Privacy notice

The data controller — the company that decides how your personal data is used — is WHATECH MOBILE CO., LIMITED. It is the seller: it buys the goods it sells, takes your order, confirms it by phone, sends it out, collects payment on delivery and deals with returns and warranty claims. “We” and “us” on this sheet mean that company.

The same company built this website and runs it, runs its advertising and its Google Ads campaigns, and holds the advertising accounts. Whatever your question is — an order, a parcel, a return or your data — WHATECH MOBILE CO., LIMITED is the one to ask, at desk@outletden.com.

Data protection has its own address: privacy@outletden.com. Write there and the message goes straight to the people who deal with access, correction and deletion requests, and is answered within 30 days. Ordinary questions about an order are faster at the contact desk, which replies within 2 working days. You may also write to the postal address below. No data protection officer sits behind that address: a shop of this size and kind is not obliged to appoint one, and we would rather you had the address of the people who actually do the work than the title of a post nobody holds.

We are a company established in Hong Kong, where the Personal Data (Privacy) Ordinance applies to us.

We also offer goods to people in the European Union. Under Article 3(2) of the EU General Data Protection Regulation (GDPR), that regulation applies to our handling of the personal data of customers and visitors who are in the EU, even though we are established outside it. If you are in the EU, your data is handled under the GDPR, and where the two sets of rules differ we apply whichever gives you the stronger protection.

The adverts for this site are planned, paid for and managed by us. Every advertising account behind them, Google Ads included, stands in the name of WHATECH MOBILE CO., LIMITED, is settled from its own funds, and is its responsibility towards you.

What runs today. The site loads the Google Ads tag, on the terms in section 4 and in the Cookies and storage sheet. It writes no advertising cookie before you agree to one. No other advertising or analytics product runs on this site.

When a campaign does start, what reaches us is arithmetic: impressions, clicks, and the number of orders that followed, with what they came to. We never receive a list of who those people are, and we do not build profiles of visitors. Section 4 sets out what Google would receive, and the Cookies and storage sheet names every cookie involved.

We stay answerable to you for that measurement. Every right in section 10 can be exercised by writing to privacy@outletden.com.

Who Google is here. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with Google LLC in the United States, would act as our processor for advertising measurement and as a controller for its own purposes, under the terms it publishes for Google Ads.

The tag starts in Google Consent Mode v2 with advertising storage, advertising user data, advertising personalisation and analytics storage all set to denied, and it stays that way until you answer the cookie question. Decline, and it writes nothing and reads nothing for as long as that answer stands.

Before you consent. Under Consent Mode v2 in the denied state, the tag writes no advertising cookie and reads none. It may send Google a cookieless ping saying a page was opened, which like any request to any server carries your IP address, your browser type and the address of the page. Google uses those pings for aggregate, modelled reporting: they do not identify you and they do not personalise adverts.

After you consent. The tag may set the Google cookies listed on the Cookies and storage sheet and report that a visit which followed one of our adverts ended in an order, with the order value in euro, the ticket reference and the currency. That is the conversion, and it is all the shop needs.

What Google is never sent by us. Your name, your delivery address, your phone number, your email address, the text of any message you send the desk and the bank details you give for a refund. We do not use enhanced conversions, we upload no customer lists, and we send Google no offline order file.

Your grip on it. “Cookie settings” in the footer of every page turns advertising consent off again at any moment, and your own Google account settings govern advert personalisation across every site you visit, not just this one. Google describes its own handling in its privacy policy and in its page on how it uses information from sites that use its services.

Order form. First name, last name, phone number, delivery address (street, town, postcode, country), email if you choose to give one, delivery notes if you write any, the item and quantity ordered and the total. With the order we record the date and time, the IP address it came from and a campaign label showing which advert or page led to the order (a label for the campaign, not a profile of you).

Order form on the country offer pages. That form asks for three things only: your full name, your phone number and your address. With them we record the IP address the order came from, plus basic technical details about your browser, used among other things to recognise fake orders; the date and time; and the campaign parameters of the link that brought you to the page: the utm fields, the subid and, when the link carried no subid, Google’s click identifier (gclid) in its place.

Confirmation call. Whether and when the order was confirmed, corrections you give us (address, quantity) and short notes such as “call back after 17:00”.

Contact desk. The topic you pick, your name, email address, order reference if you give one, the message itself, the date and time, and the IP address the message came from.

Delivery, returns and refunds. Delivery status reported by the courier (delivered, not at home, refused), the content of a withdrawal or guarantee request, photos you send us, and, for a refund, the account holder’s name and IBAN of the account to be credited.

Technical data. Like every website, the servers that deliver this site process your IP address, the time of the request, the page requested and the browser type, in order to send you the page and keep the service secure.

Cookies and browser storage. A few small entries that the site needs to work, plus the one that remembers your cookie answer, are written to your browser’s storage. An advertising cookie is written only with your agreement, and only while a campaign is running (section 4). Every entry is listed by name on the Cookies and storage sheet.

What we do not collect. No card or payment data (you pay the courier in cash), no identity documents, no special categories of data such as health data, and no account or password: there are no customer accounts on this site. We do not buy data about you from anyone.

You are not obliged to give us any data. Without a name, a phone number and a delivery address, though, we cannot confirm or deliver an order, so those fields are required on the order form. Email is optional there.

Where we rely on legitimate interests, we have weighed them against your interests and keep the use narrow. You may object at any time (section 10).

We do not send newsletters, and we do not use your phone number or email for marketing.

