Privacy Policy - .

Introduction

This Privacy Policy explains how we collect, use, disclose, and protect personal data and what rights individuals have under the General Data Protection Regulation (GDPR). This policy applies to all customers in the area and to individuals whose personal data we process in connection with the services we provide. It is intended to describe our privacy practices in clear and transparent terms.

1. Controller and Scope

Controller: For the purposes of the GDPR, we are the data controller of the personal data described in this policy.
This policy applies to all customers in the area and to data subjects whose personal data is processed by us in the provision of our services.

2. Categories of Personal Data Collected

We collect and process the following categories of personal data, as necessary for our operations and the provision of services:

Identity data: name, title, date of birth where required.
Contact data: postal address, email address, telephone numbers.
Account and profile data: account credentials, preferences, service usage settings.
Transaction data: records of services provided, billing and payment information (payment card or bank details are processed by our payment processors).
Technical data: IP address, device identifiers, browser and operating system information, log files.
Communications data: correspondence with us, support requests, marketing preferences.
Special categories (only where explicitly required and with additional safeguards): limited health or sensitive information necessary to perform specific services, where the data subject has given explicit consent or where another lawful basis applies.

3. Sources of Personal Data

We collect data directly from the individual (e.g., during registration, account updates, or communications), from authorized third parties acting on the individual’s behalf, and automatically through our systems and service integrations.

4. Lawful Bases for Processing

We process personal data only where we have a valid legal basis for doing so under the GDPR. Those bases include:

Performance of a contract — processing necessary to provide services or to perform obligations under a contract with the data subject.
Legal obligation — processing required to comply with applicable law, regulation, or public authority request.
Consent — where the data subject has given clear, informed consent for a specific processing purpose (e.g., marketing communications or processing special category data when necessary).
Legitimate interests — processing necessary for our legitimate interests or those of a third party, provided such interests are not overridden by the data subject’s rights and freedoms (for example: fraud prevention, network and information security, and direct communications about services).
Vital interests — in rare cases, processing necessary to protect someone’s life.

5. Retention of Personal Data

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Retention periods vary depending on the category of data, the reason for processing, and legal obligations. Typical retention approaches include:

Transactional and financial records: retained for the period required by applicable tax and accounting laws, typically 6–10 years.
Account and service records: retained for the duration of the customer relationship plus a reasonable period afterward to address disputes or legal requirements.
Support and communications: retained while required to resolve requests or complaints and for a limited period afterward to improve services.
Logs and technical data: retained for security, troubleshooting, and performance monitoring for a limited period, unless longer retention is necessary for compliance or legal defense.

When personal data is no longer required, we will delete it or render it anonymous in a manner designed to prevent its recovery.

6. Use of Processors and International Transfers

We use third-party processors to perform services on our behalf, including cloud hosting, payment processing, analytics, and communications. We:

Carefully select processors and require them to implement appropriate technical and organizational measures to protect personal data.
Enter into written agreements with processors that include obligations consistent with the GDPR, including confidentiality, security, and instructions for processing.
Use standard contractual clauses, approved codes of conduct, or other appropriate safeguards when personal data is transferred outside the European Economic Area.

We remain responsible for ensuring that any transfer of personal data to a third country is lawful and protected by appropriate safeguards.

7. Data Security

We implement and maintain reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, or disclosure. These measures include access controls, encryption of sensitive data where feasible, regular security testing, staff training, and data minimization practices. However, no method of transmission over the internet is completely secure.

8. Data Subject Rights

Under the GDPR, data subjects have a range of rights in relation to their personal data. These rights include:

Right of access: the right to obtain confirmation whether personal data concerning them is being processed and to receive a copy of that data.
Right to rectification: the right to have inaccurate or incomplete personal data corrected.
Right to erasure (the "right to be forgotten"): the right to request deletion of personal data where there is no lawful basis to continue processing.
Right to restriction of processing: the right to request the restriction of processing under certain circumstances.
Right to data portability: the right to receive personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller where applicable.
Right to object: the right to object to processing based on legitimate interests or direct marketing, including profiling for marketing purposes.
Rights related to automated decision-making: the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

To exercise any of these rights, data subjects should use the methods we have made available within our services or otherwise notified to them. We will respond to verified requests in accordance with the GDPR and applicable law. Where permitted, we may request additional information to verify identity before fulfilling a request.

9. Consent and Marketing

Where processing is based on consent, that consent may be withdrawn at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. Individuals may opt out of marketing communications at any time using the mechanisms provided in those communications.

10. Complaints and Supervisory Authority

If a data subject believes their rights under the GDPR have been violated, they have the right to lodge a complaint with a supervisory authority in their country. We encourage data subjects to raise concerns with us first so we have an opportunity to investigate and address the issue.

11. Changes to this Policy

We may update this policy from time to time to reflect changes in our practices, services, legal obligations, or regulatory guidance. Significant changes will be communicated through our usual channels. Continued use of services after a modification constitutes acceptance of the updated policy.

Effective Date: This policy is effective as of the date published by us. Please review it periodically.

Note: This Privacy Policy aims to provide a clear summary of our data handling practices under the GDPR. It does not create contractual or legal rights beyond those established by data protection law.