering internal operations. Where we rely on this basis, we assess the impact on your privacy and apply appropriate safeguards.
4.4 Consent
In limited cases, we rely on your consent, especially where the law requires it. If we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
4.5 Vital Interests and Public Interest
Although less common in our services, we may process personal data where necessary to protect vital interests or where required for tasks carried out in the public interest in accordance with applicable law.
5. Sharing of Personal Data and Processors
We may share personal data with trusted third parties where necessary for the purposes described in this policy. These parties may include processors that help us operate our business, such as hosting providers, payment service providers, analytics services, customer support tools, document management systems, and security vendors. All processors are required to:
- process personal data only on our documented instructions;
- implement appropriate technical and organizational security measures;
- keep personal data confidential;
- assist us with compliance, rights requests, and incident response where appropriate;
- delete or return personal data when processing ends, unless retention is required by law.
We may also disclose personal data to independent third parties where necessary for legal compliance, professional advice, debt recovery, dispute resolution, or to protect rights, safety, and property. If personal data is transferred outside the European Economic Area, we will ensure that appropriate safeguards are in place, such as an adequacy decision, Standard Contractual Clauses, or another valid transfer mechanism under GDPR.
6. Retention of Personal Data
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including for any legal, accounting, reporting, or operational requirements. Retention periods vary depending on the nature of the data, the reason for processing, and relevant legal obligations.
In general, we consider the following factors when determining retention periods:
- the length of our relationship with you;
- whether we are under a legal obligation to retain the data;
- the need to resolve disputes, enforce agreements, or establish legal claims;
- the sensitivity and volume of the data;
- the potential risk of harm from unauthorized use or disclosure;
- industry standards and regulatory guidance.
When personal data is no longer required, we will delete, anonymize, or securely archive it in accordance with our retention practices. Retention does not mean indefinite storage; we regularly review data and remove it when it is no longer needed.
7. Security Measures
We apply appropriate technical and organizational measures to protect personal data against accidental loss, unauthorized access, alteration, disclosure, or destruction. These measures may include access controls, encryption, secure storage, staff training, monitoring, and vendor due diligence. While we work to protect data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Your Rights Under GDPR
If you are covered by GDPR, you have a number of rights in relation to your personal data. These rights may be subject to certain conditions, exemptions, or limitations under law.
- Right of access: you may request confirmation of whether we process your personal data and obtain a copy of it.
- Right to rectification: you may request correction of inaccurate or incomplete personal data.
- Right to erasure: you may request deletion of your personal data in certain circumstances.
- Right to restriction: you may request that we limit processing in specific situations.
- Right to data portability: you may request your data in a structured, commonly used, machine-readable format where technically feasible.
- Right to object: you may object to processing based on legitimate interests or to direct marketing where applicable.
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
- Right not to be subject to automated decision-making: you may have the right to challenge decisions made solely by automated means that produce legal or similarly significant effects.
You also have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated. We encourage you to raise concerns with us first so that we can attempt to resolve the matter promptly and fairly.
9. Children’s Data
Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children without appropriate authorization where required by law. If we become aware that data has been collected from a child inappropriately, we will take reasonable steps to delete it.
10. Automated Processing and Profiling
Where relevant, we may use limited automated tools to improve fraud detection, system security, service personalization, or operational efficiency. Any such processing will be conducted lawfully and with appropriate safeguards. We do not make decisions producing legal or similarly significant effects solely on the basis of automated processing unless permitted by law and accompanied by appropriate measures to protect your rights.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in law, technology, business practices, or service features. If we make material changes, we will revise the policy accordingly. We encourage customers to review this policy periodically so they remain informed about how personal data is handled.
12. Scope and Applicability
This Privacy Policy applies to all customers in area who receive, access, or use our services. By continuing to use our services, you acknowledge that your personal data may be processed in accordance with this policy and applicable data protection laws. Where local law provides additional rights or protections, those rights will apply alongside the GDPR requirements described here.
In summary, we are committed to processing personal data fairly, lawfully, and transparently. We collect only what is necessary, rely on appropriate lawful bases, retain data for limited periods, use trusted processors under contractual controls, and respect your rights as a data subject.
