Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected when services are provided to customers in the relevant area. It applies to all customers in that area and is intended to describe our practices in a clear and transparent way. We are committed to handling personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

For the purposes of this policy, personal data means any information relating to an identified or identifiable person. This may include names, contact details, account details, transaction records, technical identifiers, and any other information that can directly or indirectly identify an individual.

1. Data We Collect

We collect only the personal data that is necessary for the purposes described in this policy. Depending on how you interact with us, we may collect the following categories of information:

Identity data, such as your name, username, or similar identifiers.
Contact data, such as address details or other communication-related information.
Account and profile data, such as preferences, settings, or records associated with your use of services.
Transaction data, including details of services requested, purchases, payments, or related records.
Technical data, such as device information, browser type, IP address, and log data.
Usage data, showing how you access and use services.
Correspondence data, such as messages, enquiries, complaints, or feedback.

We do not intentionally collect special category data unless required by law or where you have provided it for a specific and lawful purpose. Special category data may include information about health, biometrics, religion, political opinions, or other sensitive matters. Where such information is processed, we apply stricter safeguards and only do so when permitted under data protection law.

2. How We Use Personal Data

Personal data is used for legitimate operational, legal, and service-related purposes. These purposes may include:

Providing and managing services.
Processing requests, transactions, and communications.
Maintaining records and ensuring service quality.
Improving products, systems, and customer experience.
Protecting against fraud, misuse, and security incidents.
Complying with legal, regulatory, and contractual obligations.
Administering internal business functions, including audits and reporting.

We only process personal data where we have a valid lawful basis under GDPR. The lawful basis depends on the specific purpose of processing and the context in which the information is collected.

3. Lawful Basis for Processing

We rely on one or more of the following lawful bases:

3.1 Performance of a Contract

We process personal data where it is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract. This may include managing accounts, delivering services, or handling payments and related support.

3.2 Legal Obligation

We may process personal data where required to comply with applicable laws, regulations, court orders, or lawful requests from public authorities. This may include recordkeeping, tax-related duties, and regulatory compliance.

3.3 Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Legitimate interests may include service improvement, fraud prevention, information security, internal administration, and business continuity. Where we rely on this basis, we assess whether the processing is necessary and proportionate.

3.4 Consent

In some cases, we may rely on your consent. Where consent is the lawful basis, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

3.5 Vital Interests and Public Interest

In limited circumstances, processing may be necessary to protect someone’s vital interests or to carry out tasks in the public interest, where permitted by law.

4. Sharing and Processors

We may share personal data with trusted third parties acting as data processors or, in certain cases, as independent controllers. Processors act only on our documented instructions and are contractually required to protect personal data and comply with GDPR standards.

Categories of processors may include:

IT and hosting providers
Payment and transaction service providers
Customer support and communications platforms
Analytics and performance monitoring services
Security and fraud prevention providers
Professional advisers and auditors

We may also disclose personal data where required by law, to defend legal claims, to protect the rights and safety of individuals, or to prevent fraudulent or unlawful activity. Where a third party acts as an independent controller, that party determines its own purposes and means of processing, and its own privacy obligations apply.

We do not sell personal data in exchange for money. Any sharing is limited to what is necessary for the purposes described in this policy.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting, tax, or reporting obligations. Retention periods vary depending on the nature of the data and the reasons for processing.

When deciding how long to keep data, we consider:

The amount, nature, and sensitivity of the data.
The potential risk of harm from unauthorised use or disclosure.
The purposes for which we process the data.
Applicable legal and regulatory retention requirements.
Whether the data is needed to establish, exercise, or defend legal claims.

Once personal data is no longer required, it will be securely deleted, anonymised, or otherwise disposed of in accordance with our retention procedures. Retention rules are reviewed periodically to ensure that data is not kept longer than necessary.

6. International Transfers

If personal data is transferred outside the jurisdiction in which it was collected, we will ensure that appropriate safeguards are in place where required by law. These safeguards may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms. Any transfer is carried out only where appropriate protections are available.

7. Security Measures

We use reasonable technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration, or disclosure. Such measures may include access controls, encryption where appropriate, secure storage, staff confidentiality obligations, and regular review of security processes. No method of transmission or storage is completely secure, but we work to reduce risks to an appropriate level.

8. Your Rights Under GDPR

Depending on the legal basis and the circumstances of processing, you may have the following rights:

Right of access – to obtain confirmation of whether your personal data is processed and to receive a copy of that data.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of your data in certain situations.
Right to restriction – to request limited processing in certain cases.
Right to data portability – to receive your data in a structured, commonly used, machine-readable format where applicable.
Right to object – to object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent – where processing is based on consent.
Right not to be subject to automated decision-making – including profiling, where such decisions produce legal or similarly significant effects, unless permitted by law.

Strong safeguards are applied when handling rights requests, and we will respond in accordance with GDPR time limits unless an extension is lawfully permitted. To protect privacy, we may need to verify identity before acting on a request.

9. Children’s Data

Our services are not intended for children unless otherwise permitted by law. Where the processing of a child’s personal data is lawful, it will be done only with appropriate safeguards and in accordance with applicable requirements.

10. Automated Decisions and Profiling

Where we use automated tools or profiling, we will do so only where permitted by law and with appropriate transparency. If such processing has legal or similarly significant effects, you have rights to request human intervention, express your point of view, and challenge the decision.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service arrangements. Any updates will take effect when published or otherwise communicated in an appropriate manner. We encourage customers to review this policy periodically to stay informed about how personal data is handled.

12. General Statement

This Privacy Policy applies to all customers in the relevant area and governs the processing of personal data associated with the provision of services there. By using the services, you acknowledge that your information may be processed in the ways described above, subject always to applicable data protection law. We are committed to treating personal data fairly, lawfully, and transparently, and to respecting the rights of every individual whose data we process.