Dear Sirs and Madams,

With effect from 25 May 2018, the current data protection legislation is amended. The General Data Protection Regulation of 27 April 2016 (hereinafter referred to as “GDPR”) is in force. Therefore, we address this information to our Customers and Potential Customers to inform you about how we process your personal data.

Data Controller

Your personal data controller, i.e. the entity which decides about the purposes and methods of processing your personal data is Turll Limited with its registered seat in 12 Science and Technology W Ave, Science Park, Hong Kong (hereinafter referred to as Turll). Providing the data is voluntary, but necessary in order to conclude an agreement and subsequently provide the service as ordered.

Obtaining information on personal data processing

In matters relating to personal data protection, you can contact the Data Protection Officer at [email protected] or write a letter to our registered seat.

Data collection and the processing purpose

We process your personal data due to the fact that it is necessary for the performance of the contract concluded with you, i.e. the provision of the service (which is in accordance with Article 6(1)(b) of GDPR) including:

• registration of the User in the order processing system and provision of User service, including presentation of product offers and order processing (which is in accordance with Article 6(1)(b) of GDPR);
• handling complaints (which is in accordance with Article 6(1)(c) of GDPR);
• pursuing contractual claims (which is in accordance with Article 6(1)(f) of GDPR) where the right to pursue claims is the legitimate interest;
• archiving purposes (which is in accordance with Article 6(1)(c) of GDPR);
• statistical purposes (which is in accordance with Article 6(1)(f) of GDPR) where the legitimate interest of the controller is to possess information about the statistics of our activities, which allows us to improve our business.

In addition, the law requires us to process your data for tax and accounting purposes.

Furthermore, we may process your data for marketing purposes, i.e. to promote our products and services. If we do this without the use of electronic means of communication, the legal grounds for carrying out such activities is Article 6(1)(f) of the GDPR, where conducting marketing activities is the legitimate interest of the Controller. On the other hand, if we use electronic means of communication for this purpose, i.e. e-mail, telephone, we process data only on the basis of your consent (which is in accordance with Article 6(1)(a) of the GDPR).

Data recipients

Your personal data may be transferred to other entities that process your data on their own behalf, including but not limited to:

• parties conducting postal or courier activities;
• banks and payment intermediaries (depending on the payment method chosen by the Customer) – for undue payment recovery purposes;
• payment intermediaries (if the Customer chooses this payment method) – for the purpose of making payments;
• government authorities or other entities entitled by law, for the purposes of performing our obligations (tax offices, law enforcement agencies, etc.);
• entities managing our IT systems (hosting companies, IT service providers);
• entities providing us with legal counsel, accounting, tax, claim collection, and advisory services.

Personal data retention period

Your personal data will be retained for the duration of a contract (performance of services) and after its termination:

• data included in contracts – until the contractual claims become barred by limitation (up to 10 years from the contract completion date);
• for the purposes required under applicable law, in particular the obligation to retain accounting documentation, issue invoices, etc.;
• statutory warranty and complaint-related documentation shall be stored for 1 year after the expiration of the statutory warranty period or after complaint settlement; Data retained for marketing purposes:
  • data processed on the basis of consent – until withdrawal of such consent;
  • data processed on the basis of Turll’s legitimate interest – until an objection to data processing is filed;
• data provided via a contact form – until any possible claims become barred by limitation (up to 3 years).

Rights related to personal data processing

You have the right to access, rectify, delete, limit the processing of, transfer, object to the processing of and withdraw your consent to the processing of your personal data at any time, which shall not affect the lawfulness of processing based on consent before its withdrawal (provided that the processing is based on consent).

Furthermore, if you consider that the processing we carry out infringes the provisions of GDPR, you have the right to lodge a complaint with the data protection supervisory authority.

Automated data processing (profiling)

Your personal data will be processed automatically (including in the form of profiling), but this shall not have any legal effect on you or significantly affect you in a similar way.

Personal data profiling by Turll involves the processing of your data (also by automated means), by using it to evaluate certain information, in particular to analyse or forecast personal preferences and interests.