Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with the services provided to all customers in area. It is designed to reflect key requirements under the General Data Protection Regulation (GDPR) and to provide clear information about the rights and choices available to individuals whose data is processed.

1. Scope of This Policy

This policy applies to all customers in area and to any individual whose personal data is processed in the course of providing services, managing accounts, delivering support, maintaining records, or meeting legal and operational obligations. It applies regardless of the channel through which data is collected, including information provided directly by the individual, generated through service use, or obtained from authorized third parties.

By using the services or otherwise engaging with the processing activities described here, individuals should understand how their personal data is handled.

2. Personal Data We Collect

We collect only the personal data necessary for specified and legitimate purposes. The categories of data collected may include:

Identity data: name, username, or similar identifiers.
Contact data: email address, phone number, billing address, or service address.
Account data: account preferences, service selections, and account history.
Transaction data: records of purchases, payments, invoices, and service usage.
Technical data: device information, browser type, IP address, and system logs.
Communication data: correspondence and feedback sent in relation to services, inquiries, or complaints.
Usage data: information about how services are accessed and interacted with.

We do not intentionally collect special category data unless it is necessary, lawful, and supported by an appropriate legal basis. Where special category data is processed, additional safeguards are applied in line with GDPR requirements.

3. Purposes of Processing

Personal data is processed for the following purposes:

to provide and administer services;
to manage customer accounts and records;
to process transactions and fulfill obligations arising from services;
to respond to enquiries, requests, and complaints;
to improve service quality, security, and performance;
to comply with legal, regulatory, tax, and accounting obligations;
to detect, prevent, and investigate fraud, misuse, or security incidents;
to maintain internal business operations, auditing, and reporting;
to exercise or defend legal claims when necessary.

Personal data is not processed for purposes that are incompatible with the original reason for collection without a valid legal basis and, where required, further notice.

4. Lawful Basis for Processing

We process personal data only where a lawful basis under GDPR applies. Depending on the circumstances, the lawful basis may be one or more of the following:

Contract

Processing is necessary to enter into or perform a contract with the customer, including managing accounts, delivering services, and handling payments.

Legal Obligation

Processing is necessary to comply with applicable legal or regulatory obligations, including record-keeping, tax, accounting, fraud prevention, and lawful disclosure requirements.

Legitimate Interests

Processing may be based on legitimate interests where those interests are not overridden by the rights and freedoms of the individual. Examples include service improvement, administrative management, security monitoring, and business reporting.

Consent

Where required by law, certain processing activities rely on consent. When consent is used, it is given freely, is specific, informed, and unambiguous. Individuals may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Vital Interests and Public Interest

In limited situations, processing may be necessary to protect vital interests or to carry out tasks in the public interest, where applicable and lawful.

5. Sharing and Processors

Personal data may be shared with trusted third-party service providers acting as processors on our behalf. These processors are engaged only where necessary and are required by contract to process personal data in accordance with GDPR obligations, confidentiality requirements, security measures, and documented instructions.

Examples of processor categories may include:

IT and hosting providers that store or support technical infrastructure;
payment processors that handle secure transaction processing;
administrative and customer support providers that help manage service requests;
analytics or monitoring providers that assist with performance and security;
professional advisers such as legal, auditing, or accounting providers where necessary.

Where processors are used, they are selected with due care and are required to implement appropriate technical and organizational measures. Personal data may also be disclosed to public authorities, regulators, courts, or other parties where required by law or where needed to establish, exercise, or defend legal rights.

We do not sell personal data.

6. International Transfers

If personal data is transferred outside the European Economic Area or another jurisdiction with equivalent protection, such transfers will be carried out only where appropriate safeguards are in place. These safeguards may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms recognized under GDPR. Additional assessments may be performed where necessary to ensure that transferred data remains protected.

7. Data Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, regulatory, and dispute-resolution requirements. Retention periods depend on the type of data, the purpose of processing, and any legal retention duties.

When determining retention periods, we consider:

the nature and sensitivity of the data;
the purpose for which it was collected;
the risk of harm from unauthorized use or disclosure;
legal or contractual obligations;
the necessity of retaining records for claims or audits.

Once data is no longer required, it will be securely deleted, anonymized, or archived in a form that no longer identifies individuals, where appropriate.

8. Security Measures

Appropriate technical and organizational measures are used to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption where appropriate, secure storage, staff confidentiality obligations, monitoring, and regular review of security practices.

While no system can guarantee absolute security, reasonable steps are taken to reduce risk and maintain a high standard of protection.

9. Data Minimization and Accuracy

We aim to collect only the data that is relevant and necessary for the stated purposes. Individuals are encouraged to keep their information accurate and up to date. Reasonable steps may be taken to correct or update data when inaccuracies are identified or when updates are requested and verified.

10. User Rights Under GDPR

Individuals whose data is processed may have the following rights, subject to conditions and limitations under GDPR:

Right of access: to obtain confirmation and a copy of personal data held about them.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request limited processing in certain situations.
Right to data portability: to receive certain data in a structured, commonly used, machine-readable format and, where applicable, to transmit it to another controller.
Right to object: to object to processing based on legitimate interests or direct marketing, where applicable.
Right to withdraw consent: to withdraw consent at any time where processing is based on consent.
Right not to be subject to automated decision-making: to request information about any solely automated decisions that have legal or similarly significant effects, where such decisions apply.

Requests will be handled in accordance with GDPR and applicable law. Verification may be required before any request is fulfilled, to protect the privacy and security of all customers in area.

11. Exercising Rights and Complaints

Individuals may exercise their rights by making a request through the appropriate administrative process. Responses will be provided within the time limits required by law, subject to lawful extensions where requests are complex or numerous. Where a request is declined, reasons will be provided where legally permitted.

Individuals also have the right to lodge a complaint with a relevant data protection supervisory authority if they believe their rights have been infringed. This right exists in addition to any other administrative or judicial remedy available under law.

12. Children’s Data

Services are not intended to be used for children where such use would require specific parental consent or other special protections, unless those requirements have been satisfied. If personal data relating to a child is processed, it will be handled in accordance with applicable legal requirements and with appropriate safeguards.

13. Policy Updates

This Privacy Policy may be updated from time to time to reflect changes in legal requirements, processing activities, service operations, or security practices. The most recent version will apply to all current processing activities. Material changes will be made available in a clear and accessible manner.

By continuing to use the services, customers acknowledge that they have read and understood this Privacy Policy as it applies to all customers in area.