Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in area and should be read carefully together with any relevant terms and conditions. We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

By using our services, you acknowledge that you have read and understood this Privacy Policy. Where required, we will provide additional notices at the point of data collection so that you have clear information about how your personal data will be processed.

1. Data We Collect

We collect only the personal data necessary for defined and legitimate purposes. Depending on how you interact with us, we may collect the following categories of information:

Identity data such as your name, title, and similar identifiers.
Contact data such as your address, email address, and telephone number.
Transaction data relating to products or services you purchase, request, or receive.
Account data such as login details, preferences, and service settings.
Communication data including correspondence and records of your enquiries or feedback.
Technical data such as device type, browser type, IP address, and usage logs.
Usage data describing how you access and use our services.
Marketing data including your preferences for receiving promotional communications.

We may collect this data directly from you, automatically when you use our services, or from third parties where lawful and appropriate. We do not knowingly collect more personal data than is necessary for the purposes described in this Policy.

2. How We Use Personal Data

We use personal data for the following purposes:

To provide, maintain, and improve our services.
To process requests, transactions, and payments.
To manage our relationship with customers and respond to enquiries.
To administer accounts and verify identity where necessary.
To monitor, analyse, and enhance service performance and security.
To comply with legal and regulatory obligations.
To send administrative messages, service notices, and, where permitted, marketing communications.
To protect our rights, users, systems, and property against fraud, misuse, or unlawful activity.

Personal data is processed only for specified, explicit, and legitimate purposes. If we intend to use data for a new purpose that is not compatible with the original purpose, we will ensure that a lawful basis exists and, where required, inform you accordingly.

3. Lawful Basis for Processing

Under GDPR, we must have a lawful basis to process personal data. Depending on the context, we may rely on one or more of the following legal bases:

a. Performance of a Contract

We process data when it is necessary to enter into or perform a contract with you, such as delivering services, managing payments, or fulfilling requests.

b. Legal Obligation

We process data where necessary to comply with legal duties, including tax, accounting, consumer protection, or regulatory requirements.

c. Legitimate Interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. This may include service improvement, fraud prevention, network security, and internal administration.

d. Consent

Where required by law, we rely on your consent, for example for certain types of marketing or optional cookies. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

e. Vital Interests

In rare cases, we may process data to protect someone’s vital interests, such as in an emergency.

We assess the lawful basis for each processing activity and keep records supporting that assessment.

4. Data Sharing and Processors

We may share personal data with trusted third parties that assist us in delivering our services. These third parties act either as independent controllers or as processors acting on our instructions. We only use processors that provide sufficient guarantees regarding data protection and security.

Examples of processors may include:

Payment processors that handle secure transactions.
IT and hosting providers that store or support our systems.
Customer support tools that help manage communications.
Analytics providers that assist in measuring usage and improving services.
Security and fraud prevention providers that help detect suspicious activity.
Professional advisers such as auditors, insurers, or legal advisers, where necessary.

When processors are used, we require appropriate contractual safeguards, including data processing agreements that set out the subject matter, duration, nature, and purpose of processing, the type of personal data, the categories of data subjects, and the obligations and rights of the controller. Processors are not permitted to use personal data for their own unrelated purposes.

We may also disclose personal data where required by law, court order, regulatory request, or to protect rights, safety, and security. Where permitted, we will ensure such disclosures are limited to what is necessary.

5. International Transfers

If personal data is transferred outside the European Economic Area or the United Kingdom, we will ensure that appropriate safeguards are in place. These may include adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms. Any transfer will be conducted in a manner that protects your data to a standard consistent with GDPR requirements.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. Retention periods may vary depending on the nature of the data and the purpose of processing.

Data used to provide services may be retained for the duration of the relationship and for a reasonable period afterward.
Transaction and financial records may be retained for the period required by applicable law.
Security logs and technical records may be retained for a limited period necessary for monitoring and protection.
Marketing data is retained until you opt out, withdraw consent, or we determine it is no longer needed.

When personal data is no longer needed, we will securely delete it or anonymise it so that it can no longer identify you. Retention is periodically reviewed to ensure data is not kept longer than necessary.

7. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental loss, destruction, unauthorised access, disclosure, alteration, or misuse. These measures may include access controls, encryption where appropriate, monitoring, staff training, and secure storage practices.

While no system can be guaranteed completely secure, we work continuously to maintain a level of protection appropriate to the risk. If a personal data breach occurs and we are required to do so by law, we will take the necessary steps to investigate, mitigate, and notify affected individuals and regulators as appropriate.

8. Your Rights Under GDPR

Depending on the circumstances and applicable law, you have the following rights in relation to your personal data:

Right of access – to obtain confirmation about whether we process your data and receive a copy of it.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of data in certain circumstances.
Right to restriction – to request limited processing in certain situations.
Right to data portability – to receive data in a structured, commonly used, machine-readable format where applicable.
Right to object – to object to processing based on legitimate interests or to direct marketing at any time.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.
Right to lodge a complaint – to raise concerns with the relevant data protection authority.

We may need to verify your identity before responding to a request. We will respond within the time limits required by law and will not charge a fee unless the request is manifestly unfounded or excessive.

9. Children’s Data

Our services are not intended for children unless stated otherwise. We do not knowingly collect personal data from children without the appropriate legal basis and, where necessary, verifiable parental consent. If we become aware that personal data has been collected inappropriately, we will take reasonable steps to delete it.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any updated version will apply from the date it is made available. We encourage you to review this Policy periodically to stay informed about how we process personal data.

Privacy and data protection are central to our approach. We are committed to processing personal data responsibly, transparently, and in a way that respects your rights and freedoms.