Privacy Policy

This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected in connection with our services. It applies to all customers in the area where our services are offered, and it is intended to meet the requirements of the General Data Protection Regulation (GDPR). By using our services, you acknowledge that your personal data may be processed in accordance with this policy and applicable data protection law.

1. Who This Policy Applies To

This policy applies to all customers in the area, including individuals who visit our premises, place orders, create accounts, subscribe to communications, make inquiries, or otherwise interact with us. It also applies to prospective customers, suppliers acting as natural persons, and any other individuals whose personal data we process in the course of providing our services.

2. Data We Collect

We collect only the personal data necessary for specific and legitimate purposes. Depending on how you interact with us, this may include the following categories:

Identification data, such as your name, title, and, where relevant, date of birth.
Contact data, such as postal address, email address, and telephone number.
Account and transaction data, including purchase history, billing details, service records, and payment-related information.
Communication data, such as messages, complaints, feedback, and support requests.
Technical and usage data, such as IP address, browser type, device identifiers, and interaction logs, where applicable.
Preference data, including marketing preferences and service choices.

We do not intentionally collect special category data unless it is required for a specific lawful purpose and permitted by law. Where such data is necessary, we will apply additional safeguards and only process it when a valid legal basis exists.

3. How We Use Personal Data

We process personal data for the following purposes:

To provide goods or services and manage customer relationships.
To process payments, invoices, refunds, and related transactions.
To respond to inquiries, requests, complaints, and support matters.
To maintain records, operate internal administration, and ensure service quality.
To comply with legal and regulatory obligations.
To prevent fraud, unauthorized access, and misuse of our services.
To send marketing communications where permitted and where you have not objected.
To analyze and improve our services, systems, and customer experience.

We will only use your personal data for purposes that are compatible with the original purpose for which it was collected, unless we have a valid legal reason to do otherwise.

4. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for each processing activity. Depending on the context, we rely on one or more of the following:

Contract

We process personal data where it is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract.

Legal Obligation

We process personal data where necessary to comply with applicable laws, including tax, accounting, consumer protection, and regulatory requirements.

Legitimate Interests

We may process data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. Examples include fraud prevention, internal administration, service improvement, and limited direct marketing where permitted by law.

Consent

Where required, we rely on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Vital Interests and Public Task

In rare cases, we may process personal data to protect vital interests or where processing is necessary for a task carried out in the public interest or under official authority, if applicable.

5. Sharing and Processors

We may share personal data with carefully selected third parties that act as data processors or, where appropriate, independent controllers. We only disclose data where necessary for legitimate business purposes, legal compliance, or service delivery.

Our processors may include providers of:

IT hosting, cloud storage, and system maintenance;
payment processing and financial administration;
customer relationship management and communication tools;
delivery, logistics, and operational support;
professional services such as accounting, audit, and legal support;
security, fraud detection, and monitoring services.

All processors are required to act only on our documented instructions, protect personal data appropriately, and implement suitable technical and organizational measures. Where data is transferred outside the European Economic Area, we will ensure an appropriate safeguard is in place, such as Standard Contractual Clauses or another lawful transfer mechanism.

6. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, regulatory, or reporting obligations. Retention periods may vary depending on the type of data and the reason for processing.

Contract and transaction records are generally retained for the period needed to manage the relationship and comply with statutory obligations.
Customer service records are retained for as long as needed to resolve issues and maintain accurate business records.
Marketing data is retained until you opt out, withdraw consent, or we determine it is no longer needed.
Technical logs are retained for security, troubleshooting, and operational purposes for a limited period.

When data is no longer required, we will delete it securely or anonymize it so that it can no longer identify you.

7. Data Security

We use appropriate technical and organizational measures to protect personal data against accidental loss, unlawful access, alteration, disclosure, or destruction. These measures may include access controls, encryption where appropriate, secure storage, staff training, and regular review of security practices. While no system can be guaranteed completely secure, we aim to maintain a level of protection appropriate to the risk.

8. Your Rights Under GDPR

Subject to applicable conditions and exceptions, you have the following rights regarding your personal data:

Right of access – to request confirmation of whether we process your data and to obtain a copy.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of your data in certain circumstances.
Right to restrict processing – to request limited use of your data in certain cases.
Right to data portability – to receive certain data in a structured, commonly used, machine-readable format.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent.
Right not to be subject to automated decision-making – including profiling, where such decisions produce legal or similarly significant effects, unless permitted by law.

You may also have the right to lodge a complaint with your local data protection authority if you believe your rights have been infringed. We encourage you to raise concerns promptly so that we can address them.

9. Children’s Data

Our services are not intended for children unless specifically stated otherwise. We do not knowingly collect personal data from children without appropriate authorization where required by law. If we become aware that personal data has been collected from a child in breach of this policy, we will take reasonable steps to delete it or obtain the necessary consent.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any updated version will apply from the date it becomes effective. We encourage customers in the area to review this policy periodically so they remain informed about how their data is handled.

11. Core Principles We Follow

We are committed to processing personal data in line with GDPR principles. In particular, we aim to ensure that data is processed lawfully, fairly, and transparently; collected for specified, explicit, and legitimate purposes; adequate, relevant, and limited to what is necessary; accurate and kept up to date; stored only as long as needed; and processed securely with appropriate accountability.

Where possible, we also apply the principles of data minimization and privacy by design and by default, meaning we seek to limit data collection and build privacy considerations into our processes from the outset.

12. Summary of Key Commitments

We collect only the data needed for service delivery, compliance, and legitimate business purposes.
We process data under a valid GDPR lawful basis.
We use trusted processors bound by appropriate contractual protections.
We retain personal data only for as long as necessary.
We respect and support your GDPR rights.
This policy applies to all customers in the area.

By continuing to use our services, you acknowledge that you have read and understood this Privacy Policy and that your personal data will be handled in accordance with it and applicable data protection laws.