Privacy Policy
This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when services are provided to customers in the area. It applies to all customers in the area and is intended to meet the requirements of applicable data protection laws, including the General Data Protection Regulation (GDPR), where relevant. By using the services, customers acknowledge that their personal data may be processed in accordance with this Policy.
1. Data Collection
We may collect and process personal data that is necessary to provide services, manage customer relationships, and comply with legal obligations. Personal data may be collected directly from customers, automatically through systems used to deliver services, or from third parties where lawful.
Categories of data collected
- Identity data: name, title, and other identifying information.
- Contact data: address, email address, telephone number, and similar details.
- Transaction data: records of purchases, service requests, payments, and related communications.
- Technical data: device type, IP address, browser type, operating system, and usage logs.
- Profile data: preferences, feedback, service history, and interaction records.
- Compliance data: information needed to satisfy legal, regulatory, tax, or accounting obligations.
Where special category data is required, it will only be processed when a valid legal condition applies and when additional safeguards are in place.
2. Purposes of Processing
Personal data is processed only for specified, explicit, and legitimate purposes. These include:
- providing and managing services;
- handling enquiries, requests, and complaints;
- processing transactions and maintaining records;
- improving service quality, functionality, and user experience;
- performing internal administration, reporting, and analytics;
- detecting, preventing, and investigating fraud, misuse, or security incidents;
- meeting legal, regulatory, and contractual obligations.
We do not process personal data in a manner that is incompatible with these purposes.
3. Lawful Basis for Processing
We process personal data only where a lawful basis under GDPR applies. Depending on the context, the lawful basis may include one or more of the following:
Contract
Processing is necessary to enter into or perform a contract with a customer, including taking steps at the customer’s request before entering into a contract.
Legal obligation
Processing is necessary to comply with legal obligations, such as record-keeping, tax, accounting, or regulatory requirements.
Legitimate interests
Processing may be carried out where it is necessary for legitimate interests pursued by us or by a third party, provided those interests are not overridden by the customer’s rights and freedoms. Examples may include service improvement, security, fraud prevention, and business administration.
Consent
Where consent is relied upon, it will be obtained freely, specifically, informed, and unambiguously. Customers may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Vital interests and public interest
In limited circumstances, processing may be necessary to protect vital interests or to perform a task carried out in the public interest, where applicable law allows it.
4. Data Sharing and Processors
Personal data may be shared only when necessary and only with appropriate safeguards. We may use trusted third-party service providers acting as data processors to help deliver services and support operations. These processors are contractually required to process personal data only on documented instructions, to keep it confidential, and to implement suitable technical and organisational security measures.
Types of processors may include
- IT hosting and cloud service providers;
- payment processing services;
- customer support and communication tools;
- analytics and reporting providers;
- professional advisers, auditors, and compliance support services;
- archiving, storage, and document management providers.
Where personal data is shared with independent third parties acting as separate controllers, those parties are responsible for their own compliance and privacy practices. Personal data may also be disclosed where required by law, court order, regulatory request, or to protect rights, safety, and property.
5. International Transfers
If personal data is transferred outside the United Kingdom or European Economic Area, appropriate safeguards will be used where required. These may include adequacy regulations, standard contractual clauses, supplementary measures, or other lawful transfer mechanisms. Any such transfer will be carried out only where adequate protection is ensured.
6. Data Retention
Personal data is kept only for as long as necessary for the purposes for which it was collected, including any legal, accounting, regulatory, or reporting obligations. Retention periods depend on the type of data, the purpose of processing, and any mandatory retention requirements.
Retention principles
- data needed to perform a contract is retained for the duration of the relationship and for a reasonable period after it ends;
- data required by law is retained for the legally required period;
- data used for operational and security purposes is retained only as long as necessary for those purposes;
- when data is no longer required, it is securely deleted, anonymised, or otherwise disposed of.
Retention decisions are regularly reviewed to ensure compliance with data minimisation and storage limitation principles.
7. Data Security
Appropriate technical and organisational measures are used to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, encryption, secure storage, monitoring, staff confidentiality obligations, and regular review of security practices. While no system can be guaranteed completely secure, reasonable steps are taken to reduce risk and protect data in line with GDPR requirements.
8. User Rights
Customers in the area have rights in relation to their personal data under applicable data protection law. Subject to legal limitations, these rights may include:
Right of access
The right to obtain confirmation of whether personal data is being processed and to receive a copy of that data.
Right to rectification
The right to have inaccurate or incomplete personal data corrected.
Right to erasure
The right to request deletion of personal data in certain circumstances, such as when it is no longer needed or consent is withdrawn.
Right to restriction
The right to request limitation of processing in specific situations, for example while accuracy or legitimacy is being verified.
Right to data portability
The right to receive personal data in a structured, commonly used, machine-readable format and, where technically feasible, to have it transmitted to another controller.
Right to object
The right to object to processing based on legitimate interests and, in certain cases, to processing for direct marketing purposes.
Rights relating to automated decision-making
The right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, except where permitted by law and with appropriate safeguards.
To exercise any of these rights, customers may make a request through the available service channels. Reasonable steps may be taken to verify identity before responding.
9. Children’s Data
The services are not intended for children unless expressly stated otherwise. Personal data relating to children will only be processed where lawful and where appropriate consent or another valid legal basis is in place, together with suitable protective measures.
10. Updates to This Policy
This Privacy Policy may be updated from time to time to reflect changes in legal requirements, operational practices, or service arrangements. The most current version will apply to all customers in the area from the date it becomes effective. Continued use of the services after an update indicates acceptance of the revised Policy, where permitted by law.
11. Complaints and Supervisory Authority
Customers who believe their data protection rights have been affected may raise a complaint with the relevant supervisory authority. Customers are encouraged to first raise concerns through the available service channels so that issues can be reviewed and, where possible, resolved promptly. This does not limit the right to contact a supervisory authority directly.
Summary of commitments:
- personal data is collected only for legitimate and specified purposes;
- processing is based on a valid lawful basis under GDPR;
- data is shared only with trusted processors or where required by law;
- retention is limited to what is necessary and lawful;
- customers in the area may exercise applicable data protection rights.
This Privacy Policy applies to all customers in the area and should be read together with any other relevant terms or notices that explain specific processing activities.
