Privacy Policy -

This Privacy Policy explains how we collect, use, store, disclose and protect personal data relating to individuals who are customers in the area. This policy applies to all customers in the area and governs our processing of personal data in accordance with the General Data Protection Regulation (GDPR). By using our services, you acknowledge that you have read and understood this Privacy Policy.

1. Scope and Controller

Scope: This policy applies to all personal data processed about customers in the area in connection with the provision of products and services. It covers personal data collected directly from you, collected from third parties, and generated through your use of our services.

Controller: For the purposes of the GDPR, we act as the data controller for personal data described in this policy and are responsible for ensuring that personal data is processed in accordance with applicable data protection law.

2. Data We Collect

We collect personal data that is necessary to provide, maintain and improve our services, to manage our relationship with you, and to comply with legal obligations. Types of personal data we collect include:

Identity data (e.g., name, title, date of birth where necessary).
Contact data (e.g., email address, postal address, phone numbers provided voluntarily).
Account and transaction data (e.g., account identifiers, billing information, order history, payment confirmations).
Usage and technical data (e.g., IP address, device identifiers, browser and operating system, log files, activity within services).
Support and correspondence data (e.g., records of communications with our support, feedback, and complaint details).
Sensitive data only where explicitly and lawfully provided and necessary (e.g., where required for compliance with a legal requirement or to perform a contract), and only with explicit consent as applicable.

Note: We do not collect more personal data than is necessary for the specific purposes described in this policy.

3. Purposes of Processing and Lawful Bases

We process personal data for specified, explicit and legitimate purposes. The lawful basis for processing depends on the processing activity. The main purposes and lawful bases are:

Performance of a contract: Processing necessary to perform a contract to which you are a party, to provide services, deliver products, manage accounts and process payments.
Legal obligation: Processing necessary to comply with applicable laws, court orders, tax and accounting obligations and regulatory requirements.
Consent: Where required, we rely on your freely given, specific, informed and unambiguous consent for processing certain categories of data, including marketing communications and certain profiling activities. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Legitimate interests: Where processing is necessary for our legitimate interests or those of a third party, provided such interests are not overridden by your rights and freedoms. Examples include fraud prevention, network and information security, improvement of services, direct marketing (where permitted), and enforcing contractual obligations.

Marketing

We may use your contact data and usage information to send you service-related messages and marketing communications where you have consented or where we have a legitimate interest and you have not objected. You can opt out of marketing communications at any time through the mechanisms we provide in our services or settings.

4. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, to meet legal, tax or accounting requirements, or to establish, exercise or defend legal claims. Retention periods are determined based on:

the nature and sensitivity of the data;
the purposes for which the data was collected;
legal and regulatory retention obligations;
statutes of limitation; and
the legitimate business needs, such as fraud prevention and record keeping.

When personal data is no longer required, we will delete, anonymize or securely archive it. Specific retention periods may vary by data category and by applicable law; retention periods are documented internally and applied consistently.

5. Data Processors and International Transfers

We may engage third-party service providers (processors) to perform functions on our behalf, such as payment processing, hosting, analytics, customer support, and fraud prevention. These processors act under our instruction and are contractually bound to implement appropriate technical and organizational measures to protect personal data.

Selection and oversight: We select processors based on their ability to provide sufficient guarantees of data protection and we maintain contracts that require processors to comply with GDPR standards.
International transfers: Where personal data is transferred outside the area or the European Economic Area, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms. Transfers are carried out only after suitable safeguards are implemented.

6. Security Measures

We implement and maintain appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. These measures include, as applicable:

encryption of data in transit and at rest;
access controls and authentication measures;
regular security assessments and testing;
data minimization and pseudonymization where practicable;
incident response procedures and staff training.

Despite these measures, no security system is impenetrable. We will notify supervisory authorities and affected individuals as required by applicable law in the event of a personal data breach that poses a risk to your rights and freedoms.

7. Your Rights

Under the GDPR, you have certain rights regarding your personal data. These include:

Right of access: You may request confirmation of whether we process your personal data and gain access to that data.
Right to rectification: You may request correction of inaccurate or incomplete personal data.
Right to erasure (right to be forgotten): You may request deletion of personal data where there is no lawful basis for continued processing.
Right to restrict processing: You may request restriction where the accuracy, lawfulness, or necessity of processing is contested.
Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request a structured, commonly used, machine-readable copy of your personal data.
Right to object: You may object to processing based on legitimate interests or direct marketing; we will stop processing unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.
Right to lodge a complaint: If you consider our processing of your personal data infringes GDPR, you have the right to lodge a complaint with a supervisory authority in your area.

How to exercise your rights: You may exercise your rights via the channels we provide in your account or through the mechanisms available within our services. We will respond to requests in accordance with applicable law and within statutory timeframes. We may request information to verify your identity before fulfilling any request.

8. Automated Decision-Making and Profiling

Where we use automated processing, including profiling, to make decisions that have legal or similarly significant effects, we will ensure you are informed and, where required by law, obtain consent. You have the right to request human intervention, to express your point of view and to contest decisions based solely on automated processing.

9. Children

Our services are not intended for children without parental consent. We do not knowingly collect personal data from children without appropriate consent. If we become aware that personal data of a child has been collected without such consent, we will take steps to delete the information as required by law.

10. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal obligations or regulatory expectations. Significant changes will be communicated where required by law, and the effective date will be updated. Continued use of our services after such updates constitutes acceptance of the revised policy.

11. Legal Disclosures

We may disclose personal data when required to do so by law, in response to lawful requests by public authorities, to comply with legal obligations, to protect rights, property or safety, or to enforce contractual terms.

Final note

Commitment: We are committed to protecting your privacy and to processing personal data in a transparent, lawful and fair manner. This policy sets out our core practices and your rights under the GDPR as they relate to customers in the area.

If you have questions about how your data is processed or wish to exercise your rights, please use the channels made available to you within our services.