Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with services provided to customers in the relevant area. It applies to all customers in that area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and applicable local privacy laws. Please read this policy carefully to understand how personal information is handled.

1. Scope of This Policy

This Privacy Policy applies to all customers in the area where the services are offered. It covers personal data processed in the course of providing services, supporting customer relationships, fulfilling legal obligations, and improving operations. It applies whether personal data is collected directly from an individual, obtained through service interactions, or received from authorized third parties.

Personal data means any information relating to an identified or identifiable natural person. This may include names, contact details, customer identifiers, transaction records, service preferences, communication history, technical data, and other information that can be linked to an individual.

2. Data Collection

Personal data may be collected in several ways, including when customers:

Register for or use services;
Communicate with support or service teams;
Submit forms, requests, or inquiries;
Make purchases or enter into agreements;
Participate in surveys, promotions, or feedback programs;
Interact with systems, applications, or digital tools provided as part of the service.

The types of data collected may include:

Identity data such as name, username, or customer reference number;
Contact data such as address, email address, and phone number;
Transaction data such as payment status, purchase history, and service usage records;
Technical data such as IP address, device type, browser information, and system logs;
Communication data such as messages, complaints, and support interactions;
Preference data such as communication choices or service settings.

Where necessary, certain personal data may also be collected from third parties, such as payment providers, service partners, public sources, or identity verification providers, provided that such collection is lawful and appropriate.

3. Lawful Basis for Processing

Personal data is processed only where a lawful basis under GDPR applies. Depending on the purpose, processing may rely on one or more of the following legal grounds:

Contract: processing is necessary to enter into or perform a contract with a customer, or to take steps at the customer’s request before entering into a contract;
Legal obligation: processing is necessary to comply with legal and regulatory requirements;
Legitimate interests: processing is necessary for legitimate business interests, provided those interests are not overridden by the customer’s rights and freedoms;
Consent: processing is based on the customer’s freely given, specific, informed, and unambiguous consent, where required;
Vital interests: processing is necessary to protect someone’s life in rare and exceptional circumstances;
Public task: processing is necessary for carrying out a task in the public interest, where applicable.

Where consent is used as the lawful basis, it may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

4. Purposes of Processing

Personal data may be processed for the following purposes:

Providing, operating, and maintaining services;
Managing customer accounts, orders, or requests;
Processing payments, billing, and refunds;
Verifying identity and preventing fraud;
Responding to inquiries and offering customer support;
Sending service-related notices and updates;
Meeting legal, tax, accounting, and regulatory requirements;
Improving service quality, performance, security, and user experience;
Maintaining records and resolving disputes.

Where processing is based on legitimate interests, those interests may include protecting systems, ensuring effective service delivery, preventing misuse, and managing business operations efficiently. A balancing assessment is carried out to ensure that such processing remains appropriate and proportionate.

5. Data Sharing and Processors

Personal data may be shared only when necessary and appropriate. Data may be disclosed to trusted third parties that act as processors or, in limited cases, as independent controllers. Processors process personal data on documented instructions and are required to protect it in accordance with GDPR.

Processors may include:

IT and cloud service providers;
Payment processing services;
Customer support and communication tools;
Analytics and security providers;
Professional advisers, such as legal, accounting, or audit providers;
Delivery, logistics, or operational partners where relevant.

Where personal data is transferred to another party, appropriate contractual and technical safeguards are used. These may include data processing agreements, confidentiality obligations, access controls, encryption, and secure transfer mechanisms. Personal data is not sold as a general practice.

If personal data is transferred outside the applicable jurisdiction, additional safeguards will be applied where required by law, such as standard contractual clauses or other recognized transfer mechanisms.

6. Retention of Personal Data

Personal data is retained only for as long as necessary for the purposes for which it was collected, or for the period required to meet legal, contractual, tax, accounting, or regulatory obligations. Retention periods vary depending on the nature of the data and the reason for processing.

In general, retention is determined by considering:

The duration of the customer relationship;
Whether data is needed to perform a contract;
Statutory limitation periods;
Record-keeping obligations;
Potential disputes, claims, or audits;
Security and fraud-prevention needs.

Once personal data is no longer required, it is securely deleted, anonymized, or archived in accordance with applicable retention rules. Where data is retained in anonymized form, it is no longer considered personal data under GDPR, provided re-identification is not reasonably possible.

7. Security of Personal Data

Appropriate technical and organizational measures are used to protect personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. These measures may include access restrictions, authentication controls, staff training, monitoring, secure backups, and data minimization practices.

Although reasonable safeguards are applied, no method of transmission or storage is completely secure. In the event of a personal data breach, steps will be taken in accordance with applicable law, including assessment, containment, remediation, and notification where required.

8. User Rights Under GDPR

Customers in the relevant area have certain rights regarding their personal data. Subject to legal limitations and verification requirements, these rights include:

Right of access: to obtain confirmation of whether personal data is processed and receive a copy of that data;
Right to rectification: to request correction of inaccurate or incomplete data;
Right to erasure: to request deletion of personal data in certain circumstances;
Right to restriction: to request limitation of processing in certain cases;
Right to data portability: to receive data in a structured, commonly used, machine-readable format and transmit it where technically feasible;
Right to object: to object to processing based on legitimate interests or direct marketing;
Right to withdraw consent: where processing is based on consent, to withdraw it at any time;
Right not to be subject to automated decision-making: unless such decision-making is permitted by law and appropriate safeguards are in place.

Requests relating to these rights will be handled in accordance with GDPR timeframes and requirements. In some cases, legal exceptions may apply, meaning a request may be lawfully limited or refused. If additional information is needed to verify identity before responding, such information may be requested to protect privacy and prevent unauthorized disclosure.

9. Children’s Data

The services are not intended for children unless explicitly stated otherwise. Where children’s personal data is processed, it will be handled with additional care and only where a lawful basis exists. If consent is required and the child is below the applicable age threshold, parental or guardian authorization may be necessary.

10. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in legal requirements, operational practices, or service arrangements. The latest version will apply from the date it becomes effective. Customers are encouraged to review the policy periodically to stay informed about how their personal data is handled.

11. Final Statement

This Privacy Policy is designed to provide a clear and transparent explanation of how personal data is processed. It applies to all customers in the area and reflects commitments to lawful, fair, and secure processing. Respect for privacy, data minimization, and accountability are central principles in all data handling activities. Where required by law, additional notices may be provided for specific processing activities, but this policy establishes the general framework for privacy protection.