Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area where our services are offered and is intended to meet the requirements of the General Data Protection Regulation (GDPR). We are committed to handling personal data lawfully, fairly, transparently, and securely.

1. Scope of This Policy

This policy applies to personal data we process when individuals use our services, make enquiries, purchase products or services, communicate with us, or otherwise interact with us. It covers data processed in electronic and paper form, and it applies whether the data is provided directly by the individual or collected through operational systems.

For the purposes of this policy, personal data means any information relating to an identified or identifiable natural person. This may include names, contact details, account information, payment-related information, service preferences, technical identifiers, and other information that can be linked to an individual.

2. Data We Collect

We may collect and process different categories of personal data depending on the nature of the interaction. The types of data we may collect include:

• Identity data, such as name, title, and similar identifiers.
• Contact data, such as address, email address, and telephone number.
• Transaction data, such as purchase records, billing details, and service history.
• Account data, such as login details, preferences, and profile information.
• Technical data, such as device type, browser information, IP address, and system logs.
• Usage data, such as pages or features accessed, frequency of use, and interaction patterns.
• Communication data, such as records of correspondence, complaints, feedback, or support requests.

We only collect data that is relevant and necessary for the purposes described in this policy. Where possible, we limit collection to the minimum amount needed to provide and improve our services.

3. How We Use Personal Data

Personal data may be used for the following purposes:

• To provide and manage services requested by the customer.
• To process orders, payments, invoicing, and related administrative tasks.
• To communicate with customers about services, updates, or operational matters.
• To respond to enquiries, complaints, and support requests.
• To improve service quality, functionality, and customer experience.
• To maintain internal records, reporting, and business administration.
• To detect, prevent, and investigate fraud, misuse, or security incidents.
• To comply with legal obligations, regulatory requirements, and lawful requests.

We will not use personal data for purposes that are incompatible with the original reason it was collected unless we have a valid legal basis and, where required, have provided appropriate notice.

4. Lawful Basis for Processing

We process personal data only where a lawful basis under GDPR applies. Depending on the purpose and context, our processing may rely on one or more of the following lawful bases:

Performance of a Contract

We process personal data when it is necessary to enter into or perform a contract with a customer, including providing requested services, managing accounts, and handling payments.

Legal Obligation

We may process personal data when required to comply with legal or regulatory obligations, including tax, accounting, audit, consumer, or record-keeping requirements.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by the rights and freedoms of the individual. Legitimate interests may include maintaining service security, improving operations, preventing fraud, and administering our business responsibly.

Consent

Where required, we will rely on consent for certain processing activities. If consent is used, it will be freely given, specific, informed, and unambiguous. Individuals may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Vital Interests

In rare circumstances, we may process personal data to protect someone’s vital interests, such as in an emergency situation.

5. Sharing and Processors

We may share personal data with carefully selected third parties that process data on our behalf. These third parties act as processors and are only permitted to process personal data in accordance with our instructions and applicable law. We require processors to implement appropriate technical and organisational measures to protect personal data.

Processors may include:

• IT and hosting service providers.
• Payment processing services.
• Customer support and communication systems.
• Accounting, auditing, and administrative service providers.
• Security and fraud prevention providers.

We may also disclose personal data to professional advisers, regulatory authorities, law enforcement bodies, or courts where legally required or permitted. We do not sell personal data.

Where personal data is transferred outside the European Economic Area, appropriate safeguards will be used, such as standard contractual clauses or another valid transfer mechanism approved under GDPR.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, reporting, and contractual obligations. Retention periods vary depending on the type of data and the context in which it was collected.

In general, we consider the following factors when determining retention:

• The length of our relationship with the customer.
• Whether the data is needed to deliver services or support claims.
• Legal and regulatory retention requirements.
• Potential disputes, investigations, or audit needs.

When personal data is no longer required, it will be securely deleted, anonymised, or archived in a manner that prevents unnecessary use.

7. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, secure storage, encryption where appropriate, staff training, and operational procedures designed to reduce risk.

Although no system can be guaranteed completely secure, we are committed to maintaining a level of protection appropriate to the nature of the data and the risks involved. We also review and improve our safeguards periodically.

8. User Rights Under GDPR

Individuals whose data we process have rights under GDPR. Subject to legal limitations, these rights may include:

• The right of access to obtain confirmation and a copy of personal data.
• The right to rectification to correct inaccurate or incomplete data.
• The right to erasure to request deletion in certain circumstances.
• The right to restrict processing where specific conditions apply.
• The right to data portability to receive certain data in a structured, commonly used format.
• The right to object to processing based on legitimate interests or direct marketing.
• The right to withdraw consent where processing is based on consent.
• The right not to be subject to automated decision-making in certain circumstances.

Requests to exercise these rights will be handled in accordance with GDPR timeframes and requirements. We may need to verify identity before responding to a request. Some rights may be limited where processing is necessary to comply with legal obligations or to establish, exercise, or defend legal claims.

9. Data Accuracy and Responsibility

We aim to keep personal data accurate and up to date. Customers are encouraged to inform us of changes to relevant personal information so records remain correct. While we take reasonable steps to maintain accuracy, we are not responsible for errors arising from information that has not been updated by the customer or from data supplied by third parties that was inaccurate at the source.

10. Children’s Data

Our services are not directed to children unless explicitly stated. We do not knowingly collect personal data from children without appropriate authorisation or consent where required by law. If we become aware that such data has been collected unlawfully, we will take appropriate steps to delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service offerings. Any updated version will apply from the date it is made available. We encourage individuals to review this policy periodically to remain informed about how personal data is processed.

12. Final Statement

This Privacy Policy is intended to provide clear and transparent information about our handling of personal data and to support compliance with GDPR. By processing personal data responsibly, lawfully, and securely, we aim to protect the rights of individuals while delivering services effectively to all customers in the area. We are committed to ensuring that personal data is processed only for legitimate purposes, retained for no longer than necessary, and safeguarded throughout its lifecycle.