Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area and is intended to reflect the requirements of the General Data Protection Regulation (GDPR). We are committed to processing personal data fairly, transparently, and securely, and to respecting the rights of individuals whose data we handle.

1. Scope of This Policy

This Policy applies to personal data processed in relation to our products, services, communications, and customer support activities. It covers data collected directly from individuals, data generated through service use, and data received from authorized third parties where legally permitted. It also applies regardless of the device or channel used to access our services.

Personal data means any information relating to an identified or identifiable natural person. This may include names, identifiers, contact details, account information, transactional information, technical identifiers, and other information that can reasonably be linked to an individual.

2. Data Collection

We collect personal data only to the extent necessary for specific, explicit, and legitimate purposes. The categories of data collected may include:

Identity data such as name, username, or account identifier.
Contact data such as email address, telephone number, billing address, or delivery details.
Transaction data such as purchase records, service history, payment confirmations, and invoices.
Technical data such as device type, browser type, IP address, log data, and usage patterns.
Communication data such as inquiries, feedback, complaints, and service-related correspondence.
Preference data such as language settings, service preferences, and consent choices.

We generally collect data directly from individuals when they create an account, place an order, request support, provide feedback, or otherwise interact with our services. In some cases, data may be collected automatically through system logs or similar technologies. We may also receive data from third parties, such as payment providers, delivery partners, or other authorized service providers, where required for service delivery or legal compliance.

We do not intentionally collect special category data unless there is a lawful and necessary reason to do so, and appropriate safeguards are in place.

3. Purposes of Processing

Personal data is processed for the following purposes:

To provide, operate, and maintain our services.
To manage customer accounts and process transactions.
To communicate about service updates, orders, or account matters.
To respond to questions, requests, complaints, and support needs.
To improve service quality, performance, and user experience.
To detect, prevent, and investigate fraud, misuse, or security incidents.
To comply with legal and regulatory obligations.
To protect rights, property, and safety where necessary.

We only use personal data for purposes that are compatible with the original reason for collection, unless another lawful basis applies.

4. Lawful Basis for Processing

Under GDPR, we must have a valid lawful basis to process personal data. Depending on the activity, we rely on one or more of the following legal bases:

Performance of a contract – when processing is necessary to provide services, fulfill orders, manage accounts, or carry out requested actions.
Legal obligation – when processing is required to comply with applicable laws, tax rules, accounting obligations, or regulatory requirements.
Legitimate interests – when processing is necessary for our legitimate business interests, provided those interests are not overridden by individual rights and freedoms. Examples include service improvement, fraud prevention, and internal administration.
Consent – when we rely on freely given, specific, informed, and unambiguous consent, especially where required for optional communications or certain data uses.
Vital interests – in rare cases where processing is necessary to protect someone’s life.
Public task – where applicable, if processing is necessary for a task carried out in the public interest or under official authority.

Where consent is used, individuals may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

5. Data Sharing and Processors

We may share personal data with trusted third parties that act as processors or, in some cases, independent controllers. Processors are engaged only where they provide sufficient guarantees regarding security, confidentiality, and GDPR compliance. They process personal data on our instructions and only for specified purposes.

Examples of processor categories may include:

Cloud hosting and infrastructure providers.
Payment processing services.
IT support and maintenance providers.
Customer relationship or communications tools.
Analytics and performance monitoring services.
Delivery, logistics, or fulfillment partners where needed.

We may also disclose data where required by law, court order, regulatory request, or to protect legal rights, prevent harm, or address suspected unlawful activity. Where data is transferred outside the European Economic Area, appropriate safeguards will be used, such as standard contractual clauses or other legally approved transfer mechanisms.

We do not sell personal data.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, tax, and reporting requirements. Retention periods vary depending on the type of data, the purpose of processing, and applicable legal obligations.

In determining retention periods, we consider:

The nature and sensitivity of the data.
The risk of harm from unauthorized use or disclosure.
The purpose for which the data is processed.
Whether legal or contractual obligations require retention.
Whether the data is needed to defend or establish legal claims.

When personal data is no longer required, it is securely deleted, anonymized, or archived in a manner consistent with legal requirements and internal retention practices. Retention is never longer than necessary for the lawful purpose for which the data was collected.

7. Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures may include access controls, encryption where appropriate, security monitoring, staff confidentiality obligations, and regular review of internal procedures.

Although no system can be guaranteed to be completely secure, we take data protection seriously and continuously work to reduce risks associated with processing personal data.

8. User Rights Under GDPR

Individuals whose personal data we process have rights under GDPR. Subject to legal limitations, these rights may include:

Right of access – to obtain confirmation of whether personal data is processed and receive a copy of that data.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of personal data in certain circumstances.
Right to restriction – to request limitation of processing in certain situations.
Right to data portability – to receive personal data in a structured, commonly used, machine-readable format and transfer it where technically feasible.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent, to withdraw that consent at any time.
Right not to be subject to solely automated decisions – to avoid decisions based only on automated processing where such rights apply.

Requests should be made through the appropriate privacy request process. We may need to verify identity before fulfilling a request. We will respond within the timeframe required by GDPR, usually within one month, unless an extension is permitted due to complexity or volume.

Exercising these rights is free of charge unless requests are manifestly unfounded or excessive.

9. Children’s Data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children without appropriate legal basis and, where required, verifiable parental consent. If we become aware that data has been collected improperly, we will take reasonable steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or service offerings. When changes are made, the revised policy will apply from the effective date stated in the updated version. We encourage individuals to review this Policy periodically to remain informed about how personal data is processed.

11. Complaints and Supervisory Authority Rights

If an individual believes that personal data has been processed unlawfully, they have the right to raise concerns with the relevant data protection supervisory authority. We also encourage individuals to first raise concerns through the applicable privacy request or complaint process so that we may attempt to resolve the issue directly.

Our Commitment

We are committed to privacy by design and privacy by default. This means that data protection is considered throughout our operations, and only the minimum necessary personal data is processed for each defined purpose. We strive to be transparent, accountable, and respectful of individual privacy rights at every stage of data handling.