Privacy Policy -

This Privacy Policy explains how personal data is collected, used, retained, and protected in relation to our services. This policy applies to all customers in the area. It describes the categories of data we process, the lawful bases for processing under the General Data Protection Regulation (GDPR), retention periods, the role of processors, and the rights available to data subjects.

1. Data We Collect

We collect personal data that is necessary to provide and improve our services. Types of data we may collect include:

Identity and account data: name, username, account identifiers, and profile information.
Contact data: email address, postal address, and telephone number where necessary for communication and service delivery.
Transactional data: records of products and services purchased, billing and payment information, and order history.
Technical and usage data: IP address, device identifiers, browser type, operating system, log files, and interaction data, including pages visited and features used.
Preference and marketing data: marketing preferences and communication consents.
Support data: correspondence and support tickets related to customer service inquiries.
Sensitive data: only collected where strictly necessary and with explicit consent, for example health-related information if required for a specific service.

2. Purposes of Processing and Lawful Basis

We rely on specific lawful bases under the GDPR to process personal data. The primary purposes and bases are:

Performance of a contract: Processing necessary to perform contractual obligations and to take steps at the request of the data subject prior to entering a contract (e.g., order fulfillment, billing, customer support).
Legal obligation: Processing required to comply with legal obligations such as tax, accounting, or regulatory reporting.
Consent: Where we ask for consent (e.g., for marketing communications or collecting special category data), processing will be based on that freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time.
Legitimate interests: Processing necessary for our legitimate interests or those of a third party, provided these interests are not overridden by your rights and freedoms (e.g., fraud prevention, network and information security, improving services, direct marketing where permitted).
Public interest: In rare cases where we process data for tasks carried out in the public interest or in the exercise of official authority, we will rely on the relevant legal basis.

3. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal obligations, or to resolve disputes and enforce our agreements.

Account and profile data: retained for the period the account is active and for a reasonable period after account closure to meet contractual and legal obligations (typically up to several years depending on jurisdictional requirements).
Transactional and billing records: retained as required by applicable law (for example, tax and accounting laws), commonly for at least 6 to 10 years where required.
Support and correspondence: retained for the period necessary to resolve inquiries and maintain service quality, generally for 2 to 5 years.
Marketing consents and preferences: retained until consent is withdrawn or preferences are changed.
Logs and technical data: retained for a limited period for security, analytics, and troubleshooting, typically from 30 days to 3 years depending on the purpose.

When retention periods expire, we securely delete, anonymize, or aggregate the data so it can no longer identify an individual.

4. Use of Processors and Third Parties

We engage third-party service providers ("processors") to perform functions on our behalf, such as payment processing, hosting, analytics, email delivery, and customer support. When we share personal data with processors, we:

Require processors to act only on our documented instructions.
Ensure processors implement appropriate technical and organizational measures to protect data.
Execute data processing agreements that include confidentiality, security, breach notification, and return or deletion obligations.

International transfers: Some processors may operate outside the area. Where data is transferred outside the European Economic Area, we rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, or other legally recognized transfer mechanisms to ensure an adequate level of protection.

5. Your Rights under the GDPR

You have the following rights in relation to your personal data. To exercise these rights, please use the channels provided within your account or the contact mechanisms available through the service.

Individual Rights

Right of access: You may request confirmation as to whether we process your personal data and request a copy of that data.
Right to rectification: You can request correction of inaccurate or incomplete personal data.
Right to erasure (right to be forgotten): You may request deletion of your personal data where there is no overriding legal basis for its continued processing.
Right to restriction of processing: You may request that processing be limited in certain circumstances (for example, while a dispute about accuracy is resolved).
Right to data portability: Where processing is based on consent or performance of a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
Right to object: You may object to processing based on legitimate interests or to direct marketing at any time.
Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been infringed.

We will respond to requests in accordance with GDPR timelines, typically within one month of receipt. If requests are complex or numerous, the period may be extended by two further months, and we will inform you of any extension within one month.

6. Security and Data Protection Measures

We implement appropriate technical and organizational measures to safeguard personal data, including but not limited to access controls, encryption in transit and at rest where appropriate, network and system monitoring, security policies, staff training, and incident response procedures. We routinely test and evaluate our measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.

7. Automated Decision-Making and Profiling

In some cases, automated processing or profiling may be used to improve service delivery and personalize user experience. You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you, except where permitted by law or necessary for contract performance. Where applicable, meaningful information about the logic involved and the envisaged consequences will be provided on request.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or services. When material changes are made, we will notify you through the service or other appropriate means. Continued use of our services following notice of changes constitutes acceptance of the updated policy.

9. Additional Information

We are committed to transparency and accountability. Where legally required, we maintain records of processing activities and conduct privacy impact assessments for high-risk processing. We only process personal data necessary for the defined purposes and apply data minimization principles. If you are a customer in the area, this policy governs the collection and processing of your personal data in relation to our services.

Note: This Privacy Policy does not provide specific instructions for contacting us; please use the contact mechanisms available within your account or the service platform to exercise your rights or raise questions related to this policy.

Last updated: the date specified within the service.