Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected in connection with the services provided to customers in the area. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws.

We are committed to processing personal data lawfully, fairly, and transparently. We also aim to ensure that any information handled in the course of providing services is limited to what is necessary, retained only for as long as needed, and protected with appropriate technical and organisational measures.

1. Personal Data We Collect

We may collect and process different categories of personal data depending on how a customer interacts with our services. This may include:

Identity data: name, title, and similar identifiers.
Contact data: address, email address, telephone number, and other communication details.
Account and service data: records relating to purchases, requests, preferences, service history, and customer interactions.
Technical data: IP address, device information, browser type, operating system, and usage logs.
Transaction data: payment confirmations, billing records, and related administrative information.
Communication data: correspondence, enquiries, complaints, feedback, and any information shared during support interactions.

We generally do not intentionally collect sensitive personal data unless it is necessary for a lawful purpose and you choose to provide it, or we are required by law to process it. Where such data is processed, it will be handled with additional safeguards.

2. How We Use Personal Data

Personal data is used only for defined purposes and in a manner consistent with GDPR principles. These purposes may include:

providing requested services and managing customer relationships;
processing transactions, billing, and service administration;
responding to enquiries, support requests, and complaints;
maintaining records and ensuring service quality;
preventing fraud, misuse, and security incidents;
meeting legal, regulatory, and compliance obligations;
improving services, systems, and customer experience;
where permitted, carrying out limited analytics and operational reporting.

We do not use personal data in ways that are incompatible with the purposes for which it was collected, unless we have a lawful basis to do so and, where required, notify affected individuals.

3. Lawful Basis for Processing

We process personal data only when we have a valid lawful basis under GDPR. Depending on the context, this may include:

Performance of a contract: where processing is necessary to provide services, manage accounts, or complete requested transactions.
Legal obligation: where processing is required to comply with applicable laws, tax rules, accounting duties, or regulatory requirements.
Legitimate interests: where processing is necessary for our legitimate business interests, such as service improvement, security, fraud prevention, and internal administration, provided these interests are not overridden by your rights and freedoms.
Consent: where you have given clear and specific consent for a particular purpose, such as certain optional communications or data uses.
Vital interests: in rare cases where processing is necessary to protect someone’s life or physical safety.
Public task: where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, if applicable.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

4. Sharing and Processors

We may share personal data with trusted third parties where necessary to support our operations or fulfil legal and contractual obligations. These third parties may act as data processors or independent controllers depending on the context.

Processors may include providers of:

IT hosting and infrastructure services;
data storage and backup solutions;
payment and billing services;
customer support and communications tools;
security, monitoring, and fraud-prevention services;
professional services such as legal, accounting, or compliance support.

When we use processors, we ensure appropriate contractual safeguards are in place, including data processing agreements requiring them to process data only on our instructions, maintain confidentiality, and implement suitable security measures.

We may also disclose personal data where required by law, where necessary to protect legal rights, or in connection with a lawful request from a public authority. Any disclosure will be limited to what is reasonably necessary.

5. International Transfers

If personal data is transferred outside the European Economic Area or another jurisdiction with equivalent data protection rules, we will ensure an adequate level of protection is in place. This may include the use of Standard Contractual Clauses, adequacy decisions, or other approved safeguards. Where necessary, we assess the risks associated with the transfer and apply additional measures to protect the data.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting, reporting, or contractual obligations. The exact retention period depends on the type of data and the reason for processing.

In general, retention periods are determined by considering:

the duration of our relationship with the customer;
legal and regulatory retention requirements;
limitation periods for potential claims;
operational needs such as audits, dispute resolution, or recordkeeping.

When personal data is no longer needed, we will securely delete, anonymise, or archive it in accordance with our retention practices. Where possible, data is minimised at every stage of the lifecycle.

7. Security of Personal Data

We take the security of personal data seriously and apply appropriate measures to protect it against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures may include access controls, encryption where appropriate, staff training, secure storage, and regular review of security practices.

While no system can be guaranteed to be completely secure, we continuously work to maintain a level of protection appropriate to the risks associated with processing.

8. Your Rights Under GDPR

If you are a customer in the area and your personal data is processed by us, you may have the following rights, subject to certain conditions and exceptions under law:

Right of access: to obtain confirmation of whether your data is being processed and to receive a copy of it.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of your data where there is no valid reason for continued processing.
Right to restriction: to request limited use of your data in certain circumstances.
Right to data portability: to receive certain data in a structured, commonly used, machine-readable format and to have it transmitted where technically feasible.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right not to be subject to automated decision-making: to avoid decisions based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects.

You may also have the right to withdraw consent at any time where processing is based on consent. Exercising these rights will not usually incur a charge, although requests that are manifestly unfounded or excessive may be refused or charged where permitted by law.

9. How Requests Are Handled

When a data protection request is received, we may need to verify your identity before taking action. This helps protect against unauthorised disclosure of personal data. We aim to respond within the time limits set by GDPR, generally within one month, though this period may be extended where requests are complex or numerous.

If we cannot fulfil a request, we will explain the reasons where legally permitted. You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe your rights have been infringed.

10. Children’s Data

Our services are not directed at children unless specifically stated otherwise. We do not knowingly collect personal data from children without appropriate authorisation where required. If we become aware that data has been collected improperly, we will take steps to delete it or obtain the necessary consent or authorisation.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service arrangements. Any updated version will apply from the time it takes effect. We encourage customers to review this policy periodically to stay informed about how personal data is handled.

Summary of Key Principles

Lawfulness: data is processed only with a valid legal basis.
Transparency: customers are informed about how their data is used.
Data minimisation: only necessary data is collected and processed.
Storage limitation: data is retained only as long as needed.
Integrity and confidentiality: security safeguards are applied to protect data.

This Privacy Policy applies to all customers in the area and is intended to provide a clear explanation of our data protection practices in line with GDPR requirements.