Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with the services provided by all customers in the area. It is intended to be clear, transparent, and consistent with the requirements of the General Data Protection Regulation (GDPR). By using the services, customers acknowledge that their personal data will be handled in accordance with this Policy and applicable data protection laws.

1. Scope of This Policy

This Privacy Policy applies to all customers in the area and to any personal data processed in the course of providing products, services, customer support, billing, administration, or related operations. It covers data collected directly from customers, data generated through service use, and data received from third parties where permitted by law.

For the purposes of this Policy, personal data means any information relating to an identified or identifiable natural person. This may include names, contact details, account details, transaction information, technical identifiers, and any other information that can reasonably be linked to an individual.

2. Data Collection

We collect personal data only to the extent necessary for lawful and legitimate purposes. The types of data collected may include:

Identity data: name, title, and similar identifiers.
Contact data: address, telephone number, and email address.
Account data: account identifiers, preferences, and authentication details.
Transaction data: purchase history, payment records, service history, and related records.
Technical data: device information, browser type, IP address, log files, and usage data.
Communication data: records of correspondence, complaints, and service requests.
Marketing and preference data: communication preferences and consent choices where applicable.

Data may be collected directly from individuals when they provide it, automatically when they interact with systems or services, or indirectly from approved business partners, service providers, or public sources where appropriate and lawful. We do not intentionally collect special category data unless required for a specific lawful purpose and with an appropriate legal basis.

3. Lawful Basis for Processing

Personal data is processed only where one or more lawful bases under GDPR apply. Depending on the purpose, processing may rely on the following grounds:

Contract: where processing is necessary to perform a contract or take steps before entering into a contract.
Legal obligation: where processing is necessary to comply with applicable laws, regulations, tax rules, or accounting requirements.
Legitimate interests: where processing is necessary for legitimate business purposes, provided that these interests do not override the rights and freedoms of the individual.
Consent: where the individual has given clear, informed, and freely given consent for one or more specific purposes.
Vital interests: where processing is necessary to protect someone’s life in an emergency.
Public task: where processing is necessary for the performance of a task carried out in the public interest, if applicable.

Where processing is based on consent, individuals have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

4. Purposes of Processing

Personal data may be processed for the following purposes:

to provide and administer services;
to manage customer accounts and records;
to communicate service updates and administrative notices;
to process transactions, payments, and refunds;
to respond to inquiries, complaints, and support requests;
to improve service quality, security, and performance;
to comply with legal, regulatory, and audit obligations;
to detect, prevent, and investigate fraud, misuse, and security incidents;
to carry out internal reporting and business analysis;
to send marketing communications where allowed by law and, where required, with consent.

Only data that is relevant, adequate, and limited to what is necessary for the specified purpose will be processed.

5. Data Sharing and Processors

Personal data may be shared with trusted third parties acting as processors or, where applicable, as independent controllers. Processors handle data on documented instructions and are required to protect data by appropriate technical and organizational measures.

Typical categories of processors may include:

IT hosting and infrastructure providers;
payment and billing service providers;
customer support and communication platforms;
security and fraud prevention services;
analytics and reporting tools;
document storage and archiving providers;
professional advisers such as legal, accounting, or audit service providers, where necessary.

Where data is transferred to a processor, we require appropriate contractual safeguards, confidentiality obligations, and data protection commitments. Data may also be disclosed when required by law, court order, or lawful request from public authorities.

We do not sell personal data. Any sharing is limited to what is necessary for the purposes described in this Policy and in accordance with applicable legal requirements.

6. International Transfers

If personal data is transferred outside the European Economic Area or another jurisdiction with equivalent protections, appropriate safeguards will be used. These may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms. Transfers will only occur where suitable protections are in place to preserve an equivalent level of data protection.

7. Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, tax, regulatory, or dispute-resolution requirements. Retention periods vary depending on the nature of the data and the reason for processing.

In general, data is kept for the duration of the customer relationship and for a reasonable period afterward to meet contractual, legal, and operational needs. After the applicable retention period ends, data is securely deleted, anonymized, or archived where required by law.

Retention decisions are based on necessity, legal obligation, and the principle of storage limitation.

8. Data Security

Appropriate technical and organizational measures are used to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption, secure storage, logging, staff confidentiality obligations, and regular security reviews.

Although every reasonable effort is made to protect personal data, no system can be guaranteed to be completely secure. Any suspected data breach will be handled in accordance with applicable legal requirements, including assessment, containment, notification, and remediation where necessary.

9. User Rights Under GDPR

Individuals whose personal data is processed have rights under GDPR. Subject to legal limitations, these rights may include:

Right of access: to obtain confirmation of whether personal data is processed and to receive a copy of that data.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request limitation of processing in specific situations.
Right to data portability: to receive personal data in a structured, commonly used, machine-readable format and to request transmission to another controller where technically feasible.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent.
Right not to be subject to automated decision-making: including profiling, where such processing has legal or similarly significant effects, unless permitted by law.

Requests to exercise these rights will be handled in accordance with applicable law and within the time limits required by GDPR. Verification of identity may be necessary before responding to certain requests.

How Rights Are Managed

To protect privacy, requests may require reasonable information to confirm identity and locate relevant records. If a request is complex or numerous, the response period may be extended as permitted by law. Where a request cannot be fully fulfilled, an explanation will be provided within the limits of the law.

10. Children’s Data

The services are not intended to be directed at children unless explicitly stated otherwise. Personal data of children will only be processed where lawful and appropriate safeguards are in place. Where consent is required for a child, the relevant legal conditions under GDPR will be followed.

11. Changes to This Policy

This Privacy Policy may be updated from time to time to reflect changes in legal, technical, or operational requirements. Any material changes will be made available through appropriate notice. Continued use of the services after changes take effect indicates acknowledgement of the updated Policy, to the extent permitted by law.

12. General Statement

This Privacy Policy applies to all customers in the area and is intended to ensure transparent, fair, and lawful processing of personal data. It reflects the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability.

By processing personal data responsibly and only for legitimate purposes, the policy seeks to protect individual rights while supporting lawful business operations.

End of Privacy Policy.