Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected. It applies to all customers in the area and is intended to provide clear information about processing practices and individual rights under applicable data protection law, including the General Data Protection Regulation (GDPR).

1. Who this policy applies to

This policy applies to every customer, user, visitor, or individual whose personal data is processed in connection with the services offered in the area. By using the services, communicating with the organization, or otherwise providing personal data, individuals acknowledge that their information may be processed as described in this policy.

2. Data we collect

We may collect and process different types of personal data depending on the relationship and interaction with us. The categories of data may include:

Identity data such as name, title, and similar identifiers.
Contact data such as address, email address, and telephone number.
Account and transaction data such as service history, purchase records, billing information, and payment-related details.
Technical data such as IP address, device information, browser type, operating system, and usage logs.
Communication data such as records of inquiries, requests, complaints, and correspondence.
Preference data such as stated interests, consent choices, and service preferences.

We generally collect personal data directly from the individual, but may also receive it from authorized representatives, service providers, payment processors, public sources, or other lawful third parties. Where required, we will indicate whether providing data is mandatory or optional and explain the possible consequences of not providing it.

3. How we use personal data

Personal data is processed for specified, explicit, and legitimate purposes. These may include:

providing and managing services;
processing transactions and related administration;
communicating updates, notices, and service information;
handling support requests and customer care;
maintaining security, fraud prevention, and abuse detection;
meeting legal, accounting, and regulatory obligations;
improving services, performance, and user experience;
establishing, exercising, or defending legal claims.

We will not use personal data in ways that are incompatible with these purposes unless we have a lawful basis to do so and, where necessary, have provided appropriate notice.

4. Lawful basis for processing

Under GDPR, we process personal data only where a lawful basis applies. Depending on the activity, the lawful basis may be one or more of the following:

4.1 Performance of a contract

We process data when it is necessary to enter into or perform a contract with a customer, including delivering services, managing accounts, or fulfilling obligations arising from a purchase or request.

4.2 Legal obligation

We may process data where necessary to comply with legal, tax, accounting, regulatory, or reporting requirements.

4.3 Legitimate interests

We may process data when it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the individual’s rights and freedoms. Examples include service improvement, fraud prevention, network security, record keeping, and business administration. Where required, we balance these interests against the impact on individuals.

4.4 Consent

Where processing is based on consent, it will be obtained in a clear and affirmative manner. Consent can be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

4.5 Vital interests and public interest

In limited cases, processing may be necessary to protect vital interests or to perform a task carried out in the public interest, where applicable law permits.

5. Sharing and processors

We may share personal data with trusted third parties who process data on our behalf or as separate controllers. These parties are engaged only when necessary and are subject to appropriate contractual and security safeguards. Such parties may include:

IT and hosting providers that store or support systems and infrastructure;
payment service providers that facilitate payments and related fraud checks;
customer support tools that help manage inquiries and service communication;
professional advisers such as legal, accounting, or audit advisers;
analytics and security providers that assist with performance monitoring and threat detection;
public authorities where disclosure is required by law or a lawful request.

When a third party acts as a processor, it may only process personal data on our documented instructions and must implement appropriate technical and organizational measures to protect the information. Processors are not permitted to use the data for their own purposes unless permitted by law.

6. International transfers

If personal data is transferred outside the European Economic Area or another jurisdiction with equivalent protections, we will ensure that appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms recognized by applicable law.

7. Data retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including any legal, accounting, or reporting requirements. Retention periods depend on the nature of the data, the purpose of processing, contractual obligations, statutory limitation periods, and any legitimate need to maintain records.

In general:

contract and transaction records are retained for the duration of the relationship and for a legally required period afterward;
support and communication records are kept for as long as needed to resolve issues and maintain service quality;
consent-based data is retained until consent is withdrawn or the purpose no longer applies;
security and technical logs are retained for a limited period necessary for monitoring and investigation.

When personal data is no longer needed, it is securely deleted, anonymized, or archived in accordance with applicable retention rules and internal policies.

8. Data security

We apply appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures may include access controls, encryption where appropriate, role-based permissions, secure storage, staff confidentiality obligations, and monitoring procedures. However, no system can be guaranteed to be completely secure.

9. User rights

Individuals have rights in relation to their personal data, subject to legal limitations and exceptions. These rights may include:

Right of access to obtain confirmation whether personal data is processed and to receive a copy of it;
Right to rectification to correct inaccurate or incomplete data;
Right to erasure to request deletion in certain circumstances;
Right to restriction to limit processing in certain cases;
Right to data portability to receive data in a structured, commonly used, machine-readable format where applicable;
Right to object to processing based on legitimate interests or direct marketing;
Right to withdraw consent where processing is based on consent;
Right not to be subject to solely automated decisions producing legal or similarly significant effects, where applicable.

Requests to exercise rights will be assessed in accordance with applicable law. We may need to verify identity before responding. Where a request is refused or partially granted, we will explain the reasons where legally permitted.

10. Children’s data

Unless specifically stated otherwise, the services are not intended for children who are below the age at which consent is valid under applicable law. Where we become aware that personal data has been collected from a child without appropriate authorization, we will take reasonable steps to delete it or obtain the necessary permissions, as required by law.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service offerings. The most current version will govern our data processing practices. Where changes are material, we will take reasonable steps to draw them to the attention of affected individuals.

12. Additional information

This policy should be read together with any other notices that may be provided at the point of data collection or in connection with specific services. If there is any inconsistency between a separate notice and this policy, the more specific notice may apply to the relevant processing activity.

We are committed to processing personal data fairly, lawfully, and transparently. Personal information is handled in a way that respects privacy rights and supports responsible service delivery. Where consent is required, it will be meaningful, informed, and freely given. Where another lawful basis applies, processing will be limited to what is necessary and proportionate.

By continuing to use the services, individuals acknowledge that they have read and understood this Privacy Policy and the manner in which personal data is processed.