Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when services are provided to customers in the relevant area. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using the services, customers acknowledge that personal data may be processed in accordance with this Policy.

1. Data We Collect

We collect only the personal data that is necessary for the purposes described in this Policy. Depending on how services are used, the categories of data may include:

Identity data: name, title, and similar identifiers.
Contact data: address, email address, telephone number, and other communication details.
Account data: login credentials, account settings, preferences, and service history.
Transaction data: records of purchases, payments, billing information, and related service records.
Technical data: IP address, device identifiers, browser type, operating system, and usage logs.
Communication data: messages, requests, complaints, and feedback sent to us.
Usage data: information about how services are accessed, viewed, and interacted with.

We may also receive data from third parties where permitted by law, such as payment providers, service partners, verification providers, or publicly available sources. When we collect data indirectly, we ensure that such collection is lawful and that data subjects are informed where required.

2. How We Use Personal Data

Personal data is processed for specific and legitimate purposes. These may include:

providing and managing services;
creating and maintaining customer accounts;
processing transactions and fulfilling contractual obligations;
responding to requests and support inquiries;
improving service quality, functionality, and security;
detecting, preventing, and investigating fraud or misuse;
meeting legal, regulatory, tax, accounting, and reporting obligations;
sending essential service notifications;
where permitted, carrying out analytics and service development.

We will not process personal data in a way that is incompatible with the purposes for which it was collected, unless we have a valid lawful basis and, where required, provide appropriate notice.

3. Lawful Basis for Processing

Under GDPR, we only process personal data when we have a lawful basis. Depending on the purpose, our lawful bases may include:

Performance of a contract: when processing is necessary to provide services, manage an account, or fulfill a request.
Legal obligation: when processing is required to comply with law, regulation, court order, or lawful authority request.
Legitimate interests: when processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the rights and freedoms of the individual.
Consent: where the law requires consent, and where consent has been freely given, specific, informed, and unambiguous.

When we rely on legitimate interests, we consider the balance between our interests and the impact on the individual. Where consent is used, it may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Sharing and Processors

We may share personal data with trusted third parties that act as processors or independent controllers, only where necessary and lawful. Processors handle personal data on our instructions and are required to protect it appropriately. Examples of processors may include:

IT and hosting providers supporting infrastructure, storage, and system maintenance;
Payment processors managing payment transactions and related fraud checks;
Customer support providers assisting with service communications and case handling;
Analytics and security providers helping monitor performance, reliability, and abuse prevention;
Professional advisers such as legal, accounting, or audit service providers;
Regulatory, tax, or law enforcement authorities when disclosure is required by law.

We require processors to implement appropriate technical and organizational measures to protect personal data, to process it only for authorized purposes, and to assist us in meeting GDPR obligations. Where personal data is transferred outside the European Economic Area or equivalent jurisdiction, such transfers are protected by appropriate safeguards such as standard contractual clauses or other lawful transfer mechanisms.

5. Data Retention

We retain personal data only for as long as necessary to achieve the purposes for which it was collected, including for legal, accounting, tax, and reporting requirements. Retention periods vary depending on the type of data, the purpose of processing, and applicable legal obligations.

In general:

account and service records are retained for the duration of the customer relationship and for a reasonable period afterward;
transaction and billing records are retained for the period required by tax and financial laws;
support communications are retained for as long as needed to resolve issues and improve service management;
technical logs may be retained for security, troubleshooting, and fraud prevention for a limited period;
data processed on the basis of consent is retained until consent is withdrawn, unless another lawful basis applies.

When personal data is no longer needed, we will delete it, anonymize it, or securely archive it in accordance with our retention practices and legal requirements. Retention periods are reviewed regularly to ensure they remain proportionate and lawful.

6. Data Security

We take appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. These measures may include access controls, encryption where appropriate, secure storage, staff confidentiality obligations, and regular review of security practices. While no system can be guaranteed to be completely secure, we aim to maintain a level of protection appropriate to the risk associated with the processing.

7. Your Rights Under GDPR

Individuals whose personal data is processed under this Policy have rights under GDPR. Subject to legal conditions and exemptions, these rights may include:

Right of access: to obtain confirmation of whether personal data is processed and to receive a copy of that data.
Right to rectification: to request correction of inaccurate or incomplete personal data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request limitation of processing in certain situations.
Right to data portability: to receive personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where applicable.
Right to object: to object to processing based on legitimate interests or to direct marketing where applicable.
Right not to be subject to automated decision-making: to request human review where a decision is made solely by automated means and has legal or similarly significant effects.

Where processing is based on consent, individuals may withdraw consent at any time. Where processing is based on legitimate interests, individuals may object and we will stop processing unless we can demonstrate compelling legitimate grounds that override the objection or unless processing is required for legal claims.

Requests to exercise rights will be handled without undue delay and within the time limits required by law. We may need to verify identity before responding to a request. Some rights may not apply in all circumstances, for example where we must retain data to comply with legal obligations or defend legal claims.

8. Children’s Data

Our services are not intended to be directed to children unless specifically stated otherwise. We do not knowingly collect personal data from children in a manner that violates applicable law. If we become aware that personal data has been collected from a child without appropriate legal basis, we will take reasonable steps to delete it or obtain required authorization.

9. International and Local Applicability

This Privacy Policy applies to all customers in the area and is intended to operate consistently with local legal requirements and GDPR standards. If local law provides additional protections or obligations, those rules will also apply. In the event of a conflict between this Policy and mandatory law, the law will prevail.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, operational practices, or service features. When changes are made, the updated version will apply from the effective date of the revision. We encourage customers to review the Policy periodically to stay informed about how personal data is handled.

Key Principles

Lawfulness, fairness, and transparency guide our data processing.
Purpose limitation ensures data is used only for specified purposes.
Data minimization means we collect only what is necessary.
Accuracy is maintained through reasonable steps to keep data correct.
Storage limitation ensures data is not kept longer than needed.
Integrity and confidentiality are supported through appropriate safeguards.

By continuing to use the services, customers confirm that they have read and understood this Privacy Policy.