Privacy Policy -

Introduction

This Privacy Policy explains how we collect, use, retain and share personal data in compliance with the General Data Protection Regulation (GDPR). This policy applies to all customers in the European Economic Area (EEA) and to any individuals whose data we process in that area. The information below describes the types of data we process, the lawful bases we rely on, how long we keep data, the categories of processors we use, and the rights available to data subjects under the GDPR.

1. Data We Collect

We collect personal data that is necessary to provide our services and to operate our business effectively. The categories of personal data we collect include:

Identity and contact data: name, job title, company name, email address, postal address, telephone numbers.
Account and transaction data: billing details, payment card or bank details (where applicable), order history, subscription information.
Technical and usage data: IP address, browser type and version, device identifiers, operating system, log files, usage patterns, clickstream and activity on our services.
Communication data: records of communications and correspondence with support or sales, including call recordings where permitted and consented.
Location data: location information derived from IP addresses or device settings where this is relevant to service delivery.
Marketing and preference data: marketing preferences, consents and opt-in status.
Sensitive data: we do not generally collect special categories of personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data) unless you explicitly provide such information and we have a lawful basis to process it; if we do process any special category data, we will obtain your explicit consent or rely on another lawful basis permitted by the GDPR.

2. Lawful Basis for Processing

We process personal data only where we have a lawful basis to do so. The lawful bases we rely on include:

Contractual necessity: processing is necessary to perform a contract with you (for example, to deliver services, process payments, provide customer support).
Legal obligation: processing is necessary to comply with legal and regulatory obligations (for example, tax, accounting, and record-keeping requirements).
Consent: where required, we will obtain your explicit consent to process certain categories of personal data (for example, marketing communications, cookies beyond essential cookies).
Legitimate interests: processing that is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. Examples include fraud prevention, improving service performance, direct marketing (where permitted), network and information security, and business administration.

We will inform you of the specific lawful basis for each processing activity at the point of collection or in related notices.

3. How We Use Personal Data

We use personal data for purposes that include:

Providing, maintaining, and improving our services.
Processing payments and managing billing and subscriptions.
Customer service, support, and dispute resolution.
Security, fraud prevention, and compliance with legal obligations.
Personalizing user experience and content; analytics and business insights.
Marketing and communications, where you have provided consent or we have another lawful basis.

4. Data Retention

Retention principles: We retain personal data only for as long as necessary for the purposes for which it was collected, to satisfy legal, tax, or accounting requirements, and to resolve disputes. The retention period depends on the type of data and the purpose of processing.

Account and transactional data: retained for the duration of the customer relationship and subsequently for a period required by law (typically up to 7 years for tax and accounting records), unless a shorter retention period applies.
Support and correspondence records: retained for a reasonable period to provide continuity and improve service (commonly 1–3 years), unless required longer by law.
Marketing and consent records: retained until consent is withdrawn or the individual objects; consent records are retained to demonstrate compliance with consent requirements.
Usage and analytics data: retained in aggregated or anonymized form where possible; identifiable usage data is retained only as long as needed to support service operations and improvements.

When data is no longer required, we securely delete or anonymize it in accordance with our data retention and deletion policies.

5. Processors and Third Parties

We use third-party processors to perform functions on our behalf, such as payment processing, hosting and cloud services, analytics, email delivery, customer support platforms, and marketing tools. These processors are engaged under data processing agreements that require appropriate technical and organizational measures and compliance with the GDPR.

Transfers outside the EEA: where personal data is transferred to countries outside the EEA, we ensure appropriate safeguards are in place, such as:

EU Commission adequacy decisions;
Standard Contractual Clauses (SCCs) or other approved transfer mechanisms;
Binding Corporate Rules (BCRs) where applicable.

We may also disclose personal data to comply with legal obligations, enforce our terms, protect rights and safety, or to complete a business transaction such as a merger or sale of assets—always in accordance with applicable law.

6. Security

We implement a combination of technical, physical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure. These measures include access controls, encryption in transit and at rest where appropriate, network security, regular security assessments, staff training and incident response procedures. While we strive to protect data, no transmission over the internet is completely secure; where you provide personal data, you do so at your own risk.

7. Your Rights

You have certain rights under the GDPR. Below is a summary of those rights and the typical ways we respond:

Right of access: you may request confirmation of whether we process your personal data and request a copy of the data.
Right to rectification: you may request correction of inaccurate or incomplete personal data.
Right to erasure (right to be forgotten): you may request deletion of your personal data where there is no overriding legal basis for retention.
Right to restriction of processing: you may request that processing be limited in certain circumstances.
Right to data portability: you may request a machine-readable copy of personal data provided by you for transmission to another controller where technically feasible.
Right to object: you may object to processing based on legitimate interests or direct marketing; where you object, we will stop processing unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent: where processing is based on consent, you may withdraw consent at any time; withdrawal will not affect processing carried out prior to withdrawal.
Right to lodge a complaint: you have the right to lodge a complaint with a supervisory authority in your country or EU member state if you believe your rights have been infringed.

Exercising your rights

To exercise your rights, please use the account controls provided to you or the communications channels available in your account and service interfaces. We will respond to valid requests without undue delay and in any event within one month of receipt. Where requests are complex or numerous, we may extend the period by up to two further months and will inform you of any extension and the reasons for the delay. We may require verification of your identity before fulfilling certain requests.

8. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Where material changes occur, we will provide notice through the channels available to customers in the EEA and, where required, obtain any necessary consents.

Conclusion: We are committed to protecting the privacy and security of personal data. This policy explains our approach and the safeguards we use. It is intended to be clear, transparent and in line with GDPR obligations for all customers in the EEA.