Privacy Policy -

Overview

Purpose. This Privacy Policy explains how we collect, use, disclose, retain and protect personal data in connection with our services. This Policy applies to all customers in the area and to any individual whose personal data we process in relation to those customers. The Policy is intended to ensure compliance with the General Data Protection Regulation (GDPR) and related data protection laws.

Scope and Applicability

This Policy covers personal data processed by us as a data controller, and where we act as a data processor on behalf of another party we will process personal data in accordance with that party's instructions and applicable contractual terms. This Policy applies to all customers in the area and to the processing of their data and the data of individuals affiliated with those customers (employees, contractors, end users).

Data We Collect

We collect and process the following categories of personal data:

Identification data: names, identifiers, dates of birth, national ID numbers where required for lawful purposes.
Contact data: postal addresses, email addresses, telephone numbers.
Account and transactional data: account usernames, passwords (securely hashed), order history, billing and payment details.
Financial data: payment card details and bank account information when required for transactions (processed through payment processors).
Technical data: IP addresses, device identifiers, browser and operating system information, log files and usage data collected through cookies and similar technologies.
Communications data: messages, support requests, and other correspondence.
Marketing and preferences: communication preferences, opt-in/opt-out choices, and profiling data used to personalize services where consent is given or another lawful basis applies.

Sensitive Personal Data

We generally do not collect special categories of personal data (sensitive data) such as health, racial or ethnic origin, political opinions, or religious beliefs except where strictly necessary and where we have an explicit lawful basis to do so. If we need such data, we will obtain explicit consent or identify another lawful basis and inform you of that basis in advance.

Lawful Bases for Processing

Under the GDPR we rely on one or more of the following lawful bases to process personal data:

Performance of a contract – processing necessary to perform our contract with you or to take steps at your request prior to entering into a contract.
Legal obligation – processing necessary to comply with laws and regulatory obligations.
Consent – where you have given clear consent for us to process your personal data for a specific purpose (for example, marketing communications or certain profiling).
Legitimate interests – where processing is necessary for our legitimate interests or those of a third party, provided your rights and freedoms do not override those interests (for example, fraud prevention, network security, direct marketing where appropriate).
Vital interests – where processing is necessary to protect someone’s life.

How We Use Your Data

We use personal data to provide, maintain, and improve our services, to process transactions, to communicate with customers, to deliver customer support, to detect and prevent fraud and abuse, to meet legal obligations and to send operational and marketing communications where permitted. We never use data for purposes incompatible with the original collection purpose unless we obtain a new lawful basis.

Data Retention

We retain personal data for as long as necessary to fulfill the purposes outlined in this Policy and to comply with legal, regulatory, tax or accounting requirements.

Account and transactional data: retained for the duration of the customer relationship and for a reasonable period thereafter to meet contractual, legal and audit obligations (typically up to 7 years for financial records unless a longer retention period is required by law).
Support and communications: retained for the period necessary to resolve issues and for business administration (generally up to 3 years unless otherwise required).
Marketing preferences: retained until you withdraw consent or opt out.
Logs and technical data: retained for security, troubleshooting and analytics purposes for a limited period, usually up to 24 months unless required longer for investigation or litigation.

Retention periods are determined by considering the nature of the data, the purposes of processing, statutory retention requirements and legitimate business needs. When data is no longer needed we will securely delete, anonymize or aggregate it.

Processors and Third Parties

We share personal data with third-party processors that provide services on our behalf. These may include:

Payment processors and acquirers
Cloud hosting and infrastructure providers
Analytics and performance monitoring providers
Email and communication service providers
Marketing, CRM and customer support providers
Professional advisors such as lawyers and auditors

All processors act under contract, on our documented instructions, and are required to implement appropriate technical and organizational measures to protect personal data. We conduct due diligence and require contractual safeguards (including data processing agreements with standard contractual clauses or equivalent measures) for any transfers of personal data outside the European Economic Area.

Your Rights

Under the GDPR individuals have a set of rights in relation to their personal data. These rights include:

Right of access: you have the right to request confirmation of processing and a copy of the personal data we hold about you.
Right to rectification: you may request correction of inaccurate or incomplete data.
Right to erasure (“right to be forgotten”): in certain circumstances you may request deletion of your personal data.
Right to restriction of processing: you may request limits on how your data is used in certain situations.
Right to data portability: where applicable, you may request a copy of your data in a structured, commonly used and machine-readable format.
Right to object: you may object to processing based on legitimate interests or direct marketing at any time.
Right to withdraw consent: if processing is based on consent you can withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.
Right to lodge a complaint: you have the right to lodge a complaint with a supervisory authority in your jurisdiction if you believe your rights have been violated.

How to Exercise Your Rights

To exercise any of the rights described above, please use the mechanisms made available to you in your account or the communication channels through which you normally engage with us. We will respond to requests in accordance with applicable law and within the timeframes required by the GDPR. Some requests may require additional verification to protect the rights and freedoms of others.

Security

We implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Measures include access controls, encryption where applicable, network security and staff training. However, no method of transmission or storage is completely secure; absolute security cannot be guaranteed.

Automated Decision-Making and Profiling

When we use automated decision-making or profiling that produces legal effects or similarly significant effects, we will provide meaningful information about the logic involved, the significance and the envisaged consequences for the data subject, and we will respect rights to object where applicable. In such cases, you will be informed in advance and applicable safeguards will be applied.

Changes to this Policy

We may update this Policy to reflect changes in our processing activities, legal requirements, or service features. Substantive changes will be communicated where required by law or contract. Continued use of our services following notification constitutes acceptance of the updated Policy.

Additional Information

This Policy is intended to describe key aspects of our privacy practices but does not create contractual rights except where expressly stated. For further details about how we process personal data in specific contexts provided to you as a customer, please review any supplemental notices or contractual terms provided as part of your relationship with us. This Privacy Policy applies to all customers in the area.