Privacy Policy

This Privacy Policy explains how personal data is collected, used, shared, stored, and protected when services are provided to customers in the relevant area. It applies to all customers in that area and is intended to meet the standards of the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using the services, customers acknowledge that their personal data may be processed as described in this policy.

1. Scope and Purpose

This policy applies to all individuals who access, purchase, use, or interact with the services in the relevant area. It covers personal data collected directly from customers, data generated through service use, and data received from third parties where lawful. The purpose of this policy is to explain in clear terms how data is handled and what rights customers have over their personal information.

2. Data We Collect

We collect only the personal data that is necessary for specific and legitimate purposes. Depending on the interaction, we may collect the following categories of data:

Identification data such as name, username, or customer reference information;
Contact data such as email address, telephone number, or billing address;
Transaction data such as payment records, purchase history, invoices, and service requests;
Technical data such as device information, browser type, IP address, and usage logs;
Profile data such as preferences, service settings, and communication choices;
Communications data such as messages, feedback, complaints, and support inquiries.

Where necessary, we may also process limited special category data only when required by law or when a lawful basis permits such processing. Such data is handled with extra safeguards and only for a valid purpose.

3. How Data Is Collected

Personal data may be collected in several ways:

Directly from customers when they register, place an order, submit a request, or communicate with us;
Automatically through technical systems when customers access digital services;
From third parties such as payment providers, delivery partners, or verification services;
Through records created during the ordinary course of business, including service and security logs.

Whenever feasible, we ensure customers are informed at the point of collection about the data being requested and the reasons for processing it.

4. Lawful Basis for Processing

We process personal data only when a lawful basis under GDPR applies. The lawful basis used depends on the nature of the processing activity. The main lawful bases are:

Performance of a contract – to provide products or services requested by the customer and to fulfill related obligations;
Legal obligation – to comply with applicable laws, tax rules, accounting rules, and regulatory requirements;
Legitimate interests – to operate, improve, secure, and develop services, provided those interests do not override the rights and freedoms of customers;
Consent – where customers have freely given clear permission for a specific purpose, such as certain marketing activities;
Vital interests – in rare situations where processing is necessary to protect someone’s life or safety;
Public task – where processing is required for a task carried out in the public interest, if applicable.

When consent is used as the lawful basis, customers may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5. How We Use Personal Data

We use personal data for the following purposes:

To provide, manage, and improve services;
To verify identity and prevent unauthorized access;
To process payments, refunds, and account-related transactions;
To communicate service updates, notices, and administrative information;
To respond to inquiries, requests, and complaints;
To maintain records and comply with legal requirements;
To monitor, detect, and prevent fraud, abuse, or security incidents;
To analyze usage and improve service performance;
To send marketing communications only where permitted by law and, if required, with consent.

We will not process personal data in a manner that is incompatible with the purposes for which it was collected unless a valid lawful basis applies.

6. Sharing and Processors

We may share personal data with trusted third parties where necessary to operate our services and meet legal obligations. These third parties may act as data processors or, in some cases, independent controllers. When a third party acts as a processor, it processes personal data only on our instructions and under a written contract that requires appropriate security and confidentiality measures.

Examples of processors may include:

IT hosting and cloud service providers;
Payment processing providers;
Customer support and communication tools;
Analytics and performance monitoring providers;
Document storage and backup providers;
Professional advisors, such as legal, auditing, or accounting service providers, where necessary.

We may also disclose personal data to authorities, regulators, courts, or law enforcement agencies where required by law or where disclosure is necessary to protect rights, safety, or security. Any transfer is limited to what is necessary and proportionate.

7. International Transfers

If personal data is transferred outside the European Economic Area or another jurisdiction with similar protections, we will ensure suitable safeguards are in place. These may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms. Such measures are intended to ensure that personal data remains protected to a standard consistent with GDPR requirements.

8. Retention of Personal Data

Personal data is retained only for as long as necessary for the purposes for which it was collected, including legal, accounting, reporting, and regulatory requirements. Retention periods are determined based on the type of data, the purpose of processing, and any applicable legal obligations.

In general:

Account and service records are kept for the duration of the relationship and for a reasonable period afterward;
Financial and tax records are kept for the period required by law;
Support communications are kept only as long as needed to resolve the issue and maintain records;
Technical logs are kept for a limited period for security, diagnostics, and performance analysis.

Once the retention period has expired, personal data is securely deleted, anonymized, or archived where appropriate and lawful.

9. Data Security

We apply appropriate technical and organizational measures to protect personal data against accidental loss, unlawful access, misuse, alteration, or disclosure. These measures may include access controls, encryption, secure storage, monitoring, staff training, and regular review of security practices. Although no system can be guaranteed to be completely secure, we take reasonable steps to reduce risk and respond promptly to incidents.

10. User Rights Under GDPR

Customers in the relevant area have rights in relation to their personal data. Subject to legal limitations, these rights include:

Right of access – to request confirmation of whether personal data is being processed and to receive a copy of that data;
Right to rectification – to request correction of inaccurate or incomplete data;
Right to erasure – to request deletion of personal data in certain circumstances;
Right to restriction – to request limited processing in certain cases;
Right to data portability – to receive personal data in a structured, commonly used, machine-readable format and, where feasible, have it transmitted to another controller;
Right to object – to object to processing based on legitimate interests or to direct marketing;
Right to withdraw consent – where processing is based on consent;
Right not to be subject to automated decision-making – including profiling, where such decisions have legal or similarly significant effects, unless permitted by law.

Customers may also have the right to complain to a supervisory authority if they believe their data protection rights have been infringed. Exercising these rights will not usually result in any penalty or reduction in service, although some requests may affect the ability to provide certain services where the requested data is essential.

11. Children’s Data

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children without appropriate authorization where required by law. If we become aware that such data has been collected improperly, we will take steps to delete it or otherwise handle it in accordance with applicable legal obligations.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service offerings. Any revised version will apply from the date it is made available. Customers are encouraged to review this policy periodically to stay informed about how personal data is processed.

13. General Statement

This Privacy Policy applies to all customers in the relevant area and governs the processing of personal data associated with the services. We are committed to handling personal data lawfully, fairly, and transparently. Only data that is necessary, relevant, and proportionate will be processed, and it will be retained only for as long as required for legitimate purposes.

By using the services, customers acknowledge that they have read and understood this policy.