Privacy Policy -

Introduction

This Privacy Policy explains how we collect, use, disclose, and retain personal data and describes the rights available to individuals. This Policy applies to all customers in the area. For the purposes of this policy, "the area" refers to the geographic region where the General Data Protection Regulation (GDPR) applies, including the European Economic Area (EEA) and the United Kingdom where applicable. This Policy applies to all customers in the area.

Scope and Applicability

This Policy applies to the processing of personal data of customers, prospective customers, and users who are located in the area. It governs the collection and use of personal data by us in relation to the provision of products and services, customer support, marketing where consent has been given, and business operations related to those customers.

What personal data we collect

Identity and contact data: name, billing and delivery addresses, telephone number, email address, and similar identifiers.
Transactional data: records of products or services purchased, invoices, order history, and payment confirmations.
Financial data: payment method details (masking or tokenization used where appropriate); full payment card details are not retained unless necessary and where secure storage and legal basis exist.
Technical and usage data: IP address, device identifiers, browser and operating system, log files, analytics and usage statistics.
Customer service data: correspondence, support requests, and recordings of interactions where applicable and lawful.
Marketing preferences: consent choices and communication preferences.
Special categories of data: we do not generally collect special category data (such as health or racial data). If such data is collected, we will do so only with explicit consent or other lawful basis, and we will document the lawful basis and safeguards.

How we collect personal data

We collect personal data when you interact with our services, complete forms, make purchases, contact support, or otherwise provide information to us. We may also collect data from trusted third-party sources (with lawful basis) such as payment processors, fraud prevention providers, and public registers.

Lawful Bases for Processing

Under the GDPR, we rely on one or more of the following lawful bases to process personal data:

Contractual necessity: processing necessary to perform a contract with you (e.g., to deliver goods or services, process payments, manage accounts).
Legal obligation: processing necessary to comply with applicable laws or regulatory requirements (e.g., tax and accounting obligations, legal holds).
Consent: where you have given explicit consent for specific processing activities, such as marketing communications or optional profiling. You can withdraw consent at any time.
Legitimate interests: processing based on our legitimate business interests where those interests are not overridden by your rights, for example to improve service quality, prevent fraud, and maintain network security. We carry out balancing assessments before relying on this basis.
Vital interests or public task: rarely used, and only where strictly necessary.

How we use personal data

We use personal data to:

Provide, operate, and improve our products and services;
Process orders, payments, and returns;
Respond to customer service requests and provide support;
Send administrative information, updates, and transactional communications;
Manage accounts, billing, and fraud prevention;
Carry out marketing activities where consent has been obtained;
Comply with legal and regulatory obligations.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal obligations. Specific retention periods are determined by the type of data and the reason for processing. Typical retention periods include:

Transactional, billing, and contract records: retained for the duration of the contractual relationship plus a limited period to meet legal and tax obligations (commonly between 6 and 10 years depending on jurisdictional requirements).
Customer support and correspondence: retained for the period necessary to resolve the issue and for a limited time thereafter for record-keeping and quality assurance (commonly 1–3 years).
Marketing consents and preferences: retained until consent is withdrawn or the underlying purpose ceases to exist.
Technical and analytics data: retained for a limited period to maintain and improve services, often anonymized or aggregated after a set time.

When personal data is no longer required, we securely delete, anonymize, or aggregate it in accordance with industry standards.

Processors and third-party recipients

We use processors to perform services on our behalf. These may include payment processors, hosting and cloud service providers, analytics vendors, customer support platforms, and marketing platforms. We enter into data processing agreements with all processors to ensure they meet GDPR standards and implement appropriate technical and organizational measures.

Where personal data is transferred outside the EEA or to jurisdictions without an adequacy decision, we rely on approved safeguards such as:

Standard Contractual Clauses (SCCs) or other approved transfer mechanisms;
Explicit consent where required;
Reliance on adequacy decisions where applicable.

Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure. Measures include access controls, encryption in transit and at rest where appropriate, regular security assessments, and staff training. While we strive to protect data, no system is completely secure; we will notify regulators and affected individuals of breaches as required by law.

User Rights

You have rights under the GDPR regarding your personal data. These rights include:

Right of access: obtain confirmation of processing and a copy of your personal data.
Right to rectification: request correction of inaccurate or incomplete data.
Right to erasure: request deletion of data where lawful (also known as the "right to be forgotten").
Right to restriction: request restriction of processing in certain circumstances.
Right to data portability: receive certain data in a structured, commonly used format and transmit it to another controller where technically feasible.
Right to object: object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: withdraw previously given consent to processing at any time without affecting processing prior to withdrawal.
Right to lodge a complaint: if you believe processing infringes applicable law, you have the right to complain to a supervisory authority in your jurisdiction.

To exercise your rights, we will require reasonable verification of your identity before fulfilling requests to protect the security of your data.

Automated decision-making and profiling

We do not rely on automated decision-making that produces legal or similarly significant effects without human intervention, unless explicitly disclosed and based on a lawful basis. Where profiling is used (for example, to personalize services or detect fraud), you will be informed and where required, explicit consent will be obtained.

Changes to this Policy

We may update this Policy from time to time to reflect changes in law or our practices. Material changes will be communicated where required by law. Continued use of our services after such changes constitutes acceptance of the updated Policy.

Final provisions

This Privacy Policy is intended to meet the requirements of the GDPR and applies to all customers in the area. Where local data protection laws impose additional obligations, those will be respected in addition to this Policy.

By engaging with our services, you acknowledge that you have read and understood this Privacy Policy and the rights it describes.

Last updated: the date of publication of this Policy.