Privacy Policy

This Privacy Policy explains how we collect, use, share, retain, and protect personal data when you use our services. It applies to all customers in the area and is intended to comply with applicable data protection laws, including the General Data Protection Regulation (GDPR). By using our services, you acknowledge that your personal data may be processed as described in this Policy.

1. Data We Collect

We collect only the personal data that is necessary for the purposes described in this Policy. Depending on how you interact with us, this may include:

• Identity data: name, title, username, and similar identifiers.
• Contact data: billing address, delivery address, email address, and telephone number.
• Transaction data: details of products or services purchased, payment status, invoices, and order history.
• Technical data: internet protocol (IP) address, browser type, device identifiers, operating system, and usage logs.
• Communication data: information contained in messages, requests, feedback, complaints, or survey responses.
• Preference data: choices relating to marketing, service settings, and communication preferences.

We do not intentionally collect sensitive personal data unless it is strictly necessary for a lawful purpose and you choose to provide it or we are otherwise permitted to process it under applicable law.

2. How We Use Personal Data

We process personal data for the following purposes:

• to provide and manage our services;
• to process orders, payments, and related administrative tasks;
• to communicate with you about service-related matters;
• to improve service quality, functionality, and user experience;
• to maintain security, prevent fraud, and detect misuse;
• to meet legal, regulatory, tax, and accounting obligations;
• to send marketing communications where permitted and where you have not opted out;
• to establish, exercise, or defend legal claims.

We apply the principle of data minimisation and collect only what is relevant and adequate for the intended purpose.

3. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for each processing activity. We rely on the following lawful bases where appropriate:

Performance of a Contract

We process personal data when it is necessary to enter into or perform a contract with you, such as fulfilling orders, providing services, and managing payments.

Legal Obligation

We may process personal data to comply with legal requirements, including accounting, tax, anti-fraud, and record-keeping obligations.

Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Examples include improving services, ensuring network and information security, preventing fraud, and managing internal administration.

Consent

Where required, we rely on your consent, for example for certain marketing communications or optional cookies and similar technologies. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Vital Interests and Public Interest

In limited cases, we may process data to protect vital interests or where processing is necessary for tasks carried out in the public interest, if applicable.

4. Sharing and Processors

We may share personal data with trusted third parties where necessary for the purposes described in this Policy. These third parties act as processors or, in some cases, as independent controllers. We require appropriate contractual and security safeguards before any sharing takes place.

Processors may include:

• Payment service providers for secure payment processing;
• IT and hosting providers for data storage, system maintenance, and infrastructure support;
• Customer support tools used to handle service requests and correspondence;
• Analytics providers that help us understand service performance and usage patterns;
• Professional advisers such as legal, accounting, or audit professionals;
• Delivery and logistics partners where relevant to order fulfilment;
• Authorities or regulators where disclosure is required by law.

We do not allow processors to use personal data for their own purposes. They may only process data on our documented instructions and must implement appropriate technical and organisational measures to protect it.

5. International Transfers

Where personal data is transferred outside the European Economic Area, we ensure that appropriate safeguards are in place, such as standard contractual clauses or equivalent legal mechanisms, to protect your data in accordance with GDPR requirements.

6. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, reporting, and dispute-resolution requirements. The exact retention period depends on the type of data and the context in which it was collected.

In general:

• Contract and transaction data are retained for the duration of the customer relationship and for the period required by applicable tax and commercial laws.
• Communication records may be kept for a reasonable period to manage follow-up, quality assurance, or legal defence.
• Marketing preferences are retained until you change your preference or withdraw consent.
• Technical logs are retained for security, troubleshooting, and service integrity purposes for a limited time.

When personal data is no longer required, we will delete, anonymise, or securely archive it in accordance with applicable retention standards.

7. Data Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures may include access controls, encryption, role-based permissions, secure storage, staff training, and regular security reviews. While no system is entirely secure, we work to maintain a level of protection appropriate to the risk.

8. Your Rights Under GDPR

Depending on the circumstances and subject to applicable exemptions, you have the following rights in relation to your personal data:

• Right of access: to obtain confirmation and a copy of your personal data.
• Right to rectification: to correct inaccurate or incomplete data.
• Right to erasure: to request deletion of your data in certain cases.
• Right to restriction: to limit how we process your data in certain circumstances.
• Right to data portability: to receive data you provided in a structured, commonly used format and, where feasible, have it transferred to another controller.
• Right to object: to object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent: where processing is based on consent, at any time.
• Right not to be subject to automated decision-making: including profiling, where such decisions produce legal or similarly significant effects, unless permitted by law.

Important: exercising these rights may be subject to verification of your identity and may be limited where the law permits or requires us to retain the data.

9. How We Respond to Requests

We will respond to valid data protection requests without undue delay and within the time limits required by GDPR. If a request is complex or if we receive multiple requests, the response period may be extended as allowed by law. We may ask for additional information to verify your identity and protect your privacy.

10. Children’s Data

Our services are not intended for children unless explicitly stated otherwise. We do not knowingly collect personal data from children without appropriate authorisation where required. If we become aware that data has been collected inappropriately, we will take steps to delete it promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any revised version will apply from the date it becomes effective. We encourage you to review this Policy periodically so that you remain informed about how we process personal data.

12. General Principles

We are committed to processing personal data fairly, lawfully, and transparently. Our approach is guided by the principles of purpose limitation, accuracy, storage limitation, integrity, confidentiality, and accountability. We aim to ensure that personal data is used responsibly and only for legitimate business and legal purposes.

By using our services, you confirm that you have read and understood this Privacy Policy. This Policy applies to all customers in the area and governs our processing of personal data in connection with those services.