Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when services are provided to customers in the area. It applies to all customers in area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and related data protection laws. By using our services, customers acknowledge that their personal data may be processed in accordance with this policy.

1. Data We Collect

We collect only the personal data that is necessary for legitimate business, legal, and service-related purposes. Depending on the interaction, this may include:

Identification data: name, title, and similar identifiers.
Contact data: postal address, email address, and telephone number.
Account and service data: records related to orders, requests, preferences, or service history.
Transaction data: payment-related records, billing information, and purchase details.
Technical data: device information, browser type, IP address, and usage logs.
Communication data: messages, enquiries, complaints, and feedback.
Compliance data: records required for tax, accounting, fraud prevention, or legal obligations.

We do not intentionally collect special category data unless it is strictly necessary and permitted by law. If such data is ever processed, it will be handled with additional safeguards and only where a lawful basis applies.

2. How We Use Personal Data

Personal data is processed for specific, explicit, and legitimate purposes. These purposes include:

providing and managing services;
processing requests and transactions;
communicating with customers;
maintaining records and service quality;
detecting and preventing fraud or misuse;
meeting legal, regulatory, accounting, and tax obligations;
improving services, systems, and customer experience;
defending legal claims and enforcing agreements.

We will not use personal data in ways that are incompatible with the original purpose unless we have a valid legal basis to do so and the new use is permitted under GDPR.

3. Lawful Basis for Processing

Under GDPR, we rely on one or more of the following lawful bases to process personal data:

a) Performance of a Contract

We process personal data when it is necessary to enter into or perform a contract with a customer, including providing services, managing orders, delivering support, and handling related administrative matters.

b) Legal Obligation

We process personal data where necessary to comply with legal and regulatory requirements, including tax, accounting, consumer protection, record-keeping, and lawful requests from public authorities.

c) Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or the legitimate interests of a third party, provided those interests are not overridden by the rights and freedoms of the individual. Legitimate interests may include service improvement, network security, fraud prevention, internal administration, and business continuity.

d) Consent

Where required by law, we will rely on freely given, specific, informed, and unambiguous consent. Customers may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

4. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including for legal, accounting, or reporting requirements. Retention periods depend on the type of data, the purpose of processing, and applicable legal obligations.

Service and account records are retained for the duration of the customer relationship and for a reasonable period afterwards.
Financial and transaction records are retained for the period required by tax and accounting laws.
Communication records are retained for as long as needed to handle the enquiry, resolve disputes, or maintain accurate records.
Technical and security logs are kept for a limited period unless longer retention is needed for investigations or legal obligations.

When personal data is no longer required, it will be deleted, anonymised, or securely archived in accordance with applicable law and internal retention procedures. Retention is always limited to what is necessary.

5. Processors and Third Parties

We may share personal data with trusted processors who act on our instructions and support the delivery of services. These processors are required by contract to process data securely, confidentially, and only for specified purposes. Categories of processors may include:

IT and hosting providers;
payment service providers;
customer support and communications providers;
accounting, auditing, and professional advisers;
security, fraud prevention, and compliance providers;
delivery, logistics, or operational partners where relevant.

We may also disclose personal data to independent third parties where necessary to comply with the law, protect rights, prevent fraud, or respond to lawful requests. If a third party determines its own purposes and means of processing, it acts as a separate controller and is responsible for its own compliance obligations.

6. International Transfers

If personal data is transferred outside the European Economic Area or the United Kingdom, we will ensure appropriate safeguards are in place. These safeguards may include adequacy decisions, standard contractual clauses, or other legally approved transfer mechanisms. Where necessary, supplementary measures will be applied to protect the data.

7. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental loss, unlawful destruction, unauthorised access, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff training, confidentiality obligations, and regular review of security practices. No method of transmission or storage is completely secure, but we work to maintain a level of protection appropriate to the risk.

8. Data Minimisation and Privacy by Design

We aim to collect and process only the data needed for a defined purpose. Privacy considerations are built into our internal processes, systems, and decision-making. This means that we regularly assess whether data collection is necessary, relevant, and proportionate. Where possible, we use pseudonymisation, restricted access, and other privacy-enhancing measures.

9. Your Rights Under GDPR

Customers in area have the following rights, subject to legal limitations and conditions:

Right of access: to obtain confirmation of whether personal data is processed and to receive a copy of that data.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request limited processing in certain situations.
Right to data portability: to receive data in a structured, commonly used, machine-readable format and transmit it to another controller where applicable.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent.
Right not to be subject to automated decision-making: including profiling, where such decisions produce legal or similarly significant effects, unless permitted by law.

Where we receive a valid rights request, we will respond within the timeframe required by GDPR, usually within one month, unless the request is complex or numerous. In those cases, the response period may be extended in accordance with the law.

10. Children’s Data

Our services are not directed at children unless expressly stated for a specific offering. If we become aware that personal data has been collected from a child without appropriate legal basis or consent where required, we will take reasonable steps to delete it or seek lawful authorisation.

11. Complaints and Supervisory Authority

If a customer believes personal data has been processed unlawfully, the customer has the right to lodge a complaint with the relevant data protection supervisory authority. We encourage individuals to raise concerns so that we can address them promptly and transparently. This does not affect the right to seek legal remedies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, operational practices, or service requirements. The most current version will apply to processing carried out after the effective date of the updated policy. We recommend reviewing the policy periodically to stay informed about how personal data is protected.

13. General Statement

This Privacy Policy applies to all customers in area. It describes how personal data is handled in a manner intended to be lawful, fair, transparent, and secure. We are committed to respecting privacy rights and processing personal data only to the extent necessary for legitimate and permitted purposes. Where there is any conflict between this policy and applicable data protection law, the law will prevail.

By using our services, customers acknowledge that their personal data may be processed as described in this Privacy Policy.