Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when services are provided to customers in the area. This policy applies to all customers in the area and is intended to comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Who We Are

For the purposes of data protection law, the organization providing the services acts as the data controller in relation to the personal data described in this Privacy Policy. This means we determine the purposes and means of processing personal data. Where third parties process personal data on our behalf, they act as data processors and are required to handle data only according to our instructions and applicable law.

2. Personal Data We Collect

We collect only the personal data that is necessary for legitimate business, legal, and operational purposes. Depending on how you interact with us, we may collect the following categories of information:

Identity data: name, title, and similar identifying details.
Contact data: address, email address, and telephone number.
Transaction data: information about services requested, purchased, or delivered.
Payment data: payment status and limited billing-related information, where applicable.
Communication data: correspondence, service requests, complaints, and feedback.
Technical data: device type, IP address, browser type, and related usage information.
Usage data: information about how services are accessed and used.
Preference data: communication preferences and service settings.

We do not intentionally collect special category data unless it is necessary and permitted by law. Special category data includes information relating to health, ethnicity, religion, political opinions, trade union membership, genetic data, biometric data, or sexual orientation. If such data is ever required, it will be processed only where a valid lawful basis exists and additional safeguards are in place.

3. How We Use Personal Data

We use personal data only for specific, explicit, and legitimate purposes. These purposes may include:

providing and managing our services;
processing orders, requests, and payments;
communicating with customers about service updates, support, and administrative matters;
maintaining records and managing accounts;
improving service quality, performance, and customer experience;
protecting against fraud, misuse, security incidents, and unlawful activity;
meeting legal, regulatory, tax, accounting, and reporting obligations;
handling complaints, disputes, and claims;
where permitted, sending relevant service information or marketing communications.

We apply data minimisation principles and process only what is adequate, relevant, and limited to what is necessary for the stated purpose.

4. Lawful Basis for Processing

Under GDPR, we must have a valid lawful basis for every processing activity. We rely on one or more of the following lawful bases:

Contract: where processing is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract.
Legal obligation: where processing is required to comply with applicable legal or regulatory obligations.
Legitimate interests: where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms.
Consent: where you have given clear and informed consent for a specific purpose, such as certain marketing activities or optional processing.
Vital interests: in rare cases where processing is necessary to protect someone’s life.
Public task: where processing is necessary for a task carried out in the public interest or in the exercise of official authority, if applicable.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

5. Sharing and Processors

We may share personal data with trusted third parties only when necessary and lawful. These may include:

service providers that support operations, such as IT hosting, data storage, analytics, communications, and payment-related services;
professional advisers, including legal, accounting, auditing, and insurance advisers;
regulators, law enforcement authorities, courts, or other public bodies where required by law;
business partners or contractors involved in service delivery, where relevant and subject to appropriate safeguards.

Where third parties process personal data on our behalf, they are bound by contract to act as processors and to:

process data only on our documented instructions;
keep data confidential and secure;
implement appropriate technical and organisational security measures;
assist us in meeting GDPR obligations where required;
delete or return personal data when processing ends, unless retention is legally required.

We do not sell personal data. If personal data is transferred outside the European Economic Area, appropriate safeguards will be used, such as standard contractual clauses or other lawful transfer mechanisms, to protect your rights.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, reporting, or dispute-resolution requirements. Retention periods depend on the nature of the data and the purpose of processing.

In general:

Customer and contract records are retained for the duration of the relationship and for a further period as required by law.
Financial and tax records are retained for periods required by applicable accounting and tax laws.
Communication records are retained as long as needed to manage enquiries, complaints, or service issues.
Security and technical logs are retained for a limited time to support system integrity and incident investigation.

When data is no longer required, it will be securely deleted, anonymised, or otherwise disposed of in accordance with our retention procedures.

7. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, unlawful use, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff training, monitoring, and regular review of security practices.

While no system can be guaranteed to be completely secure, we take reasonable and proportionate steps to reduce risk and to respond appropriately to any suspected personal data incident.

8. Your Rights Under GDPR

You have several rights regarding your personal data. These rights may be exercised free of charge, subject to legal limitations and verification of identity where necessary.

Right of access: to obtain confirmation of whether we process your personal data and to request a copy of it.
Right to rectification: to request correction of inaccurate or incomplete personal data.
Right to erasure: to request deletion of personal data in certain circumstances.
Right to restriction: to request that processing be limited in certain situations.
Right to data portability: to receive data you provided to us in a structured, commonly used, machine-readable format and, where feasible, have it transferred to another controller.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time.
Right not to be subject to automated decision-making: to avoid decisions made solely by automated processing, including profiling, where those decisions have legal or similarly significant effects, unless permitted by law.

You also have the right to lodge a complaint with the relevant data protection authority if you believe your rights have been infringed. We encourage you to raise concerns first so that we can address them promptly and fairly.

9. Children's Data

Our services are not intended for children unless otherwise stated. We do not knowingly collect personal data from children without appropriate legal basis and, where required, parental or guardian consent. If we become aware that personal data has been collected from a child in breach of this policy, we will take appropriate steps to delete it or secure the correct authorisation.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, our processing practices, or operational needs. Any updates will take effect when published or otherwise communicated as appropriate. We encourage customers in the area to review this policy periodically to stay informed about how personal data is protected.

Summary of Key Commitments

We collect only necessary personal data, process it under a valid GDPR lawful basis, share it only with controlled processors or legal recipients, retain it for limited periods, and respect your data subject rights. This policy applies to all customers in the area and is designed to ensure transparent and lawful handling of personal data.