Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected for all customers in the area. It applies to all customers in area and is designed to meet the requirements of the General Data Protection Regulation (GDPR).

1. Introduction

We are committed to handling personal data lawfully, fairly, and transparently. This Policy describes the types of information that may be processed, the purposes for which it is processed, the legal grounds we rely on, how long data is retained, which processors may assist in processing, and the rights available to individuals under the GDPR. By using our services, customers in area acknowledge that their personal data may be processed in accordance with this Policy.

This Policy applies to all customers in area, regardless of the channel through which services are received, and regardless of whether interactions are completed online, in person, by phone, or through any other operational method.

2. Data We Collect

We only collect personal data that is necessary for specified, explicit, and legitimate purposes. The data collected may include the following categories:

Identity information: such as name, title, or similar identifiers.
Contact information: such as email address, telephone number, postal address, or other communication details.
Transaction information: such as records of purchases, service requests, invoices, and payment-related history.
Technical information: such as IP address, device type, browser type, operating system, and general usage data where relevant.
Communication records: including correspondence, feedback, complaints, and support interactions.
Preference information: where a customer has indicated choices relevant to service delivery or communication.

In limited circumstances, we may also process special category data only where strictly necessary and where a lawful basis exists under the GDPR. Such data is not collected routinely and is handled with heightened safeguards.

3. How We Use Personal Data

Personal data is used for legitimate business and operational purposes, including:

providing and managing services;
processing transactions and fulfilling requests;
maintaining customer records;
responding to inquiries and support needs;
sending service-related notices;
improving services, systems, and customer experience;
ensuring security, fraud prevention, and abuse detection;
meeting legal, regulatory, accounting, and reporting obligations.

We do not use personal data for purposes that are incompatible with the reasons for which it was collected unless we obtain a valid legal basis or further consent where required.

4. Lawful Basis for Processing

Under GDPR, we process personal data only when a lawful basis applies. Depending on the context, we may rely on one or more of the following:

Contract

Processing may be necessary to perform a contract with a customer or to take steps before entering into a contract. This includes account administration, service delivery, and transaction processing.

Legal Obligation

We may process personal data where necessary to comply with legal duties, including tax, accounting, consumer protection, and other regulatory requirements.

Legitimate Interests

We may process data based on our legitimate interests, provided those interests are not overridden by the rights and freedoms of the individual. Examples include service improvement, internal administration, fraud prevention, and network or information security.

Consent

Where required, we rely on consent. When consent is used as the legal basis, individuals may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Vital Interests and Public Interest

In rare cases, processing may be necessary to protect vital interests or where processing is required for a task carried out in the public interest, in accordance with applicable law.

5. Retention of Personal Data

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including to meet legal, accounting, and reporting obligations. Retention periods depend on the type of data, the nature of the relationship, and applicable legal requirements.

In general:

customer account and transaction records are retained for the period needed to manage the relationship and comply with legal obligations;
communication and support records are retained for a reasonable period to resolve issues and improve service quality;
technical and security data are retained for the time needed to maintain system integrity and prevent misuse;
data no longer required is securely deleted, anonymized, or otherwise irreversibly removed.

When retention periods expire, data is either deleted or anonymized in a secure and controlled manner. If deletion is not immediately possible due to legal or technical reasons, the data will be isolated from further use until deletion is feasible.

6. Processors and Data Sharing

We may engage third-party processors to support the operation of our services. Processors act only on our documented instructions and are required to protect personal data in accordance with GDPR obligations. Typical categories of processors may include:

IT hosting and infrastructure providers;
customer support and communication service providers;
accounting, auditing, and financial administration providers;
security and fraud prevention service providers;
analytics or system performance service providers where necessary;
professional advisers who support compliance and operational obligations.

We share personal data only when necessary, proportionate, and supported by a valid legal basis. Any processor that handles data on our behalf must implement appropriate technical and organizational measures to protect confidentiality, integrity, and availability.

Where required by law, we may also disclose personal data to public authorities, regulators, courts, or law enforcement bodies. Such disclosures will be limited to what is required and permitted under applicable law.

7. Data Security

We apply appropriate safeguards to protect personal data from accidental loss, unauthorized access, disclosure, alteration, or destruction. These safeguards may include access controls, encryption where appropriate, secure storage, staff confidentiality obligations, and regular review of security practices.

Although no system can be guaranteed completely secure, we take reasonable and proportionate steps to reduce risk and protect the personal data of all customers in area.

8. International Transfers

If personal data is transferred outside the jurisdiction where GDPR protections apply, such transfers will be carried out only where appropriate safeguards are in place. These safeguards may include adequacy decisions, standard contractual clauses, or other legal transfer mechanisms recognized under applicable data protection law.

9. Your Rights Under GDPR

Individuals whose personal data is processed under this Policy have rights under the GDPR, subject to certain conditions and legal exceptions. These rights include:

Right of access: to obtain confirmation of whether personal data is being processed and to receive a copy of that data.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request limited use of personal data in specific situations.
Right to data portability: to receive certain data in a structured, commonly used, machine-readable format and to transmit it to another controller where applicable.
Right to object: to object to processing based on legitimate interests or direct marketing, where applicable.
Right to withdraw consent: where processing is based on consent, withdrawal may be made at any time.
Right not to be subject to automated decision-making: to avoid decisions made solely by automated means where such decisions produce legal or similarly significant effects, subject to legal exceptions.

Requests relating to these rights will be handled in line with GDPR timeframes and requirements. Verification may be required to ensure that personal data is not disclosed to unauthorized persons.

10. Children’s Data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children in circumstances where parental or guardian consent is required, unless such consent or another lawful basis has been obtained in accordance with applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or security changes. When updates are made, the revised Policy will apply to future processing activities from the date it becomes effective. Individuals are encouraged to review the Policy periodically to stay informed about how personal data is handled.

12. Final Statement

This Privacy Policy applies to all customers in area and is intended to ensure that personal data is processed in a lawful, fair, and transparent manner. We remain committed to respecting privacy rights, minimizing data use, maintaining secure processing, and honoring the principles of GDPR compliance in all relevant activities.