Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when services are provided to customers in the area. This policy applies to all customers in area and is intended to meet the requirements of the General Data Protection Regulation (GDPR) and related data protection laws. Please read this policy carefully to understand your rights and how personal information is handled.

1. Data We Collect

We may collect and process different types of personal data depending on how a person interacts with our services. The categories of data may include:

• Identity data: name, username, or similar identifiers.
• Contact data: address, email address, and telephone number where necessary for service delivery.
• Transaction data: details of services requested, purchased, or received.
• Technical data: IP address, browser type, device identifiers, and usage information.
• Communication data: records of messages, requests, or feedback provided through support or service channels.
• Preference data: marketing choices, service settings, and consent records.

We only collect personal data that is relevant and limited to what is necessary for the purposes described in this policy. Where possible, data is collected directly from the individual. In some cases, data may be collected from third parties, service providers, or publicly available sources when permitted by law.

2. How We Use Personal Data

Personal data is used for lawful, fair, and transparent purposes. These purposes may include:

• providing and managing services;
• processing requests and transactions;
• maintaining records and accounts;
• responding to enquiries and support requests;
• improving service quality, security, and user experience;
• complying with legal obligations;
• detecting, preventing, and investigating fraud or misuse;
• sending updates or communications where permitted by law.

We will not use personal data for purposes that are incompatible with the original purpose of collection unless we have a lawful basis to do so and, where required, have informed the data subject.

3. Lawful Basis for Processing

Under GDPR, personal data must be processed on a valid legal basis. Depending on the situation, we rely on one or more of the following lawful bases:

3.1 Contract

Processing may be necessary to perform a contract with a customer or to take steps before entering into a contract. This includes using data to deliver requested services, manage accounts, and complete transactions.

3.2 Legal Obligation

Some processing is required to comply with legal or regulatory obligations, including tax, accounting, record-keeping, and other compliance duties.

3.3 Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or the legitimate interests of a third party, provided those interests are not overridden by the rights and freedoms of the individual. Examples include fraud prevention, service improvement, network security, and internal administration. When relying on this basis, we consider the nature of the data, the context of processing, and the potential impact on the individual.

3.4 Consent

Where required by law, we rely on consent for specific processing activities. Consent must be freely given, informed, specific, and unambiguous. Individuals may withdraw consent at any time, and this will not affect the lawfulness of processing carried out before withdrawal.

3.5 Vital Interests and Public Interest

In limited situations, processing may be necessary to protect vital interests or to carry out tasks in the public interest where permitted by law. These bases will only be used when appropriate and applicable.

4. Data Sharing and Processors

We may share personal data with trusted third parties where necessary to operate our services, comply with legal duties, or protect our rights. Such recipients may act as processors or independent controllers, depending on the relationship and purpose of processing.

Processors are third parties that process personal data on our instructions and are contractually required to protect it and use it only for specified purposes. Examples may include:

• hosting and infrastructure providers;
• payment service providers;
• customer support platforms;
• analytics and performance monitoring tools;
• document storage and backup providers;
• IT security and maintenance providers;
• professional advisers, where appropriate.

Where personal data is shared with independent third parties, they will be responsible for their own compliance with data protection laws. We require appropriate contractual safeguards, including data processing agreements where needed, to ensure personal data is handled securely and lawfully.

We do not sell personal data. Any sharing is limited to what is necessary and proportionate for the stated purposes.

5. International Transfers

If personal data is transferred outside the European Economic Area or the United Kingdom, we will ensure that appropriate safeguards are in place. These safeguards may include adequacy decisions, Standard Contractual Clauses, or other legally recognized transfer mechanisms. We will take reasonable steps to ensure that transferred data receives a level of protection consistent with GDPR requirements.

6. Data Retention

We keep personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, reporting, or dispute resolution requirements. Retention periods depend on the type of data, the purpose of processing, and any legal obligations that apply.

In practice, this means:

• data used for service delivery is retained for the duration of the relationship and for a reasonable period afterward;
• financial and tax records are retained for the period required by law;
• communications and support records are retained as needed to resolve issues and maintain accurate records;
• consent records are retained to demonstrate compliance with GDPR.

When personal data is no longer required, it will be securely deleted, anonymized, or otherwise disposed of in accordance with applicable procedures. Retention is reviewed periodically to ensure that data is not kept longer than necessary.

7. Data Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff training, monitoring, and regular review of security practices.

While no system can be guaranteed to be completely secure, we aim to maintain a level of security appropriate to the risks associated with the processing of personal data. If a data breach occurs that is likely to result in a risk to individuals, we will take steps required by law, which may include notifying the relevant supervisory authority and affected individuals.

8. User Rights Under GDPR

Individuals whose personal data is processed under this policy have the following rights, subject to legal exceptions and conditions:

• Right of access: to request confirmation of whether personal data is being processed and to obtain a copy of that data.
• Right to rectification: to request correction of inaccurate or incomplete personal data.
• Right to erasure: to request deletion of personal data in certain circumstances.
• Right to restriction: to request limited processing of personal data in certain situations.
• Right to data portability: to receive personal data in a structured, commonly used, machine-readable format and to request transfer where applicable.
• Right to object: to object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent: where processing is based on consent, this may be withdrawn at any time.
• Right to lodge a complaint: to raise concerns with a supervisory authority if the individual believes data protection laws have been violated.

Where a request is made, we may need to verify identity before responding. We will respond without undue delay and within the time limits set by law.

9. Automated Decision-Making

We do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects unless this is permitted by law and appropriate safeguards are in place. If such processing is used, individuals will be informed and given relevant rights and options as required.

10. Children’s Data

Our services are not intended for children unless expressly stated otherwise. We do not knowingly collect personal data from children without the required legal basis and, where applicable, parental or guardian consent. If we become aware that data has been collected inappropriately, we will take steps to delete it promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service developments. Any updated version will apply from the date it takes effect. Individuals should review this policy periodically to stay informed about how personal data is handled.

12. Final Statement

This Privacy Policy is designed to ensure that personal data is processed in a lawful, transparent, and secure manner. It reflects our commitment to respecting privacy rights and meeting GDPR obligations for all customers in area. By continuing to use our services, individuals acknowledge that their data may be processed as described in this policy, subject always to applicable law and the rights granted to them under GDPR.