Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with the services offered to all customers in the area. It applies to every customer in the area, regardless of the channel used to access the services, and is designed to meet the requirements of the General Data Protection Regulation (GDPR).

1. Who this Policy Applies To

This Policy applies to all customers in the area who interact with the services, whether as a visitor, registered user, customer, or prospective customer. By using the services, customers acknowledge that their personal data may be processed in accordance with this Policy and applicable data protection laws.

2. Personal Data We Collect

We may collect and process different categories of personal data depending on the nature of your interaction with the services. The categories may include:

Identity data such as name, title, and similar identifiers.
Contact data such as address, email address, and phone number.
Account data such as login details, user preferences, and profile information.
Transaction data such as purchase history, payment status, and service records.
Technical data such as device information, IP address, browser type, language settings, and access logs.
Usage data such as interactions with features, pages visited, and service activity.
Communication data such as messages, requests, feedback, and correspondence.
Marketing preferences such as communication choices and consent records.

We generally collect personal data directly from you when you provide it, and we may also receive data automatically through technical systems or from third parties where permitted by law.

3. How We Use Personal Data

Personal data is used for legitimate business and operational purposes, including to:

provide, manage, and improve services;
process transactions and maintain service records;
verify identity and prevent fraud;
respond to enquiries and support requests;
customize user experience and preferences;
analyze service performance and usage trends;
maintain security, prevent abuse, and detect unauthorized activity;
comply with legal obligations;
send administrative communications;
where permitted, send marketing communications in line with your preferences.

We do not process personal data in ways that are incompatible with the purposes for which it was collected unless we have a lawful basis to do so and have informed you where required.

4. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for each processing activity. Depending on the context, we may rely on one or more of the following:

Contract: processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
Legal obligation: processing is necessary to comply with legal or regulatory requirements.
Legitimate interests: processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. This may include service improvement, security, fraud prevention, and business administration.
Consent: processing is based on your freely given, specific, informed, and unambiguous consent, where required by law.
Vital interests: in rare cases, processing may be necessary to protect someone’s life.
Public task: where applicable, processing may be necessary for the performance of a task carried out in the public interest.

Where processing is based on consent, you may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting, tax, audit, and regulatory requirements. Retention periods depend on several factors, such as:

the nature of the data;
the purpose of processing;
whether there is an ongoing contractual relationship;
applicable legal retention obligations;
the need to resolve disputes or enforce agreements.

When personal data is no longer required, it is securely deleted, anonymized, or otherwise disposed of in a manner designed to prevent unauthorized access or reuse.

6. Sharing of Personal Data and Processors

We may share personal data with trusted third parties acting as processors or, where applicable, as independent controllers. Processors only process personal data on our instructions and are required to implement appropriate technical and organizational measures to protect it.

Examples of processors may include:

service hosting and infrastructure providers;
payment service providers;
IT support and maintenance providers;
analytics and performance measurement providers;
customer communication and messaging providers;
professional advisers and compliance service providers.

Where personal data is transferred to third parties, we require appropriate safeguards to protect it. This may include contractual protections, confidentiality commitments, and security obligations. Personal data may also be disclosed where required by law, court order, or lawful request from public authorities.

7. International Transfers

If personal data is transferred outside the European Economic Area or another jurisdiction with equivalent safeguards, we take steps to ensure that the transfer is lawful and protected by appropriate measures. These may include adequacy decisions, standard contractual clauses, or other legally recognized safeguards.

8. Security of Personal Data

We use reasonable and appropriate technical and organizational measures to protect personal data against accidental loss, unauthorized access, alteration, disclosure, or destruction. These measures may include access controls, encryption where appropriate, secure storage, staff confidentiality duties, and regular review of security practices. While no system can be completely secure, we work to reduce risks and protect data in line with recognized standards.

9. Your Rights Under GDPR

As a data subject, you have several rights under GDPR, subject to certain conditions and exceptions. These rights include:

Right of access: to obtain confirmation of whether your personal data is being processed and receive a copy of that data.
Right to rectification: to request correction of inaccurate or incomplete personal data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction of processing: to request that processing be limited in certain cases.
Right to data portability: to receive personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where technically feasible.
Right to object: to object to processing based on legitimate interests or for direct marketing purposes.
Right not to be subject to automated decision-making: to not be subject to a decision based solely on automated processing, including profiling, where that produces legal or similarly significant effects, unless permitted by law.

You may also have the right to withdraw consent where processing is based on consent. Exercising a right will not usually affect the lawfulness of processing carried out before the request was received.

How Requests Are Handled

We will respond to valid rights requests within the time limits required by GDPR and may request information to verify identity before actioning a request. If a request is complex or numerous, the response period may be extended as allowed by law. We may refuse requests that are manifestly unfounded or excessive, or where retention or processing is required by law.

10. Marketing Preferences

Where permitted, we may use personal data to provide information about services, offers, or updates. You can object to direct marketing at any time. If you opt out of marketing, you may still receive important service-related communications that are necessary for operational or legal reasons.

11. Cookies and Similar Technologies

Where applicable, we may use cookies and similar technologies to support functionality, remember preferences, analyze use, and improve security. Some technologies are necessary for operation, while others may depend on consent or your browser settings. You can manage cookie settings through your device or browser controls, subject to the limitations of those tools.

12. Children’s Data

The services are not intended to knowingly collect personal data from children without appropriate authorization where required by law. If we become aware that personal data has been collected from a child in breach of applicable requirements, we will take reasonable steps to delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal, operational, or technical requirements. Any updated version will apply from the date it becomes effective. Customers in the area are encouraged to review the Policy periodically to stay informed about how personal data is handled.

14. Final Statement

This Privacy Policy is intended to provide transparent information about our data practices and the rights available to individuals under GDPR. By using the services, customers in the area acknowledge that their personal data may be processed as described in this Policy, subject always to applicable law. Your privacy matters, and we are committed to processing personal data lawfully, fairly, and securely. Nothing in this Policy limits your statutory rights under GDPR or other applicable data protection laws.