Privacy Policy - .

Introduction. This Privacy Policy explains how we collect, use, disclose, retain and protect personal data for the services we provide. This policy applies to all customers in the area and governs the processing of personal data in accordance with the General Data Protection Regulation (GDPR). The terms "we", "us", and "our" refer to the data controller responsible for determining the purposes and means of processing personal data.

1. Information We Collect

We collect personal data necessary to deliver services, meet legal obligations, manage relationships, and improve user experience. Categories of data we may collect include:

Identity and account data: name, username, account identifiers, date of birth (where required).
Contact data: email, postal address, telephone numbers.
Transaction and service data: purchase history, service usage, billing and payment details, order information.
Technical and device data: IP address, device identifiers, browser type and settings, operating system, log files, cookie identifiers.
Usage data: interactions with our services, pages viewed, time spent, preferences and settings.
Marketing and communications data: communications preferences and responses to promotions.
Sensitive personal data: we do not generally process special categories of personal data (such as health, race, religion) unless you provide them voluntarily and we have a lawful basis, including explicit consent, to process them.

2. Sources of Personal Data

We obtain personal data directly from you when you register, subscribe, contact support, make payments, or otherwise interact with our services. We may also receive data from third parties such as payment processors, service providers, publicly available sources, or with your prior authorisation from social media providers. We only combine and use such data where permitted by law.

Data Minimization

We limit collection to what is adequate, relevant and proportionate to the purposes for which it is processed. Where possible, we use aggregated or anonymized data that does not identify you.

3. Lawful Bases for Processing

Under the GDPR, we rely on one or more lawful bases to process personal data. The principal bases we rely on are:

Performance of a contract: processing necessary to perform a contract or to take steps at your request prior to entering into a contract (for example, to provide services, process orders, or manage accounts).
Legal obligation: processing necessary to comply with statutory obligations, regulatory requirements, tax or audit obligations, or to respond to lawful requests by public authorities.
Consent: where required (for example, for certain marketing communications or processing special category data), we will request your freely given, specific and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Legitimate interests: where processing is necessary for legitimate interests pursued by us or a third party, except where such interests are overridden by your fundamental rights and freedoms. Examples include fraud prevention, direct marketing (where permitted), network and information security, and improving services.

4. Use and Purposes of Processing

We process personal data for the following purposes:

To provide, operate and maintain our services;
To manage accounts, including authentication, billing and customer support;
To process payments and fulfill orders;
To comply with legal and regulatory obligations;
To prevent, detect and respond to fraud, security incidents and abuse;
To communicate about updates, service changes and important notices;
To send marketing communications where you have consented or where we rely on legitimate interests and you have not objected;
To analyze usage and improve our products, services and user experience through aggregated analytics.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to meet legal and regulatory obligations, to resolve disputes and enforce our agreements, or where retention is otherwise permitted by law. Factors used to determine retention periods include:

the nature and sensitivity of the data;
the purposes for which the data was collected;
legal and contractual requirements (for example, tax, accounting and consumer protection laws);
the statute of limitations for legal claims.

When retention periods expire, personal data is either securely deleted, anonymized or archived in a manner that restricts access and use.

6. Processors and Third Parties

We engage trusted third-party service providers (processors) to perform functions on our behalf such as payment processing, hosting, analytics, customer support, marketing, and communications. We ensure:

processors are selected carefully and contractually required to implement appropriate technical and organisational measures to protect personal data;
processing is limited to what is necessary for the contracted purpose;
where data is transferred outside the European Economic Area, we use legal transfer mechanisms such as Standard Contractual Clauses or other lawful safeguards permitted under the GDPR.

We do not sell personal data. Any disclosure to regulators, public authorities or other third parties is performed only when required by law or to protect our legal rights.

7. Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Measures include encryption, access controls, secure development practices, staff training, and incident response procedures. However, no method of transmission or storage is completely secure and we cannot guarantee absolute security.

8. Your Rights

The GDPR grants you a set of rights regarding your personal data. These rights may be exercised in accordance with applicable law and subject to required verifications and limitations. Your rights include:

Right of access: obtain confirmation of whether we process your personal data and request a copy of that data.
Right to rectification: correct inaccurate or incomplete personal data.
Right to erasure (right to be forgotten): request deletion of personal data where there is no overriding lawful basis for retention.
Right to restriction of processing: request limitation of processing when accuracy is contested, processing is unlawful, or when data is no longer needed but you require it for legal claims.
Right to data portability: receive personal data you provided in a structured, commonly used and machine-readable format and transmit it to another controller where technically feasible.
Right to object: object to processing based on legitimate interests or direct marketing.
Rights related to automated decision-making: where applicable, challenge automated decision-making and profiling that produces legal effects concerning you.
Right to withdraw consent: where processing is based on consent, withdraw consent at any time without affecting prior lawful processing.
Right to lodge a complaint: you have the right to lodge a complaint with a competent supervisory authority if you believe your rights under the GDPR have been infringed.

Exercising Your Rights

You may exercise these rights through the channels made available to you when you registered or through your account settings and authorised representatives. We will respond to verified requests within statutory timeframes. We may ask for additional information to confirm your identity before actioning requests to protect the security of your data.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal obligations, or marketplace expectations. Material changes will be communicated in appropriate ways in advance where required by law. Continued use of our services after changes take effect constitutes acceptance of the revised policy.

10. Additional Information

Third-party links and social features may be present in our services. We are not responsible for the privacy practices of third parties. Please review their privacy policies before providing personal information. We encourage you to remain informed about your privacy rights and the choices available to you.

Conclusion

Summary: This Privacy Policy explains how we collect, process and protect personal data for all customers in the area in compliance with the GDPR. It describes lawful bases for processing, categories of data collected, retention practices, use of processors, security measures and the rights available to data subjects. Please review this policy periodically for updates.