Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected. It applies to all customers in the area and describes the rights available to individuals under applicable data protection laws, including the General Data Protection Regulation (GDPR). By using the services covered by this policy, individuals acknowledge that their personal data may be processed in accordance with the practices described below.

1. Scope of This Policy

This policy applies to all customers in the area, including current, former, and prospective customers whose personal data is processed in connection with products, services, support, billing, marketing, administration, or legal compliance. It also applies where personal data is obtained from third parties, public sources, or automated interactions related to service delivery.

Personal data means any information relating to an identified or identifiable natural person. This may include names, contact details, account identifiers, transaction details, device information, usage data, and any other information that can be linked directly or indirectly to an individual.

2. Data We Collect

We collect only the data that is necessary for specified and legitimate purposes. Depending on the context, we may collect the following categories of personal data:

Identity data: name, title, and similar identifiers.
Contact data: postal address, email address, telephone number, and communication preferences.
Account data: account numbers, login credentials, profile details, and service settings.
Transaction data: purchase records, invoices, payments, refunds, and service history.
Technical data: IP address, browser type, device identifiers, operating system, and log information.
Usage data: pages viewed, features used, session duration, and interaction patterns.
Communications data: records of correspondence, support requests, complaints, and feedback.
Compliance data: verification information, fraud prevention records, and audit logs.

Where required, we will identify whether data provision is mandatory or optional. If certain data is not provided, some services may not function properly or may be unavailable.

3. How We Use Personal Data

Personal data is processed for lawful, specific, and transparent purposes. These purposes may include:

providing and managing services;
processing transactions and maintaining records;
verifying identity and preventing fraud;
responding to inquiries and offering support;
improving products, systems, and customer experience;
sending service notices and administrative communications;
meeting legal, regulatory, and tax obligations;
protecting rights, property, and security;
where permitted, sending direct marketing communications.

We do not use personal data in ways that are incompatible with the purposes for which it was collected unless we have a lawful basis to do so and, where required, have informed the individual accordingly.

4. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for each processing activity. Depending on the situation, we rely on one or more of the following legal bases:

4.1 Contract

We process personal data when it is necessary to enter into or perform a contract with a customer. This includes creating accounts, processing orders, delivering services, managing payments, and providing support related to the service.

4.2 Legal Obligation

We may process personal data where required to comply with legal obligations, including accounting rules, tax requirements, consumer protection obligations, regulatory reporting, and lawful requests from public authorities.

4.3 Legitimate Interests

We may process personal data for our legitimate interests, provided those interests are not overridden by the rights and freedoms of the individual. Legitimate interests may include fraud prevention, service improvement, network and information security, internal reporting, and limited direct marketing. Where appropriate, we conduct a balancing test to assess the impact on individuals.

4.4 Consent

In certain cases, we rely on consent. This may apply to specific marketing activities or optional data collection. When consent is used as the lawful basis, individuals may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4.5 Vital Interests and Public Interest

In rare circumstances, we may process personal data to protect an individual’s vital interests or where processing is necessary for tasks carried out in the public interest or in the exercise of official authority, if applicable.

5. Sharing and Processors

We may disclose personal data to trusted third parties that act as processors or, in limited cases, as independent controllers. Processors are engaged only where necessary and are required to process personal data according to our instructions and applicable data protection law.

Examples of processors may include:

IT and cloud service providers;
payment service providers;
customer support platforms;
analytics and reporting tools;
security and fraud prevention services;
document storage and archiving providers;
professional advisers acting under confidentiality obligations.

Before sharing data with a processor, we take steps to ensure appropriate data protection safeguards are in place, including contractual commitments on confidentiality, security, sub-processing, and deletion or return of data when processing ends.

We may also disclose data if required by law, to protect legal rights, to prevent harm, or in connection with a merger, acquisition, restructuring, or similar business transaction, subject to applicable legal requirements.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including for satisfying legal, accounting, reporting, and security requirements. Retention periods vary depending on the type of data, the purpose of processing, and any legal obligations that apply.

In determining retention periods, we consider factors such as:

the duration of the customer relationship;
the need to resolve disputes or enforce agreements;
tax, accounting, and regulatory obligations;
the risk profile of the information;
whether the data is required for ongoing security or fraud prevention.

When personal data is no longer needed, we will securely delete it, anonymize it, or otherwise render it inaccessible, unless retention is required by law. Retention schedules are periodically reviewed to ensure data is not kept longer than necessary.

7. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction. These measures may include access controls, encryption, secure storage, logging, staff training, and procedures for incident management.

While no system can be guaranteed completely secure, we maintain a risk-based approach and regularly review our safeguards to reduce the likelihood and impact of data breaches.

8. International Transfers

If personal data is transferred outside the European Economic Area or another jurisdiction with equivalent protections, we ensure that appropriate safeguards are used. These may include standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms permitted under GDPR.

Where relevant, individuals may request information about the safeguards used for international transfers, subject to legal and contractual limitations.

9. User Rights

Individuals whose personal data is processed under this policy have rights under GDPR. These rights are not absolute and may be subject to conditions or exceptions.

Right of access: to obtain confirmation and a copy of personal data being processed.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request limited processing in specific situations.
Right to data portability: to receive data in a structured, commonly used format where applicable.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where consent is the basis for processing, it may be withdrawn at any time.
Right to lodge a complaint: to raise concerns with a relevant data protection supervisory authority.

Requests relating to these rights will be handled in accordance with applicable law. We may need to verify identity before responding to protect against unauthorized disclosure.

10. Children

This policy is intended for services provided to customers in the area and is not directed at children unless specifically stated otherwise. We do not knowingly collect personal data from children without appropriate authorization where required by law.

11. Automated Decision-Making

We do not use personal data for decisions based solely on automated processing that produce legal or similarly significant effects, unless permitted by law and subject to appropriate safeguards. If such processing is introduced, individuals will be informed and given the rights available under GDPR.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service offerings. When updates are made, the revised policy will apply from the effective date of the change. Individuals are encouraged to review this policy periodically.

Summary principle: We process personal data fairly, lawfully, and transparently, with clear limits on use, retention, and sharing. Customer rights remain central to all processing activities.