Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with the services offered by our business. It applies to all customers in the area where our services are provided. We are committed to processing personal data in a lawful, fair, and transparent manner in accordance with the General Data Protection Regulation (GDPR).

1. Scope of this Policy

This Policy applies to personal data relating to customers, prospective customers, website visitors where applicable, and other individuals whose information we process in the course of providing our services. It covers all data processing activities carried out by us as a data controller unless we state otherwise.

Personal data means any information relating to an identified or identifiable natural person. This may include names, contact details, account details, transaction records, service preferences, and other information that can directly or indirectly identify an individual.

2. Information We Collect

We collect only the information necessary to operate our services, meet legal requirements, and improve customer experience. Depending on your interaction with us, we may collect the following categories of personal data:

Identity data: name, title, username, or similar identifiers.
Contact data: postal address, email address, telephone number, and other contact details.
Transaction data: records of purchases, payments, invoices, and service history.
Technical data: device information, log data, browser type, IP address, and usage patterns where relevant.
Communication data: records of correspondence, enquiries, complaints, and customer support interactions.
Preference data: marketing choices, service preferences, and communication settings.

Where necessary, we may also collect special category data only if a lawful basis exists and additional safeguards are in place. We do not intentionally collect more information than is needed for the specified purpose.

3. How We Use Personal Data

We use personal data for the following purposes:

To provide, manage, and deliver our services.
To process payments, invoices, and account administration.
To communicate with customers about services, bookings, updates, or support requests.
To handle complaints, disputes, and service-related enquiries.
To comply with legal, tax, accounting, and regulatory obligations.
To maintain security, prevent fraud, and protect our systems and customers.
To improve service quality and customer experience.
To send marketing communications where permitted by law and where consent or another lawful basis applies.

We do not use personal data for purposes that are incompatible with the original reason for collection unless we have a valid legal basis and, where required, provide appropriate notice.

4. Lawful Basis for Processing

Under GDPR, we process personal data only where we have a lawful basis. Depending on the context, we may rely on one or more of the following:

4.1 Performance of a Contract

We process personal data when it is necessary to enter into or perform a contract with you, such as providing services, managing accounts, or processing payments.

4.2 Legal Obligation

We may process personal data to comply with legal requirements, including tax, accounting, consumer protection, and regulatory obligations.

4.3 Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided that those interests are not overridden by your rights and freedoms. Examples include service improvement, fraud prevention, internal administration, and security monitoring.

4.4 Consent

Where required by law, we rely on your consent, for example for certain marketing activities or optional processing. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4.5 Vital Interests and Public Interest

In limited situations, we may process data to protect vital interests or where processing is necessary for a task carried out in the public interest or in the exercise of official authority, if applicable.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for legal, accounting, tax, dispute resolution, and operational requirements. Retention periods vary depending on the type of data and the reason for processing.

In general:

Customer and transaction records are kept for the duration of the relationship and for the period required by law afterward.
Support and communication records are kept for a reasonable period to manage enquiries and service follow-up.
Marketing data is retained until you opt out, withdraw consent, or object where applicable.
Technical and security logs are kept only as long as needed for monitoring and incident management.

When data is no longer needed, we will securely delete, anonymise, or archive it in line with our retention practices and legal obligations.

6. Sharing of Personal Data and Processors

We may share personal data with third parties only when necessary and only under appropriate safeguards. These third parties may act as processors on our behalf or, in some cases, as independent controllers.

Our processors may include:

IT and hosting providers that store or support systems and data infrastructure.
Payment service providers that handle transactions securely.
Professional advisers such as accountants, auditors, or legal advisers.
Customer support and communication service providers.
Security, fraud prevention, and compliance service providers.

We require processors to process personal data only on our documented instructions, to implement suitable technical and organisational security measures, and to respect confidentiality obligations. Where data is transferred outside the European Economic Area, we ensure appropriate safeguards are used, such as standard contractual clauses or other lawful transfer mechanisms.

We may also disclose personal data where required by law, court order, regulatory request, or to protect our rights, customers, or business.

7. Data Security

We take appropriate measures to protect personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures may include access controls, encryption, secure storage, staff training, and regular review of security practices. While no system can be guaranteed completely secure, we are committed to maintaining a level of protection appropriate to the risk.

8. Your Rights Under GDPR

Individuals whose personal data we process have specific rights under GDPR. Subject to legal conditions and exemptions, you may have the right to:

Access your personal data and obtain information about how we process it.
Rectification of inaccurate or incomplete data.
Erasure of your data in certain circumstances, also known as the right to be forgotten.
Restriction of processing in certain circumstances.
Data portability for data you provided to us and where processing is based on consent or contract.
Objection to processing based on legitimate interests or for direct marketing.
Withdraw consent at any time where processing is based on consent.
Not be subject to automated decision-making in circumstances where such decisions produce legal or similarly significant effects, unless permitted by law.

To exercise these rights, individuals may make a request using the methods we make available in our service processes. We may need to verify identity before responding to a request. We aim to respond within the timeframes required by GDPR.

9. Children’s Data

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children without appropriate authorization or consent where required by law. If we become aware that personal data has been collected inappropriately, we will take reasonable steps to delete it.

10. Marketing Preferences

Where permitted, we may send promotional communications about services, offers, or updates. You can object to direct marketing at any time. If consent is required, you may withdraw it whenever you choose. We will respect your preferences and keep a record of them as needed to ensure compliance.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, services, or processing practices. Any revised version will apply from the date it is made effective. We encourage you to review this Policy periodically so that you remain informed about how we use personal data.

12. Summary of Core Principles

We apply the GDPR principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability. In practical terms, this means we only collect what we need, use it for clear purposes, protect it with suitable safeguards, and retain it only as long as necessary.

By using our services, you acknowledge that your personal data may be processed in accordance with this Privacy Policy and applicable data protection laws.