Tom and Jerry Privacy Policy

This Privacy Policy explains how Tom and Jerry collects, uses, stores, and protects personal data relating to its customers and prospective customers. It also describes your rights under the General Data Protection Regulation and related data protection laws. This Privacy Policy applies to all Tom and Jerry customers and users of our services in our service area.

Who we are and scope of this policy

Tom and Jerry acts as the data controller for the personal data described in this Privacy Policy. As data controller, we determine the purposes and means of processing your personal data. This Privacy Policy applies to all products and services offered by Tom and Jerry in our service area, whether you interact with us online, in person, or by other means.

Types of personal data we collect

We collect and process different categories of personal data depending on how you interact with us and which services you use. The types of personal data we may collect include:

Identification and contact details, such as your name, postal address, billing address, and preferred contact details. Account and service information, such as username, account identifiers, service history, order details, invoices, payment status, and customer support records. Transaction and payment-related information, such as payment method, payment confirmations, and limited transaction details required for billing and accounting. Usage information, such as how you use our services, your preferences, feedback, and responses to surveys where provided. Technical information, such as device identifiers, browser type, and general diagnostic data generated when you access our online services. Communications data, such as records of communications you send to us and our responses, including queries, complaints, and service requests.

How we collect your personal data

We collect personal data in the following ways:

Directly from you when you contact us, request a quote, place an order, create an account, use our services, or communicate with us in any manner. Automatically when you access or use our online services, where certain technical data and usage information is generated by your device or browser. From third parties acting on your behalf or in connection with our services, such as payment service providers or other service partners, where this is necessary to complete a transaction or deliver services.

Purposes and lawful bases for processing

We process your personal data only when we have a lawful basis to do so under applicable data protection laws. The main purposes and lawful bases are:

To provide and manage our services. We process identification, contact, and account data to set up your account, provide products and services, manage bookings, process payments, and handle customer support. The lawful basis is performance of a contract or taking steps at your request prior to entering into a contract. To communicate with you. We use your contact details to send service-related notices, updates, and responses to your requests. The lawful basis is performance of a contract and our legitimate interests in ensuring effective customer communication. To manage billing, accounting, and legal obligations. We process transaction, payment, and accounting data to comply with legal and regulatory obligations, such as tax, accounting, and business record-keeping requirements. The lawful basis is compliance with legal obligations and our legitimate interests in managing our business. To improve and develop our services. We may use usage information, feedback, and technical data to monitor performance, fix issues, and improve our services. The lawful basis is our legitimate interests in developing and improving our services while respecting your privacy. To send marketing communications. Where permitted by law, we may use your contact details to inform you about products, services, offers, or events that may be of interest. The lawful basis is either your consent, where required, or our legitimate interests in promoting our business. You can opt out of marketing at any time. To protect our rights, property, and safety. We may use relevant data to prevent and detect fraud, misuse of services, or security incidents. The lawful basis is our legitimate interests in protecting our business and complying with legal requirements.

Data retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting obligations.

Customer account and service data are generally retained for the duration of your relationship with us and for a specified period thereafter, in line with limitation periods for legal claims. Transaction and billing records are retained for the period required under applicable tax and accounting laws. Technical and usage data are retained for shorter periods, as necessary for security, diagnostics, and service improvement, unless a longer retention period is required or permitted by law. When personal data is no longer required, we will delete it or anonymise it so that it can no longer be associated with you.

Data processors and third parties

We may engage third party service providers who process personal data on our behalf and in accordance with our instructions. These service providers act as data processors and are only permitted to process personal data for the purposes defined by us and subject to contractual safeguards.

Categories of processors and third parties we may use include: providers of hosting, infrastructure, and information technology services; payment and billing processors that assist with transactions and payment confirmations; customer support and communication service providers; professional advisers such as accountants or legal advisers where necessary for our business operations; and other service partners that help us deliver or support our services.

Where we share personal data with processors or other third parties, we take appropriate measures to ensure that your data is protected in accordance with data protection laws, including, where relevant, data transfer safeguards for processing outside the European Economic Area or other applicable region.

User rights under data protection law

As a data subject, you have a number of rights under the General Data Protection Regulation and related laws. These rights apply to all Tom and Jerry customers in our service area, subject to any legal conditions and exemptions. Your principal rights include:

Right of access. You have the right to obtain confirmation as to whether we process personal data concerning you and, if so, to receive a copy of that data together with certain information about how it is processed.

Right to rectification. You have the right to request correction of inaccurate personal data and to have incomplete data completed.

Right to erasure. In certain circumstances, you may request that we delete your personal data, for example where the data is no longer necessary for the purposes for which it was collected or where you withdraw consent and there is no other lawful basis for processing.

Right to restriction of processing. You have the right to request that we restrict the processing of your personal data in certain situations, such as while we verify the accuracy of data you contest.

Right to data portability. In certain circumstances, you have the right to receive personal data you have provided to us in a structured, commonly used, and machine readable format and to transmit that data to another controller where technically feasible.

Right to object. You may object at any time to processing based on our legitimate interests, including profiling relating to such interests, and we will no longer process your personal data unless we can demonstrate compelling legitimate grounds. You also have the absolute right to object at any time to processing of your personal data for direct marketing purposes.

Right to withdraw consent. Where our processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.

You also have the right to lodge a complaint with a supervisory authority if you consider that our processing of your personal data infringes applicable data protection laws.

Security of your personal data

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage. These measures are designed to ensure a level of security appropriate to the risks presented by the processing. While no system can be completely secure, we regularly review our security practices and seek to maintain the confidentiality, integrity, and availability of the personal data we hold.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. When we make changes, we will revise the effective date at the beginning of the policy and, where appropriate, take steps to inform you. We encourage you to review this Privacy Policy periodically to stay informed about how we process and protect your personal data.