Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected in connection with our services. It applies to all customers in the area where our services are offered, and it is designed to reflect the requirements of the General Data Protection Regulation (GDPR). We are committed to handling personal data fairly, lawfully, and transparently.

1. Data We Collect

We may collect and process different categories of personal data depending on how you interact with us. This may include:

• Identity data: name, title, and similar identifiers.
• Contact data: email address, billing address, delivery address, and telephone number.
• Account data: login details, preferences, and profile information.
• Transaction data: records of purchases, payments, refunds, and related correspondence.
• Technical data: IP address, browser type, device identifiers, operating system, and access logs.
• Usage data: information about how you use our services, pages viewed, and actions taken.
• Communication data: messages, queries, feedback, complaints, and support interactions.

We generally collect data directly from you when you register, place an order, make an inquiry, or otherwise use our services. We may also receive data from third parties where lawful, such as payment processors, delivery partners, or publicly available sources.

2. How We Use Personal Data

We use personal data for the following purposes:

• To provide and manage our services.
• To process orders, payments, and refunds.
• To communicate with you about your account, transactions, or service updates.
• To respond to requests and provide customer support.
• To improve our services, systems, and user experience.
• To maintain security, prevent fraud, and detect unauthorized activity.
• To comply with legal and regulatory obligations.

Where appropriate, we may also use data for internal analysis and service improvement. We only use personal data in ways that are compatible with the purposes for which it was collected, unless we have a valid lawful basis to do otherwise.

3. Lawful Basis for Processing

Under GDPR, we must have a lawful basis to process personal data. Depending on the activity, our lawful bases may include:

Contractual Necessity

We process personal data when it is necessary to perform a contract with you or to take steps at your request before entering into a contract. This includes fulfilling orders, providing access to services, and managing your account.

Legal Obligation

We may process personal data where necessary to comply with a legal obligation, such as tax, accounting, consumer protection, or regulatory requirements.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. This may include fraud prevention, service improvement, network security, and business administration. We always consider whether such processing is proportionate and necessary.

Consent

In certain circumstances, we rely on your consent. For example, if specific communications or optional data uses require consent under applicable law, we will request it clearly. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Data Sharing and Processors

We may share personal data with trusted third parties who act as processors or, in some cases, independent controllers. Processors only act on our instructions and are required to protect personal data appropriately.

• Payment processors: to process financial transactions securely.
• IT and cloud service providers: to host systems, store data, and support technical operations.
• Customer support providers: to help manage service inquiries and communications.
• Delivery and logistics partners: to deliver goods or related services where applicable.
• Professional advisers: such as auditors, insurers, lawyers, or accountants.
• Public authorities: where disclosure is required by law or a valid legal request.

We require processors to implement appropriate technical and organizational measures, to process data only for specified purposes, and to assist us in meeting GDPR obligations where relevant. Personal data is not sold in the ordinary sense of the term.

5. International Transfers

If personal data is transferred outside the European Economic Area or another jurisdiction with similar protections, we will ensure that appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, or equivalent legal mechanisms. We assess transfers to ensure that your personal data remains protected to a level consistent with GDPR requirements.

6. Retention of Personal Data

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including meeting legal, accounting, reporting, or dispute-resolution requirements. Retention periods may vary depending on the type of data and the reason for processing.

• Contract and transaction records: kept for the duration of the relationship and for a period required by applicable law.
• Support communications: kept for as long as needed to resolve the issue and maintain service records.
• Technical and security logs: kept for limited periods to monitor, secure, and improve systems.
• Consent-based records: retained until consent is withdrawn or the purpose expires, unless a longer period is legally required.

When personal data is no longer required, we will delete it securely or anonymize it so that it can no longer identify you.

7. Data Security

We apply appropriate technical and organizational measures to protect personal data against accidental loss, unauthorized access, misuse, alteration, or disclosure. These measures may include access controls, encryption, secure storage, monitoring, and staff training. While no system can be guaranteed to be completely secure, we take reasonable steps to reduce risk and maintain the integrity and confidentiality of personal data.

8. Your Rights Under GDPR

Subject to legal conditions and exemptions, you have the following rights regarding your personal data:

• Right of access: to obtain confirmation that your data is being processed and receive a copy of it.
• Right to rectification: to correct inaccurate or incomplete data.
• Right to erasure: to request deletion of your data in certain circumstances.
• Right to restriction: to request limited use of your data in certain situations.
• Right to data portability: to receive your data in a structured, commonly used, machine-readable format and to transmit it where technically feasible.
• Right to object: to object to processing based on legitimate interests or to direct marketing.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

You also have the right to lodge a complaint with the relevant supervisory authority if you believe your rights have been infringed. We encourage you to raise concerns directly so that we may address them promptly, but this does not limit your legal rights.

9. Automated Decision-Making

We do not use personal data for decisions based solely on automated processing that produce legal or similarly significant effects, unless explicitly stated and permitted by law. If such processing is ever introduced, we will provide the required information and safeguards.

10. Children’s Data

Our services are not intended for children where parental consent or specific age limits apply under local law, and we do not knowingly collect personal data from children in violation of those requirements. If we become aware that we have collected such data without a valid basis, we will take appropriate steps to delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any revised version will apply from the date it is made effective. We encourage you to review this policy periodically to remain informed about how we protect personal data.

12. General Statement

This Privacy Policy applies to all customers in the area and is intended to provide a clear explanation of how personal data is handled. We process personal data with care, respect, and accountability, and we aim to ensure that our practices remain consistent with the principles of lawfulness, fairness, transparency, data minimization, accuracy, storage limitation, integrity, and confidentiality.

We are committed to respecting your privacy and handling your data responsibly.