Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the relevant area and is intended to meet the requirements of the General Data Protection Regulation (GDPR). We are committed to handling personal data lawfully, fairly, and transparently.

1. Scope and Purpose

This policy describes the categories of personal data we process, the purposes for which we process it, the lawful bases we rely on, how long we retain data, the categories of processors that may handle data on our behalf, and the rights available to individuals under the GDPR.

For the purposes of this policy, personal data means any information relating to an identified or identifiable person. This may include information provided directly by customers, information generated through our services, and limited technical data collected automatically when services are used.

2. Data We Collect

We may collect the following categories of data:

Identity data such as name, title, and customer reference information.
Contact data such as address, email address, and telephone number.
Transaction data such as details of services requested, orders placed, invoices, payment status, and delivery or service history.
Account data such as login details, preferences, and service settings, where applicable.
Technical data such as device information, browser type, operating system, time zone setting, and basic usage information.
Communication data such as enquiries, feedback, complaints, and records of correspondence.
Usage data such as interaction with service features, pages viewed, and actions taken within our systems.

We do not intentionally collect special category data unless it is strictly necessary, permitted by law, and subject to additional safeguards. Where such data is required, we will process it only in accordance with GDPR requirements.

3. How We Collect Data

We may collect personal data directly from you when you:

submit forms or request services;
communicate with us by email, telephone, or other channels;
create or manage an account;
make payments or enter into a contract with us;
provide feedback, complaints, or support requests.

We may also collect data automatically through technical tools and system logs, and from third parties where permitted by law, such as payment providers, service partners, or public sources.

4. Lawful Basis for Processing

We process personal data only where a lawful basis under GDPR applies. The lawful bases we rely on may include the following:

Contract: processing is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract.
Legal obligation: processing is necessary to comply with laws, regulations, tax rules, accounting requirements, or lawful requests from authorities.
Legitimate interests: processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. Examples include service improvement, fraud prevention, network security, and internal administration.
Consent: where required, we will ask for your consent before processing personal data for specific purposes, such as certain marketing activities. You may withdraw consent at any time.
Vital interests: in limited circumstances, we may process data to protect someone’s life.
Public task: where applicable, processing may be necessary for the performance of a task carried out in the public interest or under official authority.

Where we rely on legitimate interests, we carry out a balancing assessment to ensure that the impact on your privacy is proportionate and justified.

5. How We Use Personal Data

We use personal data for the following purposes:

to provide, manage, and improve our services;
to process transactions and maintain business records;
to verify identity and prevent fraud;
to respond to enquiries, complaints, and requests;
to maintain security and monitor performance;
to comply with legal and regulatory obligations;
to carry out internal reporting and analysis;
to send administrative communications related to the services.

We will only use personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another compatible purpose and that such use is permitted by law.

6. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, accounting, tax, and reporting obligations.

When determining retention periods, we consider:

the amount, nature, and sensitivity of the data;
the risk of harm from unauthorised use or disclosure;
the purposes of processing and whether those purposes can be achieved by other means;
applicable legal or regulatory retention requirements.

When personal data is no longer required, we will delete it securely or anonymise it so that it can no longer be associated with an individual. Retention periods may vary depending on the type of data and legal obligations.

7. Processors and Data Sharing

We may share personal data with trusted third-party processors that act on our instructions and process data only for specified purposes. These may include:

IT hosting and cloud service providers;
payment processing providers;
customer support and communication tools;
analytics and security service providers;
professional advisers such as accountants, auditors, and legal advisers;
delivery, logistics, or operational partners where needed to provide services.

Where processors are engaged, we require appropriate contractual safeguards under GDPR, including confidentiality obligations, security measures, and restrictions on subcontracting where applicable. We do not permit processors to use personal data for their own independent purposes.

We may also disclose personal data to public authorities, regulators, or law enforcement where required by law or where necessary to protect rights, safety, or property.

8. International Transfers

If personal data is transferred outside the European Economic Area or the United Kingdom, we will ensure appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms recognised under data protection law.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data against accidental loss, unlawful destruction, alteration, unauthorised disclosure, or access. These measures may include access controls, encryption, secure storage, staff confidentiality obligations, and regular review of security practices.

While we take reasonable steps to protect personal data, no method of transmission or storage is completely secure. We therefore cannot guarantee absolute security, but we continuously work to reduce risks and improve safeguards.

10. Your Rights Under GDPR

Depending on the legal basis and circumstances of processing, you may have the following rights:

Right of access – to obtain confirmation of whether we process your data and receive a copy of it.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of personal data in certain cases.
Right to restriction – to request that processing be limited in certain circumstances.
Right to data portability – to receive data you provided to us in a structured, commonly used format and to transmit it elsewhere where technically feasible.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.
Rights related to automated decision-making – to obtain human intervention and challenge decisions where applicable.

We will respond to valid requests within the time limits required by law. In some cases, we may need additional information to verify identity before acting on a request.

How to Exercise Your Rights

You may make a request to exercise any of the rights listed above through the appropriate channel made available to customers. We may refuse requests that are manifestly unfounded, excessive, or otherwise not permitted under GDPR, but we will explain our decision where required.

11. Marketing Preferences

Where we send marketing communications and where consent or another lawful basis is required, you have the right to object or withdraw your preferences at any time. Administrative or service-related communications may still be sent where necessary to provide the service or comply with legal obligations.

12. Children’s Data

Our services are not directed at children unless expressly stated otherwise. We do not knowingly collect personal data from children without appropriate authorisation and safeguards where required by law.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or the services we provide. Any updated version will apply from the date it takes effect. We encourage customers to review this policy periodically so they remain informed about how personal data is handled.

14. Additional Notes

This policy is intended to provide clear information about our data processing practices in a concise and transparent manner. It should be read together with any service-specific terms, notices, or consent requests that may apply in particular situations. Where a conflict exists between this policy and mandatory legal requirements, the law will prevail.

Summary principle: we collect only the data we need, use it for defined purposes, retain it for limited periods, protect it with appropriate safeguards, and respect the rights of every customer in the relevant area.