Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area, including individuals and organizations that use our products or services, visit our premises, or otherwise interact with us. We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with the General Data Protection Regulation (GDPR) and any applicable local data protection laws.

1. Scope of This Policy

This Policy applies to personal data we process when providing our services, managing customer relationships, operating our business, and fulfilling legal obligations. It covers data collected directly from you, data generated through your use of our services, and data received from third parties where permitted by law. By using our services, you acknowledge that your personal data may be processed as described in this Policy.

2. Data We Collect

We may collect and process the following categories of personal data:

Identity data: name, title, date of birth, and similar identifiers.
Contact data: address, email address, telephone number, and other communication details.
Customer relationship data: account details, service preferences, transaction history, and communication records.
Technical data: IP address, device identifiers, browser type, operating system, and logs.
Usage data: information about how services are accessed and used.
Financial and billing data: payment details, invoices, payment status, and related records.
Correspondence data: messages, requests, complaints, and feedback.
Compliance data: records needed to verify identity, prevent fraud, or meet legal requirements.

We do not intentionally collect special category data unless it is required or voluntarily provided for a specific lawful purpose and with appropriate safeguards.

3. How We Collect Data

We collect personal data in several ways, including:

when you create an account, place an order, request a service, or complete forms;
when you communicate with us by email, phone, or other channels;
when you use our systems, websites, or digital tools;
when data is generated through service delivery, billing, or support;
when we receive data from authorized third parties, such as payment providers, business partners, or public authorities where legally permitted.

4. Lawful Basis for Processing

We only process personal data when we have a lawful basis under GDPR. Depending on the purpose, we rely on one or more of the following legal grounds:

Contract: processing is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract.
Legal obligation: processing is necessary to comply with laws, regulations, tax rules, accounting obligations, or lawful requests from authorities.
Legitimate interests: processing is necessary for our legitimate business interests, provided these are not overridden by your rights and freedoms. Examples include service improvement, fraud prevention, security, and internal administration.
Consent: where required by law, we will rely on your consent for specific processing activities. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Vital interests: in rare cases, we may process data to protect someone’s life or physical safety.
Public interest: where applicable, processing may be required for tasks carried out in the public interest or under official authority.

We assess the necessity and proportionality of each processing activity to ensure it is limited to what is relevant and adequate for the stated purpose.

5. Purposes of Processing

We process personal data for the following purposes:

to provide and administer our services;
to manage customer accounts and requests;
to process payments, invoices, and refunds;
to communicate about service updates, notices, and support matters;
to improve operations, products, and customer experience;
to maintain security, detect misuse, and prevent fraud;
to comply with legal and regulatory obligations;
to defend or establish legal claims, where necessary.

6. Data Sharing and Processors

We may share personal data with trusted third parties that act as processors or, in some cases, independent controllers. We ensure that any processor is bound by a written data processing agreement and only processes data on our documented instructions, subject to appropriate security and confidentiality obligations.

Categories of processors may include:

IT hosting and cloud service providers;
software and system maintenance providers;
payment and billing service providers;
customer support and communication platforms;
document storage and backup providers;
professional advisers such as auditors, lawyers, or accountants;
fraud prevention, security, and compliance service providers.

We may also disclose personal data if required by law, court order, or regulatory request, or if necessary to protect our rights, customers, staff, or the public.

7. International Transfers

If personal data is transferred outside the European Economic Area, we will ensure that appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, or other valid transfer mechanisms under GDPR. We take steps to assess the risks of such transfers and to preserve a level of protection essentially equivalent to that required within the EEA.

8. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including any legal, accounting, or reporting requirements. Retention periods vary depending on the type of data and the reason for processing.

Contract and service records: kept for the duration of the relationship and for a reasonable period afterward.
Financial and tax records: kept for the period required by applicable law.
Support and correspondence records: kept as long as needed to resolve matters and maintain service history.
Security logs and technical records: kept for limited periods unless needed for investigations or legal proceedings.

When retention is no longer necessary, data will be deleted, anonymized, or securely archived in accordance with our internal retention procedures. We do not keep personal data indefinitely.

9. Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption where appropriate, monitoring, staff confidentiality obligations, and secure backup practices. While no system can be guaranteed completely secure, we continuously review our safeguards and improve them as needed.

10. Your Rights Under GDPR

Subject to applicable law, you have the following rights regarding your personal data:

Right of access: to obtain confirmation of whether we process your data and receive a copy of it.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of data in certain circumstances.
Right to restriction: to request limited processing in specific situations.
Right to data portability: to receive data you have provided in a structured, commonly used, machine-readable format and transmit it to another controller where applicable.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing relies on consent, you may withdraw it at any time.
Right to lodge a complaint: to contact the relevant supervisory authority if you believe your rights have been infringed.

We may need to verify your identity before responding to a rights request. We will respond within the time limits required by law and explain any refusal or limitation where applicable.

11. Automated Decision-Making

We do not use personal data for decisions based solely on automated processing that produce legal or similarly significant effects on individuals, unless such processing is permitted by law and appropriate safeguards are in place. If this changes, we will provide clear information about the logic involved and the consequences for you.

12. Children’s Data

Our services are not directed to children unless specifically stated otherwise. We do not knowingly collect personal data from children without proper authorization or a lawful basis. If we become aware that data has been collected inappropriately, we will take steps to delete or protect it as required.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any updated version will apply from the date it becomes effective. We encourage customers to review this Policy periodically to stay informed about how personal data is handled.

14. Summary of Key Principles

we collect only data needed for defined and lawful purposes;
we process data under a valid GDPR lawful basis;
we share data only with appropriate processors and other permitted recipients;
we keep data no longer than necessary;
we respect and support your data protection rights;
we apply this Policy to all customers in the area.

Thank you for taking the time to read this Privacy Policy. We are committed to safeguarding personal data and maintaining transparency in how we process information.