NOVATERA TRADE LTD Privacy Policy

This Privacy Policy applies to all personal data related to you that we collect and process through our official website (novateratrade.com), email (manager@novateratrade.com), offline communication, order processing, and other channels. Whether you are a resident of the EU or not, this policy applies to you as long as your personal data processing is governed by the EU GDPR.

(I) Types of Personal Data Collected

1. Identifiable Data: Including but not limited to your name, contact information (email address, phone number, mailing address), company name (if a corporate client), etc., used to establish business contacts, process orders, and provide services.
2. Business-Related Data: Including but not limited to your order information, procurement needs, payment-related information (excluding sensitive payment data such as complete bank card passwords), logistics and delivery information, etc., used to complete transactions and fulfill contractual obligations.
3. Website Access Data: Including but not limited to your IP address, browser type, access time, pages viewed, duration of stay, etc., non-identifiable data, automatically collected through website backend statistical tools, used to optimize website performance and improve user experience.
4. Other Voluntarily Provided Data: Other personal data you voluntarily provide when communicating with us, providing feedback, or participating in activities. We will process this data based on the purpose for which you provide it.

(II) Data Collection Methods

1. Direct Collection: Personal data you proactively provide when registering a website account, submitting orders, sending inquiry emails, or conducting offline business negotiations.
2. Automatic Collection: Website access data automatically collected through website server logs, cookies, and similar technologies is used solely for website operation and optimization and is not used to identify individuals.
3. Third-Party Sources: Personal data obtained from legitimate and compliant third-party partners with your consent will have its legality verified.

We process your personal data only when there is a valid legal basis. The purposes and corresponding legal basis are as follows:

1. Fulfilling Contractual Obligations: Processing your orders, providing sports apparel and arranging logistics and delivery, and completing payment settlements are necessary for the performance of the contract between you and the government, in accordance with Article 6, Paragraph 1(b) of the GDPR.
2. Obtaining Your Consent: When collecting non-essential personal data (such as contact information for marketing purposes), we will obtain your explicit written or oral consent. In accordance with Article 6, Paragraph 1(a) of the GDPR, the processing is based on your consent.
3. Legitimate Business Interests: To optimize products and services, improve website experience, mitigate transaction risks, and maintain business communication with you (such as order progress notifications), the processing is in line with our legitimate business interests under Article 6, paragraph 1(f) of the GDPR and does not infringe upon your privacy rights.
4. Compliance with Legal Obligations: To respond to investigations by judicial authorities, fulfill tax declaration requirements, and comply with product quality traceability and other legal and regulatory requirements, the processing is necessary to comply with legal obligations under Article 6, paragraph 1(c) of the GDPR.

(I) Restrictions on Use

We will only use your personal data within the scope of the processing purposes stated in this policy, and will never use it for any other purpose beyond that scope without your consent or legal permission. If the processing purpose needs to be changed due to business adjustments, we will inform you in advance and obtain the necessary consent.

(II) Data Sharing

We promise not to sell, rent, or transfer your personal data to any unrelated third party, and will only share it to a limited extent in the following necessary scenarios:

1. Service Partners: To complete services such as order delivery and payment settlement, we will share necessary personal data with legally qualified logistics service providers, payment institutions, and design partners, requiring them to strictly comply with data protection obligations and not use it for other purposes.
2. Legal Requirements: In accordance with legal instructions from judicial or regulatory authorities, or to protect public interests and our own legitimate rights and interests, we will disclose necessary personal data to relevant departments.
3. Corporate Restructuring: In the event of mergers, acquisitions, asset transfers, or other corporate restructuring, personal data will be transferred to the transferee as part of the assets. The transferee must continue to comply with this Privacy Policy and relevant laws and regulations.

(I) Storage Period

We will store your personal data according to the principle of "minimum necessity, shortest duration," retaining it for the shortest time required to achieve the processing purpose. After the storage period expires, the data will be completely deleted through anonymization or secure deletion to ensure it cannot be recovered. If a legal requirement necessitates an extension of the storage period, we will retain the data in accordance with the law and notify you.

(II) Security Protection Measures

We employ technical and managerial security measures compliant with EU GDPR standards to protect your personal data from unauthorized access, use, disclosure, alteration, damage, or loss:

1. Technical Level: We utilize encrypted transmission, firewalls, access control, and data backup to provide end-to-end security protection for your personal data; website access uses the HTTPS protocol to ensure secure data transmission.
2. Management Level: We have established a strict data access permission system, authorizing only essential personnel to access personal data; we regularly provide data protection training to employees to enhance their privacy awareness; we have developed a data breach emergency plan, and in the event of a data breach, we will promptly take remedial measures and notify relevant regulatory agencies and affected individuals.

In accordance with the EU GDPR, you enjoy the following personal data-related rights, and we will facilitate your exercise of these rights:

1. Right to Know: You have the right to know the specific circumstances of our collection and use of your personal data, including the purpose of processing, data type, and scope of sharing.
2. Right to Access: You have the right to request a copy of your personal data and detailed information regarding data processing.
3. Right to Correction: If your personal data is incorrect or incomplete, you have the right to request that we correct or supplement it promptly.
4. Right to Erasure (Right to Be Forgotten): You have the right to request that we delete your personal data under legal circumstances, such as when the data processing purpose has been achieved, the storage period has expired, or you have withdrawn your consent.
5. Right to Limit Processing: You have the right to request that we limit the processing of your personal data in specific circumstances (such as when there is a dispute regarding the accuracy of the data).
6. Right to Data Portability: You have the right to request that we provide your personal data in a structured, universal, and machine-readable format for transfer to other data processors.
7. Right to Withdraw Consent: If you have consented to provide personal data, you have the right to withdraw your consent at any time. Withdrawal of consent will not affect the legal data processing previously carried out based on consent.
8. Right to Complain: If you believe that our personal data processing violates the EU GDPR or related laws and regulations, you have the right to file a complaint with the personal data protection regulatory authority within the EU.

Our website may use cookies and similar technologies to record website browsing preferences, optimize page loading speed, and track website traffic. You can refuse or delete cookies through your browser settings, but some website functions may be affected as a result. We will not collect your sensitive personal data through cookies, and cookies are only used for website operation and optimization purposes.

If your personal data needs to be transferred outside the EU for business purposes, we will ensure that the transfer complies with EU GDPR requirements and will only be conducted in the following circumstances: transfer to a country or region recognized by the European Commission as having an adequate level of data protection; signing a GDPR-compliant data processing agreement with the recipient, clearly defining the rights and obligations of both parties; and adopting compliant transfer mechanisms such as EU-recognized standard contract terms and company rules to ensure the security of cross-border data transfer.

We may revise this Privacy Policy based on updates to laws and regulations, business adjustments, etc. The revised policy will be published on our official website. If the revisions involve your core privacy rights, we will notify you in advance via email, website pop-ups, etc., to ensure that you are fully aware of the changes.