Privacy Policy
This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when customers use our services. It applies to all customers in our service area and is intended to provide clear information about our data practices in a manner consistent with the General Data Protection Regulation (GDPR). By using our services, you acknowledge that your personal data may be processed as described in this Policy.
1. Scope of this Policy
This Policy applies to all customers in the area where our services are offered. It covers personal data processed in connection with account creation, service delivery, communication, billing, support, security, and legal compliance. It does not apply to information that has been anonymized so that it can no longer identify an individual.
2. Data We Collect
We collect only the personal data necessary for the purposes described in this Policy. Depending on how you interact with us, we may collect the following categories of information:
- Identity data: name, title, and similar identifiers.
- Contact data: address, email address, and telephone number where relevant for service administration.
- Account data: customer identification details, account settings, and service preferences.
- Transaction data: records of purchases, payments, invoices, and service history.
- Technical data: device type, browser type, IP address, and system logs related to service use.
- Usage data: information about how services are accessed and used.
- Communication data: messages, inquiries, complaints, and feedback submitted to us.
We generally do not intentionally collect special category data unless it is required by law, necessary to protect vital interests, or expressly provided by you for a lawful purpose. Where such data is processed, it is handled with appropriate safeguards and only when permitted under applicable law.
3. How We Use Personal Data
We use personal data for specific, explicit, and legitimate purposes. These include:
- providing and managing services;
- creating and maintaining customer accounts;
- processing payments and accounting records;
- responding to inquiries and providing customer support;
- monitoring service performance and improving quality;
- protecting against fraud, misuse, or unauthorized access;
- complying with legal and regulatory obligations;
- establishing, exercising, or defending legal claims.
We do not use personal data for purposes that are incompatible with the original reasons for collection unless we have a valid legal basis and, where required, additional notice or consent.
4. Lawful Basis for Processing
Under GDPR, we must have a lawful basis before processing personal data. Depending on the context, we rely on one or more of the following legal bases:
Contract
We process personal data where it is necessary to perform a contract with you or to take steps at your request before entering into a contract. This includes account management, service delivery, billing, and related customer administration.
Legal Obligation
We may process personal data when necessary to comply with legal obligations, such as tax, accounting, consumer protection, anti-fraud, or regulatory requirements.
Legitimate Interests
We may process personal data where it is necessary for our legitimate interests or the legitimate interests of third parties, provided those interests are not overridden by your rights and freedoms. Examples include service improvement, network and information security, fraud prevention, and internal reporting. Where we rely on legitimate interests, we consider the nature of the data, the context of processing, and any impact on individuals.
Consent
In limited situations, we may rely on your consent. When consent is used as the lawful basis, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Vital Interests and Public Interest
In rare cases, we may process personal data to protect vital interests or where processing is necessary for tasks carried out in the public interest or under official authority, if applicable.
5. Data Sharing and Processors
We may share personal data with third parties that assist us in operating our services. These third parties act as processors or, in some cases, independent controllers. We only share personal data where necessary and subject to appropriate contractual, technical, and organizational safeguards.
Processors may include providers of:
- payment processing;
- IT hosting and cloud storage;
- customer support systems;
- analytics and service monitoring;
- security and fraud prevention tools;
- document storage and archiving.
Each processor is required to process personal data only on our instructions, to protect confidentiality, and to implement appropriate security measures. Where data is transferred outside the European Economic Area, such transfers are made only where permitted by law and protected by approved safeguards, such as standard contractual clauses or equivalent mechanisms.
We may also disclose personal data if required to do so by law, court order, regulatory request, or where necessary to protect our rights, the rights of our customers, or the safety of others.
6. Retention of Personal Data
We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, and reporting requirements. Retention periods vary depending on the type of data and the reason for processing.
- Account and service records: kept for the duration of the customer relationship and for a reasonable period afterwards.
- Transaction and billing data: retained for periods required by financial and tax laws.
- Support communications: retained for as long as needed to resolve the matter and document the interaction.
- Security logs and technical records: retained for short periods unless longer retention is needed for investigation or compliance.
When personal data is no longer required, we will delete it securely or anonymize it so that it can no longer identify you. Retention decisions are reviewed periodically to ensure data is not kept longer than necessary.
7. Security Measures
We take appropriate technical and organizational measures to protect personal data against accidental loss, unauthorized access, alteration, disclosure, or destruction. These measures may include access restrictions, encryption, role-based permissions, secure storage, monitoring, and internal policies for data handling.
While no system can be guaranteed to be completely secure, we continually review and improve our safeguards to reduce risk and maintain an appropriate level of protection.
8. User Rights Under GDPR
If GDPR applies to your personal data, you have several rights. Subject to legal conditions and limitations, these may include:
- Right of access: to obtain confirmation of whether we process your personal data and to receive a copy of that data.
- Right to rectification: to request correction of inaccurate or incomplete information.
- Right to erasure: to request deletion of your personal data in certain circumstances.
- Right to restriction: to request limitation of processing in certain situations.
- Right to data portability: to receive certain data in a structured, commonly used, machine-readable format and to transmit it to another controller where feasible.
- Right to object: to object to processing based on legitimate interests or direct marketing.
- Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time.
- Right not to be subject to solely automated decisions: to avoid decisions made only by automated means that produce legal or similarly significant effects, where applicable.
You may also have the right to lodge a complaint with a supervisory authority if you believe your rights under data protection law have been infringed. Exercising these rights will not usually require a fee, although a reasonable fee or refusal may apply where requests are manifestly unfounded, repetitive, or excessive, as permitted by law.
9. Children’s Data
Our services are not intended for children unless explicitly stated otherwise. We do not knowingly collect personal data from children without the necessary legal basis and safeguards. If we become aware that personal data has been collected inappropriately, we will take steps to delete it where required.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service offerings. Any updated version will apply from the date it is made available. We encourage customers to review the Policy periodically to remain informed about how personal data is processed.
11. Summary of Key Principles
In handling personal data, we aim to follow the core GDPR principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. This means we collect only what is necessary, use it for stated purposes, keep it only as long as needed, and protect it with appropriate safeguards.
By using our services, you acknowledge that your personal data may be processed in accordance with this Privacy Policy and applicable data protection law.
