Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area and is intended to meet the standards of the General Data Protection Regulation (GDPR). We are committed to handling personal data lawfully, fairly, and transparently, and to respecting the rights of individuals whose data we process.

1. Scope of This Policy

This Policy applies to all individuals who use, request, or otherwise interact with our services in the relevant area. It covers personal data collected through direct interactions, automated technologies, and third parties where applicable. For the purposes of this Policy, personal data means any information relating to an identified or identifiable natural person.

We process personal data only to the extent necessary for specific and legitimate purposes. We do not use personal data in ways that are incompatible with those purposes.

2. Data We Collect

We may collect and process the following categories of personal data:

Identity data: name, title, and similar identifiers.
Contact data: billing address, delivery address, email address, and telephone number.
Transaction data: details about purchases, services requested, payments, and related records.
Technical data: IP address, device identifiers, browser type, operating system, and usage logs.
Profile data: preferences, service interests, feedback, and communication choices.
Communication data: messages, inquiries, complaints, and other correspondence.
Financial data: limited payment-related information necessary to process transactions, where relevant.

We do not intentionally collect special category data unless it is necessary, lawful, and appropriate safeguards are in place. Where such data is processed, we do so only in accordance with GDPR requirements and applicable local law.

3. How We Collect Data

We collect personal data in several ways, including:

information you provide directly when you make an enquiry, place an order, or communicate with us;
automated collection through cookies, logs, and similar technologies;
information from service providers, payment processors, or other entities acting on our behalf;
records generated through the performance of a contract or the provision of services.

Where required by law, we will obtain consent before placing non-essential cookies or using data for specific optional purposes.

4. Lawful Basis for Processing

We process personal data only where we have a valid lawful basis under GDPR. Depending on the context, the lawful basis may be one or more of the following:

Performance of a contract: when processing is necessary to provide requested services, manage accounts, deliver products, or handle related administration.
Legal obligation: when processing is required to comply with tax, accounting, consumer protection, or other legal obligations.
Legitimate interests: when processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. Examples include improving services, preventing fraud, maintaining security, and managing business operations.
Consent: where you have given clear and informed consent for a specific purpose, such as certain marketing activities or non-essential cookies.
Vital interests: in rare cases where processing is necessary to protect someone’s life.
Public task: where processing is necessary for a task carried out in the public interest or under official authority, if applicable.

Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

5. How We Use Personal Data

We use personal data for the following purposes:

to provide and manage services;
to process payments and transactions;
to communicate with customers;
to respond to enquiries and support requests;
to maintain records and business administration;
to improve service quality and user experience;
to detect, prevent, and investigate fraud or misuse;
to comply with legal and regulatory obligations;
to send marketing communications where permitted by law and, where required, with your consent.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects without appropriate safeguards, unless permitted by law and clearly communicated.

6. Retention of Data

We keep personal data only for as long as necessary to fulfill the purposes for which it was collected, including for legal, accounting, or reporting requirements. Retention periods vary depending on the type of data and the reason for processing.

In general:

contract and transaction records are retained for the duration of the relationship and for the period required by applicable law;
communications and support records are retained as long as necessary to resolve issues and maintain accurate records;
consent-based marketing records are retained until consent is withdrawn or the data is no longer needed;
technical and security logs are retained for a limited period consistent with security and operational needs.

When data is no longer needed, we will delete it, anonymize it, or securely archive it in accordance with our retention practices and legal requirements.

7. Processors and Data Sharing

We may share personal data with trusted third parties who act as data processors or independent controllers, depending on the context. Processors are engaged only where necessary and are required to process data under our instructions and with appropriate confidentiality and security measures.

Examples of processors may include:

IT and hosting providers;
payment and transaction service providers;
customer support and communication platforms;
analytics and security service providers;
professional advisers and administrative support providers.

We may also disclose personal data where required by law, court order, regulatory request, or to protect rights, safety, or security. Where a transfer of personal data outside the applicable jurisdiction is necessary, we will ensure appropriate safeguards are in place in line with GDPR, such as adequacy decisions, standard contractual clauses, or equivalent lawful mechanisms.

8. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures are designed to ensure a level of security appropriate to the risk, taking into account the nature of the data and the processing activities involved.

Security measures may include access controls, encryption where appropriate, secure storage, staff confidentiality obligations, and regular review of systems and procedures. No method of transmission or storage is entirely secure, but we strive to protect personal data to the best of our ability.

9. Your Rights Under GDPR

Individuals whose data we process have the following rights, subject to the conditions and exceptions set out in GDPR:

Right of access – to obtain confirmation of whether we process your data and to receive a copy of it;
Right to rectification – to request correction of inaccurate or incomplete data;
Right to erasure – to request deletion of your data in certain circumstances;
Right to restriction – to request limited processing in specific situations;
Right to data portability – to receive data you provided in a structured, commonly used, machine-readable format and to transmit it to another controller where technically feasible;
Right to object – to object to processing based on legitimate interests or for direct marketing;
Right to withdraw consent – where processing is based on consent;
Right not to be subject to solely automated decisions – where such decisions have legal or similarly significant effects, except where permitted by law.

Exercising your rights will not usually involve a fee. However, if a request is manifestly unfounded, repetitive, or excessive, we may refuse it or charge a reasonable administrative fee where permitted by law.

How Rights Can Be Exercised

To exercise your rights, you may submit a request using the appropriate available channel. We may need to verify your identity before responding, to ensure that personal data is not disclosed to unauthorized persons. We will respond within the timeframe required by GDPR, typically within one month, unless the request is complex or numerous.

10. Complaints

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the relevant data protection supervisory authority in the applicable jurisdiction. We encourage individuals to raise concerns promptly so that we may address them directly where possible.

11. Children’s Data

Our services are not intended for children unless otherwise clearly stated. We do not knowingly collect personal data from children without lawful basis and, where required, parental consent or equivalent authorization. If we become aware that personal data has been collected inappropriately, we will take reasonable steps to delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or our processing practices. Any revised version will apply from the date it is made effective. We encourage individuals to review this Policy periodically so they remain informed about how personal data is handled.

13. General Statement

This Privacy Policy is intended to provide clear information about our processing practices and GDPR rights. It applies to all customers in the area and should be read together with any other applicable terms, notices, or policies that may supplement it. We remain committed to data minimization, purpose limitation, accuracy, storage limitation, integrity, confidentiality, and accountability in all our processing activities.