Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected in connection with our services. It is designed to meet the requirements of the General Data Protection Regulation (GDPR) and applies to all customers in the area where the services are offered. By using the services, customers acknowledge that their personal data may be processed in accordance with this Policy.

1. Scope of This Policy

This Policy applies to personal data relating to identified or identifiable natural persons. It covers information collected when customers create an account, place an order, request support, communicate with us, or otherwise interact with the services. It also applies to data collected automatically through technical means when permitted by law.

Personal data means any information that can directly or indirectly identify a person. This may include names, contact details, account identifiers, payment-related information, and usage data. Special categories of personal data are not intentionally collected unless strictly necessary and lawful.

2. Data Collection

We may collect the following categories of data:

• Identity data: name, username, and similar identifiers.
• Contact data: billing address, delivery address, email address, and telephone number where applicable.
• Transaction data: details relating to purchases, returns, refunds, and service requests.
• Technical data: device type, operating system, browser type, IP address, log files, and other diagnostic information.
• Usage data: pages viewed, interactions, preferences, and service engagement information.
• Communication data: records of inquiries, complaints, feedback, and support interactions.

Data may be provided directly by customers, generated through service use, or received from authorized third parties where permitted. We only collect data that is relevant, limited, and necessary for the purposes described in this Policy.

3. Purposes of Processing

We process personal data for the following purposes:

• to provide and operate the services;
• to manage customer accounts and administrative functions;
• to process orders, payments, and related transactions;
• to respond to inquiries and provide customer support;
• to maintain security, prevent fraud, and detect misuse;
• to improve service performance, functionality, and user experience;
• to comply with legal and regulatory obligations;
• to establish, exercise, or defend legal claims where necessary.

Where processing is based on consent, customers may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

4. Lawful Basis for Processing

Under GDPR, personal data must be processed on a lawful basis. Depending on the activity, we rely on one or more of the following bases:

Performance of a Contract

We process personal data when it is necessary to perform a contract with a customer or to take steps at the customer’s request before entering into a contract. This may include account administration, service delivery, billing, and support.

Legal Obligation

We may process personal data where required to comply with applicable laws, regulations, tax rules, accounting obligations, or lawful requests from public authorities.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by the individual’s rights and freedoms. Legitimate interests may include service improvement, fraud prevention, network and information security, and internal record keeping. We always assess whether the processing is proportionate and limited.

Consent

We may rely on consent for certain optional processing activities. When consent is used as the lawful basis, it will be requested in a clear and informed manner. Customers have the right to withdraw consent at any time.

5. Data Sharing and Processors

We may share personal data with trusted third parties acting as processors on our behalf. These processors are permitted to process data only under our instructions and are required to implement appropriate technical and organizational safeguards.

Categories of processors may include:

• IT and hosting providers;
• payment service providers;
• customer support platforms;
• analytics and performance monitoring providers;
• security and fraud prevention services;
• accounting, audit, and legal service providers where necessary.

We may also disclose data to independent controllers where required by law or where necessary to protect rights, safety, or property. In such cases, the receiving party determines its own purposes and means of processing.

Where personal data is transferred outside the European Economic Area, appropriate safeguards will be applied, such as standard contractual clauses or equivalent legal mechanisms, to ensure a level of protection essentially equivalent to GDPR standards.

6. Retention of Personal Data

We keep personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, tax, dispute resolution, and security requirements. Retention periods depend on the type of data and the reason for processing.

In general:

• account and service data are retained for the duration of the relationship and for a reasonable period afterward;
• transaction records are retained for legally required periods;
• support communications are retained for as long as needed to resolve the issue and maintain records;
• technical logs are retained for limited periods unless longer retention is needed for security or legal reasons.

When data is no longer required, it is deleted, anonymized, or securely archived in accordance with applicable retention standards. Retention is always limited to what is necessary.

7. Data Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, alteration, or disclosure. These measures may include access controls, encryption, secure storage, staff confidentiality obligations, and regular review of security practices.

While we strive to protect all personal data, no system can be guaranteed completely secure. Where a personal data breach occurs and is likely to result in a risk to rights and freedoms, we will take appropriate steps in line with GDPR requirements, including notification where legally required.

8. User Rights

Customers have important rights regarding their personal data under GDPR. Subject to legal limits and verification requirements, these rights include:

• Right of access: to request confirmation and a copy of personal data being processed;
• Right to rectification: to correct inaccurate or incomplete data;
• Right to erasure: to request deletion of data in certain circumstances;
• Right to restriction: to request limited processing in certain situations;
• Right to data portability: to receive data in a structured, commonly used, machine-readable format and transmit it where applicable;
• Right to object: to object to processing based on legitimate interests or direct marketing;
• Right to withdraw consent: where processing is based on consent;
• Right to lodge a complaint: with the relevant data protection authority if a person believes their rights have been infringed.

Requests relating to these rights will be handled within the time limits required by law. In some cases, we may need to request information to verify identity before responding. Certain rights may be limited where processing is necessary for compliance with legal obligations or the establishment, exercise, or defense of legal claims.

9. Children’s Data

The services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children in a manner that would violate applicable data protection rules. If we become aware that data has been collected inappropriately, we will take steps to delete it where required.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, processing practices, or service operations. Any revised version will apply from the date it becomes effective. Customers are encouraged to review this Policy periodically to stay informed about how personal data is processed.

11. Final Statement

This Privacy Policy is intended to ensure transparency, accountability, and fairness in the processing of personal data. We are committed to respecting privacy rights, minimizing data use, and maintaining appropriate safeguards. By continuing to use the services, customers in the area acknowledge that their personal data may be processed in accordance with this Policy and applicable law.