Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area where our services are offered, and it is intended to meet the requirements of the General Data Protection Regulation (GDPR) and any related applicable data protection laws.

1. Scope of this Policy

This Policy applies to personal data processed when customers use our services, interact with our products, make inquiries, or otherwise engage with us in the ordinary course of business. It covers data collected directly from individuals, data received from business partners, and data collected automatically through technical systems used to operate and secure our services.

Personal data means any information relating to an identified or identifiable natural person. Depending on the context, this may include names, contact details, account information, service usage data, payment-related details, and technical identifiers.

2. Data We Collect

We collect only the information needed to provide, maintain, protect, and improve our services. The categories of personal data we may process include:

• Identity data, such as name or user identifier;
• Contact data, such as email address, telephone number, or postal address;
• Account data, such as login details, profile settings, and service preferences;
• Transaction data, such as records of purchases, billing status, and service history;
• Technical data, such as IP address, device type, browser type, operating system, and log files;
• Usage data, such as pages viewed, actions taken, session duration, and feature interaction;
• Communication data, such as messages, feedback, support requests, or complaints;
• Marketing preferences, where applicable, including communication choices and consent records.

We do not seek to collect more data than is necessary for the purposes described in this Policy. Where possible, we minimize collection and limit access to personnel and processors who require the data to perform their functions.

3. How We Use Personal Data

We process personal data for the following purposes:

• to provide and deliver our services;
• to create and manage customer accounts;
• to communicate about service updates, operational notices, and support matters;
• to process payments and maintain transaction records;
• to secure our systems, detect fraud, and prevent misuse;
• to analyze performance and improve service quality;
• to comply with legal obligations;
• to establish, exercise, or defend legal claims;
• where permitted, to send marketing communications and measure their effectiveness.

Where processing is based on consent, individuals may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4. Lawful Basis for Processing

Under GDPR, personal data must be processed on a lawful basis. Depending on the activity, we rely on one or more of the following bases:

4.1 Performance of a Contract

We process personal data when it is necessary to enter into or perform a contract with a customer, or to take steps at the customer’s request before entering into a contract. This includes setting up accounts, fulfilling service requests, and delivering agreed services.

4.2 Legal Obligation

We may process personal data where required to comply with legal or regulatory obligations, such as tax, accounting, consumer protection, anti-fraud, or record-keeping requirements.

4.3 Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or the legitimate interests of a third party, provided those interests are not overridden by the individual’s rights and freedoms. Examples include service security, internal administration, analytics, service improvement, and the prevention of misuse.

4.4 Consent

In certain situations, we rely on consent, particularly for optional marketing or for specific forms of data processing where consent is legally required. Where consent is used, it must be freely given, specific, informed, and unambiguous.

5. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, reporting, and dispute-resolution requirements. Retention periods vary depending on the type of data, the nature of the relationship with the customer, and applicable law.

In general, we consider the following factors when determining retention:

• the duration of the customer relationship;
• legal retention obligations;
• the need to resolve disputes or enforce agreements;
• security and fraud-prevention requirements;
• whether the data is still necessary for the purpose for which it was collected.

When personal data is no longer needed, we will delete it securely or anonymize it so that it can no longer identify an individual. If deletion is not immediately possible due to legal or technical reasons, the data will be stored securely and isolated from further use until deletion is possible.

6. Sharing and Processors

We may share personal data with third parties only when necessary and subject to appropriate safeguards. Some third parties act as processors and process data on our behalf under contract. They are required to follow our instructions and to implement suitable technical and organizational measures.

Types of processors may include:

• IT and cloud service providers;
• payment service providers;
• customer support or communications platforms;
• analytics and performance monitoring providers;
• security and anti-fraud service providers;
• professional advisers, such as accountants or legal advisers, where necessary.

We may also disclose data to independent third parties where required by law, to protect rights and safety, or in connection with corporate transactions. Any sharing is limited to what is necessary for the relevant purpose.

7. International Transfers

If personal data is transferred outside the European Economic Area or another jurisdiction with comparable data protection standards, we will ensure that appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, or other legally recognized transfer mechanisms. Such measures are intended to ensure a level of protection essentially equivalent to that guaranteed under GDPR.

8. Data Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption where appropriate, monitoring, secure storage, confidentiality obligations, and regular review of security practices.

While we take reasonable steps to protect data, no system is completely secure. In the event of a personal data breach, we will assess the incident and, where required by law, notify the relevant supervisory authority and affected individuals.

9. User Rights Under GDPR

Individuals whose personal data we process have certain rights under GDPR. Subject to legal limitations, these rights include:

• Right of access – to obtain confirmation of whether personal data is being processed and to receive a copy of the data;
• Right to rectification – to request correction of inaccurate or incomplete data;
• Right to erasure – to request deletion of personal data in certain circumstances;
• Right to restriction – to request limited processing in certain situations;
• Right to data portability – to receive data in a structured, commonly used, machine-readable format and, where feasible, have it transmitted to another controller;
• Right to object – to object to processing based on legitimate interests or for direct marketing;
• Right to withdraw consent – where processing is based on consent;
• Right not to be subject to automated decision-making – including profiling, where such decisions produce legal or similarly significant effects, unless permitted by law.

To exercise these rights, individuals may make a request through the channels provided by us in the ordinary course of business. We will respond within the time limits required by applicable law and may request additional information to verify identity where necessary.

10. Complaints and Supervisory Authority

Individuals also have the right to lodge a complaint with a data protection supervisory authority if they believe their personal data has been processed unlawfully. We encourage individuals to raise concerns so that we can address them promptly, but this does not affect the right to contact the competent authority directly.

11. Children’s Data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children without appropriate authorization or legal basis. If we become aware that data has been collected from a child in a manner inconsistent with applicable law, we will take steps to delete or otherwise protect the data as required.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service features. The revised version will apply from the effective date stated in the updated policy. We encourage customers to review this Policy periodically to remain informed about how personal data is handled.

In summary, we are committed to processing personal data lawfully, fairly, and transparently, using it only for legitimate purposes, retaining it only as long as necessary, and respecting the rights of all customers in the area.