Privacy Policy -

Introduction

This Privacy Policy explains how personal data is collected, used, stored, and protected in connection with our services. This Policy applies to all customers in the area. It is also intended to meet the requirements of the General Data Protection Regulation (GDPR) and applies to all customers in the European Economic Area (EEA). The terms used in this Policy are defined in accordance with applicable data protection law.

Scope and Applicability

This Privacy Policy applies to all individuals who use, purchase, or inquire about our products and services, including potential customers, current customers, and former customers in the EEA. It covers the processing of personal data carried out by us as a data controller and describes the categories of data processed, the lawful bases relied upon, retention periods, use of processors, and the rights of data subjects.

Data We Collect

We collect and process personal data that is necessary for the provision, improvement, and support of our services. Categories of personal data we may collect include:

Identity and contact information: name, job title, organization, email address, postal address, phone number.
Account and transactional data: account identifiers, order history, billing information, invoices, payment confirmations.
Technical and usage data: IP addresses, device and browser information, cookies, usage logs, analytics data about how services are used.
Communications: correspondence with customer support, feedback, recorded interactions where applicable.
Marketing preferences: subscription status and communication preferences.
Special categories: we do not routinely process special category data. If such data is provided, we will only process it where there is an explicit lawful basis and appropriate safeguards in place.

Lawful Basis for Processing

Under the GDPR, we rely on one or more lawful bases to process personal data:

Contractual necessity: processing necessary to perform a contract with you or take steps at your request prior to entering into a contract (e.g., account provisioning, order fulfillment).
Legal obligation: processing required to comply with legal obligations, such as tax, accounting, or regulatory requirements.
Consent: where we rely on consent (e.g., marketing communications or cookies), you have the right to withdraw consent at any time. Withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.
Legitimate interests: processing for legitimate business interests, such as improving services, preventing fraud, securing systems, or direct marketing where those interests are not overridden by your rights and freedoms.

Purpose of Processing

We process personal data to provide and administer services, manage accounts, process payments, provide customer support, comply with legal obligations, detect and prevent fraud and abuse, perform analytics to improve services, and, where permitted, to send relevant marketing communications.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, to meet legal obligations, to resolve disputes, and to enforce agreements. Typical retention periods include:

Account data: retained for the duration of the business relationship plus a reasonable period after account closure to allow for legitimate business needs and legal obligations.
Transactional and billing records: retained in accordance with applicable accounting and tax laws (commonly up to 7 years, or as otherwise required by law).
Support and correspondence records: retained for a period sufficient to address service issues, frequently no longer than necessary for operational needs and legal obligations.
Analytics and logs: retained in aggregated or anonymized form where possible; raw logs retained only as needed for security, troubleshooting, or compliance.

When retention periods expire, we securely delete, anonymize, or aggregate personal data unless further retention is required by law.

Processors and Third-Party Services

We engage carefully selected service providers and subprocessors to perform functions on our behalf, such as payment processing, cloud hosting, analytics, customer support, and data backup. These processors are contractually obliged to process personal data only on our documented instructions and to implement appropriate technical and organizational measures to protect personal data.

Categories of processors may include:

Cloud hosting and infrastructure providers.
Payment and billing processors.
Customer relationship management and support platforms.
Analytics and monitoring services.

Before engaging a processor, we conduct due diligence and require contractual commitments including confidentiality, security, and deletion obligations. Where data is transferred outside the EEA, we ensure adequate safeguards are in place such as adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms.

Security Measures

We implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. These measures include encryption, access controls, staff training, incident response procedures, and regular security assessments. While we strive to protect personal data, no system can be guaranteed fully secure; unauthorized access incidents will be handled in accordance with applicable legal requirements.

User Rights

You have rights under GDPR in relation to your personal data. These include the right to:

Access: obtain confirmation of whether we process your personal data and request a copy of the data.
Rectification: request correction of inaccurate or incomplete personal data.
Erasure: request deletion of personal data where there is no lawful basis for continued processing (the "right to be forgotten").
Restriction: request restriction of processing in certain circumstances.
Data portability: request transfer of your personal data to another controller in a structured, commonly used, machine-readable format.
Objection: object to processing based on legitimate interests or direct marketing; we will comply unless we demonstrate compelling legitimate grounds.
Withdraw consent: where processing is based on consent, withdraw it at any time without affecting processing done prior to withdrawal.

If you consider that our processing of your personal data infringes applicable data protection law, you also have the right to lodge a complaint with a competent supervisory authority in your country. Instructions on how to exercise these rights are provided through the account interface or other communication channels we make available.

Automated Decision-Making

We may use automated processing or profiling to improve services or for security and fraud detection. Where automated decision-making produces legal effects or significantly affects you, we will provide meaningful information about the logic involved and the significance and envisaged consequences of such processing, and we will ensure appropriate safeguards are in place.

Changes to This Policy

We may update this Privacy Policy to reflect changes in legal, regulatory, or operational requirements. Material changes will be communicated where required. It is your responsibility to review the Policy periodically.

Final Note

We are committed to protecting personal data and ensuring compliance with GDPR and other applicable data protection laws. This Privacy Policy is intended to describe our practices transparently and to inform you of your rights. If you are a customer or user in the EEA, this Policy governs our processing of your personal data in relation to our services.

Effective date: This Policy is effective as of the date published.