Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area where our services are offered and to anyone whose personal data is processed in the course of providing those services. We are committed to handling personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Personal Data We Collect

We collect only the data that is necessary for legitimate business purposes and to provide our services effectively. The types of personal data we may collect include:

Identity data such as name, title, and other identifying information.
Contact data such as address, email address, and phone number.
Transaction data such as purchase history, service requests, and payment-related details.
Technical data such as IP address, browser type, device identifiers, and usage data.
Communication data such as messages, feedback, complaints, and other correspondence.
Profile data such as preferences, interests, and service choices.

We generally collect personal data directly from you when you interact with us, make an inquiry, enter into a service relationship, or use our services. We may also receive information from third parties where permitted by law, for example from service providers, payment processors, or public sources.

2. How We Use Personal Data

We use personal data only for specific, explicit, and lawful purposes. These purposes may include:

Providing and managing our services.
Processing transactions and maintaining records.
Responding to inquiries and service-related requests.
Sending important service updates, notices, or administrative messages.
Improving our services, systems, and customer experience.
Detecting, preventing, and investigating fraud, misuse, or security incidents.
Meeting legal, regulatory, or contractual obligations.

We do not use personal data in ways that are incompatible with the purposes for which it was collected unless we have a valid lawful basis for doing so.

3. Lawful Basis for Processing

Under GDPR, we process personal data only where there is a lawful basis. Depending on the context, the lawful basis may include:

Performance of a contract: when processing is necessary to provide our services or fulfill obligations under a contract with you.
Legitimate interests: when processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.
Legal obligation: when processing is necessary to comply with laws, regulations, or lawful requests from authorities.
Consent: when you have given clear consent for a specific processing activity, and you may withdraw that consent at any time where applicable.
Vital interests: in rare cases, when processing is necessary to protect someone’s life or physical safety.

Where we rely on legitimate interests, we carefully balance those interests against your privacy rights. We do not process personal data without a valid reason.

4. Sharing and Processors

We may share personal data with trusted third parties that help us operate our services. These third parties act as processors when they process personal data on our behalf and under our instructions. Examples may include:

IT and cloud service providers.
Payment processing providers.
Customer support and communication tools.
Analytics and system monitoring providers.
Professional advisers such as legal, accounting, or compliance consultants.

Processors are required to protect personal data and to process it only in accordance with our instructions, applicable law, and appropriate contractual safeguards. We may also disclose personal data where required by law, to protect our rights, to prevent harm, or in connection with legal claims or regulatory requirements.

Where personal data is transferred outside the European Economic Area or another region with equivalent protections, we take appropriate safeguards to ensure an adequate level of protection, such as standard contractual clauses or other lawful transfer mechanisms.

5. Data Retention

We keep personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, tax, reporting, or contractual requirements. Retention periods vary depending on the nature of the data and the reasons for processing.

In general, we assess retention based on:

The duration of our relationship with you.
Whether the data is needed to provide services or resolve disputes.
Legal or regulatory retention requirements.
Whether retention is necessary for security, fraud prevention, or recordkeeping.

When personal data is no longer needed, we will delete, anonymize, or securely archive it in accordance with applicable law and our retention practices. Data is not kept indefinitely without reason.

6. Your Rights Under GDPR

If you are a data subject protected by GDPR, you have certain rights regarding your personal data. Subject to legal limitations, these rights include:

Right of access: to request confirmation of whether your data is being processed and obtain a copy of it.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of your data in certain circumstances.
Right to restriction: to request that processing be limited in specific situations.
Right to data portability: to receive your data in a structured, commonly used, machine-readable format and transmit it where applicable.
Right to object: to object to processing based on legitimate interests or direct marketing, where applicable.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
Right not to be subject to automated decision-making: to the extent such decisions have legal or similarly significant effects, unless permitted by law.

We may need to verify your identity before responding to a rights request. We will respond within the time limits required by law and may refuse requests where an exemption applies. Your privacy rights are respected and supported by our internal procedures.

7. Security of Personal Data

We use appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, disclosure, alteration, or destruction. These measures may include access controls, encryption where appropriate, secure storage, and staff confidentiality obligations.

Although no system can be guaranteed completely secure, we continuously review and improve our security practices to reduce risk and maintain appropriate protection.

8. Children’s Data

Our services are not intended for children unless explicitly stated otherwise. We do not knowingly collect personal data from children without appropriate legal basis and safeguards. If we become aware that data has been collected from a child in violation of applicable law, we will take steps to address the issue promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will take appropriate steps to inform affected individuals in a manner consistent with applicable law. The latest version will apply from the date it becomes effective.

10. How We Comply with GDPR

Our approach to privacy is based on accountability, transparency, and data minimization. We aim to collect only what is necessary, use it fairly, retain it only for as long as needed, and provide individuals with meaningful control over their data. We maintain internal policies and procedures designed to support compliance with GDPR principles, including lawfulness, fairness, purpose limitation, accuracy, storage limitation, integrity, and confidentiality.

Summary of Key Principles

Transparency: we explain what data we collect and why.
Necessity: we process only data needed for legitimate purposes.
Accountability: we remain responsible for processing carried out by processors on our behalf.
Choice: where consent is used, it is freely given and can be withdrawn where applicable.
Protection: we apply safeguards to help keep personal data secure.

This Privacy Policy is intended to ensure that individuals understand how their personal data is handled and what rights they have under applicable law. By using our services, you acknowledge that your personal data may be processed in accordance with this policy and the legal bases described above.