Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, disclosed, and protected in connection with the services provided to customers in the area. It applies to all customers in area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws. Please read this policy carefully to understand what information is handled, why it is handled, and what rights individuals have in relation to their personal data.

1. Data Collection

We collect and process personal data only to the extent necessary for legitimate business operations and service delivery. The categories of data that may be collected include:

Identity data such as name, title, and any identifiers provided during account creation or service use.
Contact data such as email address, phone number, billing address, or delivery address where relevant.
Transactional data such as records of purchases, payments, and service interactions.
Technical data such as device type, browser type, IP address, time zone settings, and log information.
Usage data such as pages viewed, features used, time spent, and interaction patterns.
Communication data such as correspondence, support requests, complaints, and feedback.

We may receive personal data directly from individuals, through automated technologies, from service providers, or from other lawful sources where permitted. Where special category data is provided, it is processed only when there is a valid legal basis and appropriate safeguards in place.

2. Purposes of Processing

Personal data is used for specific, explicit, and legitimate purposes. These purposes include:

Providing and managing services requested by customers in area.
Processing transactions, payments, refunds, and related administrative tasks.
Maintaining records, internal administration, and service quality monitoring.
Responding to enquiries, support requests, and complaints.
Improving services, systems, security, and user experience.
Detecting, preventing, and investigating fraud, misuse, or security incidents.
Complying with legal obligations, regulatory requirements, and lawful requests.

We do not use personal data in ways that are incompatible with these purposes unless required or permitted by law.

3. Lawful Basis for Processing

Under GDPR, we process personal data only when a lawful basis applies. Depending on the activity, the lawful basis may be one or more of the following:

Contract: processing is necessary to enter into or perform a contract with a customer, including delivering services or managing accounts.
Legal obligation: processing is required to comply with legal or regulatory duties, including tax, accounting, and record-keeping obligations.
Legitimate interests: processing is necessary for our legitimate interests or those of a third party, provided these interests are not overridden by the individual’s rights and freedoms. Examples include service improvement, fraud prevention, and internal administration.
Consent: where required, we rely on freely given, specific, informed, and unambiguous consent. Individuals may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Vital interests: in rare circumstances, processing may be necessary to protect someone’s life or physical safety.
Public task: if applicable, processing may be carried out to perform a task in the public interest or under official authority.

The lawful basis used will depend on the context and the purpose for which the data is processed.

4. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. Retention periods may vary depending on the type of data and the reason for processing.

In general:

Service and account data are retained for the duration of the customer relationship and for a reasonable period thereafter.
Transaction and financial records are retained for the period required by tax, audit, and accounting laws.
Support communications are retained as long as needed to resolve issues, maintain quality records, and manage follow-up.
Technical and security logs are retained for a limited period unless needed longer for investigations, compliance, or legal proceedings.

When personal data is no longer required, it is securely deleted, anonymised, or otherwise disposed of in accordance with our retention procedures.

5. Processors and Data Sharing

We may engage third-party service providers, known under GDPR as processors, to process personal data on our behalf. These processors may support functions such as hosting, information technology, analytics, customer support, payment processing, communications, or document storage.

All processors are selected carefully and are required to:

process personal data only on documented instructions;
maintain confidentiality and appropriate security measures;
assist with compliance obligations where relevant;
notify us of personal data breaches without undue delay;
return or delete personal data when the service ends, unless retention is required by law.

We may also disclose personal data to independent controllers where necessary and lawful, such as professional advisers, regulatory authorities, law enforcement bodies, courts, or other recipients when required to protect legal rights, prevent harm, or comply with obligations. We do not sell personal data.

6. International Transfers

Where personal data is transferred outside the European Economic Area or the United Kingdom, we ensure appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, supplementary measures, or other lawful transfer mechanisms permitted under GDPR. Transfers are only made where necessary and where suitable protection is provided.

7. Data Security

We use reasonable technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, encryption, secure storage, staff confidentiality obligations, and regular review of security practices. While no system can be guaranteed completely secure, we work to maintain an appropriate level of protection based on the nature of the data and the risks involved.

8. User Rights

Individuals whose personal data is processed under this policy have rights under GDPR. Subject to legal limitations, these rights include:

Right of access — to obtain confirmation and a copy of personal data being processed.
Right to rectification — to request correction of inaccurate or incomplete data.
Right to erasure — to request deletion of personal data in certain circumstances.
Right to restriction — to request limited processing in certain cases.
Right to data portability — to receive data in a structured, commonly used, machine-readable format where applicable.
Right to object — to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent — where processing is based on consent, to withdraw it at any time.
Rights related to automated decision-making — to not be subject to decisions based solely on automated processing where such rights apply.

Requests relating to data protection rights should be made in accordance with the applicable internal process. We may need to verify identity before responding, and responses will be provided within the time limits required by law.

9. Children’s Data

Our services are not intended for use by children unless specifically stated otherwise. Where we become aware that personal data has been collected from a child without appropriate authority or lawful basis, we will take steps to delete or protect the data as required by law.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or technical changes. Any revised version will apply from the date it is made available. Individuals are encouraged to review the policy periodically to remain informed about how personal data is protected.

Summary of Key Principles

Data minimisation: we collect only what is necessary.
Purpose limitation: we use data only for defined purposes.
Storage limitation: we retain data only as long as needed.
Integrity and confidentiality: we protect data with appropriate safeguards.
Accountability: we maintain records and controls to demonstrate compliance.

This Privacy Policy applies to all customers in area and is intended to ensure transparency, fairness, and lawful processing of personal data.