Privacy Policy -

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when we provide our services to customers in the area. It applies to all customers in the area and is intended to meet the requirements of the General Data Protection Regulation (GDPR). We are committed to processing personal data lawfully, fairly, and transparently, and to respecting the rights of individuals whose data we handle.

1. Scope of this Policy

This policy applies to personal data processed in connection with our services, communications, transactions, support activities, and any related business operations. It covers data collected directly from customers, data provided by third parties where permitted, and data generated through the use of our services. For the purposes of GDPR, we act as a data controller where we determine the purposes and means of processing personal data.

2. Data Collection

We collect only the information that is necessary, relevant, and limited to what is needed for the purposes described in this policy. Depending on the interaction and service context, the categories of personal data we may process include:

Identity data such as name, title, and customer reference details.
Contact data such as email address, postal address, and telephone number.
Account and service data such as preferences, service history, and communication records.
Transaction data such as records of purchases, billing, and payment status.
Technical data such as device type, browser information, and basic usage logs.
Correspondence data such as messages, complaints, requests, and feedback.

We collect personal data directly from individuals when they provide it to us, and in some cases from lawful third-party sources where this is permitted. When collection is required by law or is necessary to provide a service, we will indicate the consequences of not providing the data.

3. Lawful Basis for Processing

We process personal data only when we have a valid lawful basis under GDPR. The lawful bases we rely on may include:

Contract - to perform a contract with a customer or to take steps at the customer’s request before entering into a contract.
Legal obligation - to comply with legal or regulatory duties, including accounting, tax, and record-keeping obligations.
Legitimate interests - to operate, improve, and protect our services, provided those interests are not overridden by the interests or fundamental rights and freedoms of the individual.
Consent - where the individual has given clear and informed consent for a specific purpose, and where consent can be withdrawn at any time.

When special categories of personal data are involved, we will process such data only where an additional lawful condition under GDPR applies. We will not use personal data for new purposes that are incompatible with the original reason for collection unless we have a lawful basis to do so.

4. How We Use Personal Data

We use personal data for the following purposes:

To provide and administer services requested by customers.
To manage accounts, records, and service delivery.
To communicate about updates, changes, support matters, and relevant notices.
To handle billing, payments, refunds, and related administrative tasks.
To maintain security, detect fraud, and prevent misuse.
To improve quality, performance, and customer experience.
To comply with legal and regulatory requirements.

Where processing is based on legitimate interests, we carefully assess the impact on the individual and apply safeguards to ensure those interests are not unfairly overridden. We do not sell personal data.

5. Sharing and Processors

We may share personal data with carefully selected third parties that act on our behalf as processors. These processors may help with hosting, data storage, payment processing, analytics, customer support tools, document management, and other operational services. Such processors are permitted to process personal data only according to our documented instructions and are required to maintain appropriate confidentiality, security, and compliance measures.

We may also disclose personal data where required or permitted by law, including to public authorities, regulators, courts, or law enforcement agencies. In addition, personal data may be shared in connection with audits, corporate reorganisations, or legal claims where necessary and lawful.

Before engaging any processor, we take reasonable steps to ensure that the processor provides sufficient guarantees regarding technical and organisational security measures and GDPR compliance. Where personal data is transferred outside the relevant jurisdiction, we will implement appropriate safeguards, such as standard contractual clauses or other lawful transfer mechanisms.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting, tax, and reporting requirements. Retention periods vary depending on the type of data, the reason for processing, and any applicable legal obligations.

When determining retention periods, we consider:

The duration of the customer relationship.
Whether the data is needed to provide ongoing services.
Legal or regulatory retention obligations.
Potential disputes, claims, or audits.
The sensitivity and volume of the information.

Once personal data is no longer required, we will securely delete, anonymise, or irreversibly de-identify it, unless we are required by law to retain it for a longer period. Where practical, we apply a storage limitation approach to ensure that data is not kept indefinitely without purpose.

7. Security Measures

We implement appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, encryption, backups, secure authentication, staff training, and restricted permissions based on need-to-know principles.

Although no system can be guaranteed to be completely secure, we regularly review our measures and seek to maintain a level of protection appropriate to the risk. If a personal data breach occurs that is likely to result in a risk to the rights and freedoms of individuals, we will respond in accordance with applicable legal requirements.

8. User Rights Under GDPR

Individuals whose personal data we process have specific rights under GDPR. Subject to legal limitations and verification requirements, these rights may include:

Right of access - to obtain confirmation that personal data is being processed and to receive a copy of it.
Right to rectification - to request correction of inaccurate or incomplete data.
Right to erasure - to request deletion of personal data in certain circumstances.
Right to restriction - to ask us to limit how personal data is used in certain situations.
Right to data portability - to receive personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where applicable.
Right to object - to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent - where processing is based on consent, individuals may withdraw it at any time.
Rights related to automated decision-making - to avoid decisions made solely by automated means in circumstances where such rights apply.

To protect personal data, we may ask for reasonable information to verify identity before responding to a rights request. We will respond within the timeframe required by law and will explain if any part of a request cannot be fulfilled due to a legal exemption.

9. Children’s Data

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children without appropriate lawful basis and, where required, verifiable parental consent. If we become aware that personal data of a child has been collected unlawfully, we will take appropriate steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service developments. Any updated version will apply from the date it becomes effective. We encourage individuals to review this policy periodically to stay informed about how personal data is processed.

11. Complaints and Supervisory Authority

If an individual believes that their personal data has been handled unlawfully, they have the right to lodge a complaint with a relevant data protection supervisory authority. We encourage concerns to be raised promptly so that they can be reviewed and addressed in line with applicable law. Individuals also retain all other rights and remedies available under GDPR.

Summary of Principles

Lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality are the core principles guiding our data processing activities. We apply these principles to all customers in the area and seek to ensure that personal data is handled responsibly, respectfully, and in accordance with GDPR.