Privacy Policy

1. Scope of Application

This Privacy Policy is formulated in accordance with the EU General Data Protection Regulation (GDPR) and related data protection regulations. It applies to the collection, use, storage, transmission, and protection of personal data by ORION TECH TRADE LTD (hereinafter referred to as "our company", website: oriontechbiz.com; contact email: office@oriontechbiz.com) in its business activities of providing large-capacity tote bag products and related services to natural persons within the EU/EEA.

Regardless of whether our company has a business establishment within the EU, as long as you are a natural person within the EU and our services are provided for the EU market (including but not limited to website support for EU member states' languages and acceptance of commonly used EU currencies), this policy applies to you.

2. Definition and Scope of Collection of Personal Data

(I) Definition of Personal Data "Personal data" as referred to in this policy means any information that can identify a specific natural person alone or in combination with other information, including but not limited to name, email address, telephone number, mailing address, payment information, device IP address preferences, etc. Information that has been anonymized or aggregated and cannot identify a specific individual is not included in the category of personal data.

(II) Types of Personal Data Collected

Service-Necessary Information: Information you proactively provide when browsing the official website, inquiring about products, or submitting orders, such as name, contact information, shipping address, and payment account information;

Technology-Related Information: Device type, browser version, IP address, access time, and page browsing history automatically collected by the system when you visit oriontechbiz.com, used to ensure the normal operation of the website and optimize the service experience;

Communication and Feedback Information: Inquiries, complaints, suggestions, etc., that you provide through office@oriontechbiz.com or other channels, and supplementary information required to handle such matters.

3. Legal Basis and Purpose of Data

Processing Our company will only process personal data when there is a legal basis, specifically including:

Obtaining your explicit consent: If you agree to receive marketing information such as new product recommendations, this consent must be given by you through clear actions such as actively checking boxes or clicking confirmation. Pre-selected options do not constitute valid consent;

Fulfilling contractual obligations: To complete the delivery of tote bag orders, after-sales service, and other contractual matters, such as using your address to arrange logistics and delivery, and using payment information to complete transaction settlement;

Complying with legal obligations: Retaining order records, payment vouchers, and other data in accordance with the relevant laws of the EU and its member states; Protecting legitimate rights and interests: Necessary processing actions to safeguard the legitimate rights and interests of you and our company in cases of handling product quality complaints and responding to legal disputes. 4. Rules for the Use and Sharing of Personal Data

(I) Restrictions on Use

Our company will only use the collected personal data for the following specific purposes, and the scope of use will not exceed the necessary limits for achieving those purposes:

Providing and optimizing tote bag products, including order processing, logistics tracking, and after-sales support;

Communicating with you on service-related matters, such as order confirmation and after-sales problem resolution;

If you have agreed, pushing marketing content such as new product information related to tote bags to you;

Ensuring the security of the official website and analyzing service usage to improve user experience;

Fulfilling legally mandated information disclosure obligations.

(II) Sharing Restrictions Our company promises not to share your personal data with third parties indiscriminately, and will only share it to a limited extent in the following circumstances:

Service Partners: Only with those who facilitate order delivery (such as logistics companies) and payment settlement (such as third-party payment institutions), and such partners must sign a data processing agreement, promising to comply with this policy and EU data protection requirements, and processing data only for specific purposes;

Legal Requirements: Disclosure of personal data to the extent necessary in accordance with the lawful directives of regulatory and judicial authorities of EU member states;

Rights Protection Needs: When necessary to protect your or other entities' personal or property safety, or to address significant public interest needs.

5. Core Rights of Data Subjects

According to GDPR As the data subject, you have the following rights, and our company will provide necessary support for you to exercise these rights:

Right to Know: You have the right to request our company to inform you of the purpose of your personal data collection, processing methods, storage period, etc. (except for content already specified in this policy);

Right to Access and Correction: You have the right to inquire about the details of your personal data held by our company and to request correction if there are errors in the data;

Right to Erasure (Right to Be Forgotten): You have the right to request our company to delete your personal data in the following circumstances: the data is no longer necessary to process, you withdraw your consent and there is no other basis for processing, you object to the data processing and have no priority interest, the data processing is illegal, or our company is obligated to delete it;

Right to Restrict Processing: When the accuracy of the data is questionable, the processing is illegal but you object to deletion, or the data is no longer necessary but you need it for rights protection, you have the right to request restrictions on the processing of the data;

Right to Data Portability: You have the right to request our company to provide your personal data in a structured, universally readable format, or to directly transfer it to other data controllers;

Right to Withdraw Consent: If the data processing is based on your consent, you have the right to withdraw your consent at any time, and the withdrawal will not affect the validity of the processing based on legal consent before the withdrawal. The process for withdrawing consent is just as simple as the process for giving consent. To exercise the above rights, you can send a written application to office@oriontechbiz.com, and we will respond within one month; in complex cases, this may be extended to two months, but we will inform you of the reasons for the extension in advance.

6. Data Storage and Cross-border Transfer

(I) Storage Period

We will determine the data storage period according to the principle of "minimum necessity":

Data collected to fulfill contractual obligations will be stored until the order is completed and the after-sales service period expires (usually the product warranty period ends);

Data collected based on your consent will be stored until you withdraw your consent or the marketing purpose is achieved;

Data collected to comply with legal regulations will be stored until the statutory period expires.

After the data exceeds the storage period, we will dispose of it using anonymization or secure destruction methods to ensure that it cannot be used to identify a specific individual.

(II) Cross-border Transfer Your personal data may be collected within the EU and then transferred to our operations center in China for storage and processing, and may be processed with the assistance of our partners in China (such as logistics coordination). We ensure that cross-border transfers comply with GDPR requirements: We have taken safeguards such as encrypted transmission, signed data processing agreements, and passed the European Commission's "adequacy assessment" mechanism to ensure that your personal data is protected at the same level as within the EU during transmission and overseas processing.

7. Data Security Measures

We regard data security as a core part of our operations and have adopted multi-layered protection measures: Technical safeguards: We use SSL encryption technology for oriontechbiz.com and data storage systems, set access control, and regularly conduct security vulnerability scans and system upgrades;

Management standards: We have established internal data processing procedures, provided GDPR compliance training to employees who handle personal data, and clarified data protection responsibilities; Emergency response: We have developed a data breach emergency plan. In the event of a personal data breach, we will notify EU regulatory authorities and you (if the breach may result in damage to your rights) within 72 hours of discovery and take remedial measures to mitigate the risks.

8. Child Personal Data Protection

If you are a child under the age of 16, you must obtain the explicit consent of your parent or legal guardian before using our services or providing your personal data.

If we discover any child's personal data without the prior consent of their guardian, we will immediately cease processing and delete the relevant information.

9. Policy Updates and Consultations

We will revise this Privacy Policy in a timely manner based on updates to EU data protection regulations and business developments. The updated policy will be prominently displayed on the homepage of oriontechbiz.com and will be communicated to users who have provided their contact information via office@oriontechbiz.com. It will take effect 7 days after the update. If you have any questions about this policy or believe that your personal data rights have been violated, you can contact our data protection officer at office@oriontechbiz.com.

You also have the right to file a complaint with the National Data Protection Authority (DPA) of an EU member state.