Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected in connection with our services. It applies to all customers in the area and is intended to comply with the General Data Protection Regulation (GDPR) and applicable data protection laws. By using our services, you acknowledge that personal data may be processed in the ways described below.

1. Scope and purpose

This policy applies to all customers in the area who interact with our services, whether as individuals, business representatives, or authorized users. It covers personal data processed when a customer accesses our services, makes inquiries, enters into a contract, receives support, or otherwise engages with us. We are committed to handling personal data in a lawful, fair, and transparent manner.

The purposes for processing personal data may include delivering services, managing customer relationships, maintaining records, complying with legal obligations, improving service quality, and protecting our legitimate interests. We process only the data that is necessary for specific and legitimate purposes.

2. Data we collect

We may collect the following categories of personal data, depending on the nature of the relationship and services provided:

Identity data, such as name, title, or user identification details;
Contact data, such as address, email address, and telephone number;
Account and transaction data, such as service history, purchase records, billing details, and payment status;
Communication data, such as messages, requests, complaints, and support correspondence;
Technical data, such as IP address, browser type, device information, and usage logs;
Preference data, such as language preferences or service settings;
Compliance data, where required for identity verification, fraud prevention, or regulatory checks.

We do not intentionally collect special category data unless it is necessary and permitted by law. If such data is ever processed, we will do so only with an appropriate lawful basis and additional safeguards.

3. Lawful basis for processing

Under GDPR, personal data must be processed only when there is a valid legal basis. Depending on the specific processing activity, we rely on one or more of the following lawful bases:

3.1 Contract

We process personal data when it is necessary to perform a contract with you or to take steps at your request before entering into a contract. This may include setting up services, processing orders, delivering requested functions, or managing customer accounts.

3.2 Legal obligation

We may process personal data when we are required to comply with legal or regulatory obligations, such as tax, accounting, fraud prevention, consumer protection, or record-keeping requirements.

3.3 Legitimate interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Such interests may include service improvement, security monitoring, prevention of misuse, network and information security, and internal administration.

3.4 Consent

In certain cases, we may rely on your consent. Where consent is the lawful basis, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

3.5 Vital interests and public interest

In rare circumstances, processing may be necessary to protect someone’s vital interests or to carry out tasks in the public interest, where applicable under local law.

4. How we use personal data

We use personal data only for lawful and specified purposes. These may include:

Providing and managing our services;
Processing payments and maintaining financial records;
Responding to customer inquiries and support requests;
Improving service functionality and user experience;
Monitoring security, preventing fraud, and detecting abuse;
Meeting contractual, regulatory, and compliance obligations;
Maintaining business records and internal reporting;
Communicating important service-related updates.

Where processing is based on legitimate interests, we balance our interests against your rights. Where processing is based on consent, we make that choice clear and easy to manage.

5. Data sharing and processors

We may share personal data with trusted third parties who act as data processors on our behalf. Processors may only process personal data according to our instructions and are contractually required to protect it and maintain confidentiality.

Typical processors may include:

IT and hosting providers that store and secure system data;
Payment service providers that process transactions;
Customer support tools that help manage service communications;
Analytics providers that assist with service performance monitoring;
Professional advisers, such as legal, accounting, or compliance consultants;
Regulatory, law enforcement, or public authorities, where disclosure is required by law.

We do not sell personal data. Where data is shared outside the organization, we ensure appropriate safeguards and use only the minimum data necessary for the specific purpose.

6. International transfers

If personal data is transferred outside the European Economic Area or another region with comparable protection, we ensure that appropriate safeguards are in place. These safeguards may include adequacy decisions, standard contractual clauses, or equivalent legal mechanisms. Such transfers are made only where necessary and with suitable protection measures.

7. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including satisfying legal, accounting, tax, or reporting obligations. Retention periods depend on the type of data, the nature of the relationship, and the relevant legal requirements.

When determining retention periods, we consider:

The duration of our relationship with you;
The need to resolve disputes or enforce agreements;
Applicable limitation periods;
Statutory retention obligations;
The sensitivity and amount of data involved.

When personal data is no longer needed, we delete, anonymize, or securely archive it in line with our retention practices. Data that is no longer required should not be kept indefinitely.

8. Security of personal data

We use appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, unlawful destruction, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff training, and regular security reviews.

Although no system can be guaranteed to be completely secure, we take reasonable steps to reduce risk and to protect the confidentiality, integrity, and availability of personal data. Security measures are reviewed and updated as needed to reflect changing risks.

9. Your rights under GDPR

Subject to legal conditions and exceptions, you have the following rights regarding your personal data:

Right of access — to obtain confirmation and a copy of the personal data we hold about you;
Right to rectification — to request correction of inaccurate or incomplete data;
Right to erasure — to request deletion of data in certain circumstances;
Right to restriction — to request limited processing in specific situations;
Right to data portability — to receive your data in a structured, commonly used, machine-readable format where applicable;
Right to object — to object to processing based on legitimate interests or direct marketing;
Right to withdraw consent — where processing is based on consent;
Right not to be subject to automated decision-making — where applicable, including profiling that produces legal or similarly significant effects.

To exercise these rights, you may make a request through the appropriate support or administrative process. We may need to verify your identity before responding. We will respond within the time limits required by GDPR, usually within one month, subject to permitted extensions.

10. Children’s data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children without appropriate authorization. If we become aware that personal data has been collected inappropriately, we will take steps to delete it or obtain the necessary consent where lawful and appropriate.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service developments. Any updates will apply from the date they are published or otherwise communicated. We encourage customers to review this policy periodically so they remain informed about how personal data is processed.

12. Summary of our commitment

We are committed to processing personal data responsibly, transparently, and in accordance with GDPR principles. We collect only what is necessary, use data for lawful purposes, retain it only for as long as needed, and work with processors that are bound to protect it. Customers in the area may exercise their rights at any time, subject to legal limits and verification requirements. This policy reflects our ongoing commitment to privacy, accountability, and data protection.