Privacy Policy

To register and manage your account, we collect personal data including your first name, surname, contact mobile number and email address.

To verify your identity for certain services, we may request your date of birth, your ID card or passport number (including expiry date and country of issue), and your nationality.

Where required for fraud prevention, compliance checks, or order fulfilment, we may also request proof of identity documents, such as an ID card or passport, uploaded by you through our secure website.

Some information is collected automatically when you use our website, including:

• the type of mobile device you are using;
• your IP address;
• session history information and related usage data.

Cookie and tracking information helps our website remember your preferences, improve functionality, and provide requested content. Device and IP information may also be used for security monitoring and fraud prevention.

When you report a problem with our website or services, we collect your contact details and a description of the issue so we can assist you.

It is important that personal data we hold about you is accurate and up to date. You can check your current personal data in your account settings.

We may use your personal data to:

• register and manage your account and profile details;
• process your orders, payments, and related customer support requests;
• verify identity where required and prevent fraud or misuse of our services;
• respond to incidents, service requests, and complaints;
• monitor, maintain, and improve our website, products, and services;
• analyse website traffic and performance for operational and technical improvements;
• comply with legal obligations and cooperate with law enforcement or regulators where required by law.

Whenever we process your personal data we ensure that we:

• process it lawfully, fairly and in a transparent manner;
• collect it only for valid purposes that we have clearly explained to you and not use it in any incompatible way;
• hold accurate records and, where possible, keep your personal data up to date;
• keep it only as long as necessary for the purposes we have told you about;
• keep it safe and secure to limit the potential of a personal data breach.

We only use your personal data for the purposes for which we collected it. Depending on the circumstances, our lawful basis under the Gibraltar GDPR includes: performance of a contract with you, compliance with legal obligations, our legitimate interests (for example website security, fraud prevention, and service improvement), and your consent where required.

We regularly review our processing activities to ensure they remain necessary, proportionate, and compliant with applicable data protection law.

Under the Data Protection Act 2004 and the Gibraltar GDPR, strict principles govern our use of personal data and our duty to ensure it is kept safe and secure.

We have appropriate security measures in place (such as password protection and access restrictions) to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We also use encryption for the collection or transfer of sensitive personal data, such as credit card details when making a payment.

All records are restricted so that only individuals with a need to know can access information. This may be through the use of technology or other environmental safeguards.

Our employees and authorised contractors are bound by confidentiality obligations. Personal data is only used for legitimate business purposes and lawful processing activities.

You should never disclose your password or login credentials to anyone. If you believe that someone has logged in with your credentials, please notify us by contacting our support team.

We do not sell your personal data. We may share your data with trusted third parties where necessary to provide our services, including payment processors, delivery providers, IT hosting/support providers, and professional advisers.

We may also disclose information where required to comply with legal obligations, enforce our terms, protect our rights, or assist with fraud prevention and criminal investigations.

Where third-party processing takes place, we require appropriate contractual, technical, and organisational safeguards to protect your personal data.

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which we collected it, including legal, regulatory, tax, accounting or reporting requirements.

Support requests, incidents, and complaints are retained for as long as necessary to deal with your query and for a reasonable period afterwards for record-keeping and legal purposes.

Retention periods may be extended if we reasonably believe that there is a prospect of litigation in respect of our relationship with you.

To determine retention periods, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process personal data and whether those purposes can be achieved by other means, and any applicable legal or regulatory requirements.

If you want to deactivate your account, please contact our support team. Deactivating your account means you can no longer access account features unless reactivated.

Where we are legally required to keep certain records (for example accounting, tax, anti-fraud, or dispute records), we will retain those records for the required period even if your account is deactivated.

Under data protection law, you have rights in relation to the personal data that we hold about you. You may exercise these rights at any time by contacting us using the details at the end of this Privacy Policy.

It may not always be possible to agree to your request if keeping the record is of significant importance. If this is the case, we will explain the reason to you.

You have the right to:

• ask us to confirm whether we hold your personal data and request a copy (Data Subject Access Request or DSAR);
• correct inaccuracies in your personal data and complete incomplete records, including by updating your account settings;
• delete your personal data where possible in the specific circumstances;
• ask us to restrict or object to processing in certain circumstances, including processing based on legitimate interests;
• ask for portability of personal data you have provided to us, where applicable;
• withdraw consent at any time where processing is based on your consent.