Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with the services offered by . It applies to all customers in area and is designed to reflect the principles of the General Data Protection Regulation (GDPR), including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

1. Scope of this Policy

This Policy applies whenever personal data is processed in the context of providing products or services to customers in area, including where individuals:

create or manage an account;
place an order or request a service;
communicate with support or service teams;
browse or interact with our digital services;
receive marketing or service-related communications where permitted by law.

For the purposes of this Policy, personal data means any information relating to an identified or identifiable individual.

2. Data We Collect

We collect only the personal data necessary for specified and legitimate purposes. Depending on how customers use the services, the data may include:

Identity data: name, title, date of birth, and similar identifiers;
Contact data: email address, phone number, billing address, and delivery address;
Account data: login credentials, preferences, and service settings;
Transaction data: purchase history, payment status, order details, and invoices;
Technical data: device type, browser type, IP address, system logs, and usage information;
Communication data: correspondence, support requests, complaints, and feedback;
Marketing data: consent preferences and communication choices;
Verification data: information needed to confirm identity where legally required.

We do not intentionally collect special category data unless it is strictly necessary and a valid legal condition applies. Where such data is processed, additional safeguards are used.

3. How We Use Personal Data

We use personal data for the following purposes:

to provide and maintain services;
to process transactions and fulfil contractual obligations;
to manage accounts and customer relationships;
to communicate service updates, notices, and support responses;
to improve products, performance, security, and user experience;
to detect and prevent fraud, misuse, and security incidents;
to comply with legal, regulatory, and tax obligations;
to send marketing messages where lawful and appropriate;
to defend or establish legal claims.

We process data only for specified, explicit, and legitimate purposes and do not use it in ways that are incompatible with those purposes.

4. Lawful Basis for Processing

Under the GDPR, we must have a lawful basis for each processing activity. Depending on the situation, we rely on one or more of the following bases:

Contract

We process data when it is necessary to enter into or perform a contract with a customer, including setting up services, managing accounts, and delivering purchased products or services.

Legal obligation

We process data when required to comply with applicable law, including tax, accounting, consumer protection, fraud prevention, and record-keeping obligations.

Legitimate interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the interests or fundamental rights and freedoms of the individual. Examples include service improvement, fraud prevention, internal administration, and network security. Where required, we perform a balancing assessment.

Consent

We rely on consent where it is required by law, such as for certain marketing activities or optional cookies and similar technologies. Consent may be withdrawn at any time, and withdrawal will not affect processing carried out before it was withdrawn.

5. Data Sharing and Processors

We may share personal data with trusted third parties that act as processors or, in some cases, independent controllers. Processors only act on our documented instructions and are bound by appropriate contractual and confidentiality obligations.

Examples of processor categories may include:

hosting and cloud infrastructure providers;
payment service providers;
customer support and communication tools;
analytics and performance monitoring services;
security and fraud prevention providers;
document storage and electronic record management providers;
professional advisers assisting with legal, tax, or compliance matters.

Where personal data is transferred outside the European Economic Area or other relevant jurisdiction, appropriate safeguards are used, such as standard contractual clauses or other lawful transfer mechanisms.

We do not sell personal data. Any disclosure to authorities will occur only where required by law or where necessary to protect rights, safety, or security.

6. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including satisfying legal, accounting, regulatory, and dispute-resolution requirements. Retention periods vary depending on the type of data and the purpose of processing.

Contract and transaction records: retained for the period required by commercial, tax, and accounting laws;
Account data: retained while the account remains active and for a reasonable period afterward;
Support communications: retained for complaint handling, quality assurance, and legal defence;
Marketing preferences: retained until consent is withdrawn or the individual opts out;
Technical logs: retained for security, diagnostics, and audit purposes for a limited period.

When data is no longer needed, it is securely deleted, anonymised, or otherwise rendered inaccessible in accordance with internal retention practices.

7. Data Security

We implement appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, encryption, staff training, monitoring, backup procedures, and supplier due diligence. While no system can be guaranteed completely secure, we take reasonable steps to maintain a high level of protection.

8. User Rights Under GDPR

Individuals whose data is processed under this Policy have rights under GDPR, subject to certain legal limitations and conditions. These rights include:

Right of access: to obtain confirmation and a copy of personal data we hold;
Right to rectification: to correct inaccurate or incomplete data;
Right to erasure: to request deletion of data in certain circumstances;
Right to restriction: to request limited processing in specific situations;
Right to object: to object to processing based on legitimate interests or direct marketing;
Right to data portability: to receive certain data in a structured, commonly used format and transmit it to another controller where technically feasible;
Right to withdraw consent: where processing is based on consent;
Right not to be subject to solely automated decisions: including profiling, where such decisions have legal or similarly significant effects, unless permitted by law.

Requests are handled in accordance with applicable GDPR requirements. We may need to verify identity before acting on a request to prevent unauthorised disclosure.

9. Children’s Data

The services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children without appropriate authorisation or lawful basis. If we become aware that such data has been collected without proper permission, we will take steps to delete it as appropriate.

10. Automated Decision-Making

Where automated processes are used to assist with fraud detection, service security, or operational efficiency, they are designed to avoid unfair or discriminatory outcomes. If a decision produces legal or similarly significant effects and is based solely on automated processing, additional safeguards will be applied as required by law.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service offerings. Any updated version will apply from the date it takes effect. Customers in area should review this Policy periodically to stay informed about how personal data is handled.

12. General Statement

This Privacy Policy applies to all customers in area and is intended to ensure that personal data is processed in a lawful, transparent, and secure manner. By using the services, customers acknowledge that their personal data may be processed as described in this Policy and in accordance with applicable law.

In summary: we collect only necessary personal data, rely on valid lawful bases, retain data for limited periods, use trusted processors under appropriate safeguards, and respect the rights of individuals under GDPR.