Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area and is intended to provide clear information about our data practices in a manner consistent with the General Data Protection Regulation (GDPR). By using our services, you acknowledge that your personal data may be processed as described below.

1. Data We Collect

We collect only the personal data that is necessary for legitimate business and operational purposes. The types of data we may collect include:

Identity data: name, title, and similar identifiers.
Contact data: address, email address, telephone number, and delivery or billing details.
Transaction data: records of purchases, payments, orders, and service requests.
Technical data: IP address, browser type, device information, operating system, and usage logs.
Communications data: messages, feedback, complaints, and support interactions.
Preference data: marketing preferences, communication choices, and service settings.

Where necessary, we may also process information that is provided indirectly through lawful third parties or generated through the ordinary use of our services. We do not intentionally collect special category data unless it is required by law or explicitly provided by you for a specific purpose.

2. How We Use Personal Data

We use personal data for the following purposes:

to provide and manage our services;
to process transactions and fulfil obligations;
to communicate service updates and account-related information;
to respond to enquiries and support requests;
to improve service quality, security, and performance;
to comply with legal and regulatory requirements;
to prevent fraud, misuse, and unauthorised access;
to send marketing messages where permitted and where consent or another lawful basis applies.

We will only process personal data in a way that is fair, lawful, and transparent, and we will not use it for purposes that are incompatible with the original reason for collection unless we have a valid legal basis to do so.

3. Lawful Basis for Processing

Under GDPR, we rely on one or more lawful bases when processing personal data. These may include:

Contract

We process personal data where it is necessary to enter into or perform a contract with you, including providing services, processing orders, and managing accounts.

Legal Obligation

We may process data to comply with applicable laws, regulations, tax rules, accounting requirements, or lawful requests from public authorities.

Legitimate Interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided that those interests are not overridden by your rights and freedoms. Examples include service improvement, fraud prevention, network security, and administrative management.

Consent

Where required, we rely on your consent, for example for certain marketing activities or optional communications. You may withdraw consent at any time, and this will not affect the lawfulness of processing carried out before withdrawal.

Vital Interests

In rare cases, we may process personal data to protect someone’s vital interests, such as in an emergency.

4. Data Sharing and Processors

We may share personal data with trusted third parties that help us operate our services. These recipients may act as processors or, in some cases, as separate controllers. We require all processors to handle personal data only on our instructions and to implement appropriate security measures.

Examples of processor categories include:

IT and hosting providers;
payment service providers;
customer support and communications tools;
analytics and performance monitoring services;
professional advisers such as accountants, auditors, and legal counsel;
logistics, delivery, or fulfilment partners where needed.

We may also disclose data where required by law, to enforce our rights, to protect the security of our services, or to respond to lawful requests by public authorities. Where personal data is transferred outside the European Economic Area, we ensure that appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, tax, or reporting requirements. The retention period depends on the type of data and the reason for processing.

Contract and transaction records: retained for the period required to complete services and satisfy legal obligations.
Customer support records: retained for a reasonable period after the matter is resolved.
Marketing data: retained until you withdraw consent or object, subject to applicable law.
Technical and security logs: retained for a limited period unless needed for investigation or compliance.

When data is no longer needed, we will delete it securely or anonymise it so that it can no longer be linked to an identifiable person. Retention periods may vary depending on legal requirements and the sensitivity of the data.

6. Security of Personal Data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures may include access controls, encryption, monitoring, staff training, and secure storage practices.

While we take reasonable steps to safeguard data, no system can be guaranteed to be completely secure. We therefore encourage users to keep their own credentials and account information confidential.

7. Your Rights Under GDPR

As a data subject, you may have the following rights, subject to applicable legal conditions and limitations:

Right of access: to request confirmation of whether we process your personal data and to receive a copy of it.
Right to rectification: to ask for inaccurate or incomplete data to be corrected.
Right to erasure: to request deletion of your personal data in certain circumstances.
Right to restriction: to request limited processing in specific situations.
Right to data portability: to receive your data in a structured, commonly used, machine-readable format and, where feasible, have it transferred to another controller.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
Right not to be subject to automated decision-making: to not be subject to decisions based solely on automated processing that produce legal or similarly significant effects, except where permitted by law.

To exercise these rights, you may submit a request through the available service channels. We may need to verify your identity before responding. We will respond within the timeframe required by GDPR, unless an extension is lawfully permitted.

8. Children’s Data

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children where doing so would be inconsistent with applicable law. If we become aware that such data has been collected without appropriate authorisation, we will take steps to delete it or obtain the required consent where lawful.

9. Data Accuracy and Responsibility

We rely on the information provided by customers to be accurate and up to date. You should inform us of any changes to your personal data so that we can keep our records accurate and relevant. Maintaining accurate information helps us provide efficient services and comply with legal obligations.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal, technical, or operational requirements. Any revised version will take effect when made available. We encourage users to review this policy periodically so they remain informed about how personal data is handled.

11. Summary of Key Principles

We are committed to processing personal data in accordance with the core principles of GDPR, including:

lawfulness, fairness, and transparency;
purpose limitation;
data minimisation;
accuracy;
storage limitation;
integrity and confidentiality;
accountability.

This means we aim to process only the data that is necessary, keep it only as long as needed, and protect it with appropriate safeguards. If a conflict arises between operational convenience and data protection obligations, we will prioritise compliance and the rights of individuals.

This Privacy Policy applies to all customers in the area and forms part of our commitment to responsible data handling and GDPR compliance.