Your data comes to us. Where a service provider works for us — for the telephone confirmation of your order, or for technical operations — it acts on our instructions, sees only what that task needs and may not use it for anything of its own. Every processor works under a written contract that binds it to our instructions, to confidentiality and to deleting or returning the data when the job ends. Whatever your question, write to privacy@outletden.com: we answer you ourselves.

Google receives nothing at all unless you accept advertising cookies, and it also uses what it receives for its own purposes under its own policies.

To know which courier is handling your particular order, ask on the confirmation call or write to privacy@outletden.com with your ticket number, or the phone number you ordered with, and we will tell you.

We are established in Hong Kong, and some of the organisations above are based in, or use servers in, other countries outside the European Economic Area — the United States among them.

Your order is placed from the EU with a company established in Hong Kong, for which the European Commission has not adopted an adequacy decision. The details we need to take, confirm and deliver your order therefore reach us there because that transfer is necessary to perform the contract between you and us, as Article 49(1)(b) of the GDPR allows. Nothing beyond what the order requires is sent on that basis.

For everything else — the hosting of this website by Vercel in the United States (section 7), and any advertising measurement once a campaign runs — the transfer rests on the European Commission’s standard contractual clauses of Decision 2021/914, signed with each provider concerned and backed by whatever extra technical and organisational measures their transfer assessments call for.

A provider certified under the EU–US Data Privacy Framework has that behind it too. We keep the clauses as the working basis all the same, so that no transfer rests on a certification that might lapse.

A copy of the clauses covering a particular transfer is yours for the asking: write to privacy@outletden.com and say which one you mean.

Orders that were delivered, with their delivery and refund records: for as long as tax and accounting law obliges us to keep business records, which is 7 years from the end of the financial year of the order, the period the Hong Kong Inland Revenue Ordinance sets for business records. After that they are deleted or made anonymous.

Orders that were never confirmed, or were cancelled before dispatch: up to 90 days, so that we can answer questions and spot repeated fake orders, then deleted or made anonymous.

Contact desk messages: up to 24 months after the last message in the conversation, unless they belong to an order, a return or a guarantee claim, in which case they are kept with that record.

Bank details given for a refund: kept with the refund record for the accounting period above and used for nothing else.

IP addresses held to prevent abuse, including blocks: up to 12 months from the last event.

Technical logs of requests to the site, held by the hosting provider named in section 7: up to 12 months, then overwritten. Where an order or a desk message passes through those logs, its content is taken into the order or message record and from then on follows the period in 9.1 or 9.3.

Your answer to the cookie question: 12 months, in your own browser. After that the question is put again. We keep no copy of it on our side, so withdrawing consent is a matter of your browser and not of our records.

Other entries in your own browser: until you clear them or replace them; any advertising cookie expires on the schedule printed on the Cookies and storage sheet.

Where a dispute is open, the relevant records are kept until it is closed and any limitation period has passed.

Access. To know whether we hold data about you and to receive a copy of it.

Rectification. To have wrong or incomplete data corrected.

Erasure. To have data deleted where we no longer need it, where you withdraw consent or where you validly object. Records we must keep by law (section 9) are restricted instead of deleted until the period ends.

Restriction. To have the use of your data paused while a question about it is settled.

Portability. To receive the data you gave us for your order in a common machine-readable format, or have it sent to another controller where that is technically feasible.

Objection. To object, on grounds relating to your situation, to any use we base on legitimate interests. We stop unless we have compelling grounds that override yours or need the data for legal claims.

Withdrawing consent. For advertising cookies: at any time through “Cookie settings” in the footer of every page. Withdrawal does not affect what was lawfully done before it.

To use a right, write to desk@outletden.com. We may ask for a detail of your order (for example the phone number used) to be sure we are talking to the right person. We answer within one month; if a request is complex we may extend that by up to two months and will tell you so within the first month.

Please tell us first: most things can be fixed with one email. You also have the right to lodge a complaint with a supervisory authority at any time.

The authority for the country where we are established is: Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk).

If you live in the EU, you may instead complain to the data protection authority of the country where you live or work, or where you think the infringement took place. That authority will deal with your complaint in your own language.

The site is served only over an encrypted connection. Forms are protected by time-limited security tokens against forged requests, and repeated submissions from one connection are limited. There are no customer accounts and no passwords to steal. Order and message records sit in access-controlled systems that only authorised staff and the recipients in section 7 can reach, each of them for one task and no more.

No system is perfectly secure. If a breach is likely to put your rights at high risk, we will tell you and the competent authority without undue delay, as the law requires.

Children. Nothing here is aimed at anyone under 16: not the goods, not the adverts, not the wording. We do not knowingly collect data from a child, and we offer no service a child could sign up to, since the site has no accounts at all. Orders may in any case only be placed by people aged 18 or over, who can enter into a contract. If you are a parent or guardian and believe a child has sent us something, write to privacy@outletden.com and we delete it without asking for anything in return.

We do not take decisions about you by purely automated means that have legal or similarly significant effects. The automatic controls are the abuse checks in section 6: several orders from one connection within minutes are blocked automatically; on an offer page, one phone number gets at most two orders per product in a day, and a further one is not passed on; and the IP address and basic browser details recorded with each offer-page order help recognise fake ones. If one of them catches you by mistake, write to us and a person looks into it.

When the way we handle data changes, this sheet changes with it and the revision date in the header moves. If a change matters to an order in progress, we tell you directly. The version shown here is the one in force.