Privacy notice

01The short version

We collect the details needed to take an order, deliver it and answer your messages. We do not sell personal data, and we do not hand it to anyone for their own marketing.

From the first page, the Google advertising tag sends Google signals without cookies — the page seen, the time and, after an order, its value — so that we can measure what our adverts sell, whatever you choose in the cookie notice. Google's advertising cookies and remarketing are added only if you accept them. Saying no changes nothing about how the shop works for you.

We are established in Hong Kong and we sell to customers in the European Union, so this notice is written under the EU General Data Protection Regulation, which applies to us under its Article 3(2), and under the Hong Kong Personal Data (Privacy) Ordinance. Wherever you live, you can use the rights described further down.

02Who is behind this site

The data controller — the company that decides how your personal data is used — is WHATECH MOBILE CO., LIMITED (contact person: Huanbin Lin), Room 505, 5th floor, Beverley Commercial Centre, 87-105 Chatham Road South, Tsim Sha Tsui, Kowloon, Hong Kong. It is the seller: it buys the goods it sells, takes your order, confirms it by phone, sends it out, collects payment on delivery and deals with returns and warranty claims.

The same company built this website and runs it, runs its advertising and its Google Ads campaigns, and holds the advertising accounts. Whatever your question is — an order, a parcel, a return or your data — WHATECH MOBILE CO., LIMITED is the one to ask, at info@gadibox.com.

Anything that concerns your personal data goes to a separate address, privacy@gadibox.com, read by the person responsible for it. The desk is open every day, 08:00–20:00 Central European Time; we answer data requests within 30 days.

03What we collect

It depends on what you do on the site:

• When you order: your name, the delivery address with country and postcode, phone number, email address, the products you chose and the way you pay.
• When you write to us: your name, your email address, the order number if you give one, and whatever you put in the message.
• Automatically: the IP address an order or a message came from, plus basic technical details about your browser, used among other things to recognise fake orders.
• When you start filling in an order form: your browser makes one call to a fraud-prevention service that works for us. The service sees what any request carries — the IP address and the type of browser — and no cookie is sent or written for it. When you send the order, the service's answer goes with it, together with your screen size, your browser's language and time zone, the time on your device, the page you are on and the page that brought you to it. It is used only to check that an order is genuine, never for advertising.
• For measuring our adverts, from the first page and whatever you choose about cookies: what our advertising tags send — the page seen, the time and, after an order, its value and a reference number — as described in the cookie notice.
• With your agreement: Google's advertising cookies, used for more precise measurement and for showing our products again on other platforms (remarketing).

There is nothing here about card or bank details, because the shop never asks for them: you pay the driver in cash when the parcel is handed over. See payment methods.

We do not ask for special category data — health, beliefs, anything of that kind — and we would rather you did not write it to us.

04Why we use it, and on what legal basis

Data protection law asks us to name a legal basis for each use. Here they are, one by one:

• Handling your order — confirming it by email or phone, passing delivery details to the carrier, dealing with returns and warranty claims. Basis: the contract between you and us.
• Answering your messages — replying to what you sent through the contact form or by email. Basis: steps taken at your request, and our legitimate interest in supporting customers.
• Keeping records — the invoices and accounts that tax law obliges us to keep. Basis: a legal obligation.
• Stopping abuse — checking orders, IP addresses, phone numbers and the check made when you fill in an order form for signs of fraud before goods leave the warehouse. Basis: our legitimate interest in protecting the business and its customers.
• Measuring our advertising — counting which adverts bring visits and orders, and what those orders are worth, with the signals our advertising tags send from the first page, whatever you choose in the cookie notice. Basis: our legitimate interest in knowing what our advertising sells; you can object to it, as explained below.
• Advertising with Google's cookies — the advertising cookies that tie a visit more precisely to the Google advert that brought it, and showing our products again on other platforms (remarketing). Basis: your consent, which you can withdraw whenever you like.
• Improving the shop — aggregate figures on which pages and products people use. Basis: our legitimate interest in running a shop that works.

We do not take decisions about you by purely automated means that would have a legal or similarly significant effect on you.

05Who else handles your data, and where they are

This is the whole list. Nobody outside it receives anything.

• Vercel Inc., United States — our hosting provider and the registrar of our domain: hosts this website and delivers its pages. It processes the technical request data every website receives, and holds the runtime logs in which an order or a message first lands. Processor, under a data processing agreement.
• Your data comes to us. Where a service provider works for us — for the telephone confirmation of your order, or for technical operations — it acts on our instructions, sees only what that task needs and may not use it for anything of its own.
• The courier or postal operator in your country — receives your name, delivery address, phone number and the amount to collect at the door, because a parcel cannot be delivered without them. The courier is chosen per country; we tell you which one on the confirmation call, or whenever you ask.
• Customs authorities, where a parcel crosses a border that requires a declaration — the details that country's rules oblige us to state.

Advertising and measurement. From the first page, the Google tag sends Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) signals without cookies — the page seen, the time and, after an order, the conversion with the order value — so that we can measure the sales our Google Ads bring, whatever you choose in the cookie notice. Accept advertising cookies, and Google's advertising cookies and remarketing are added; decline, and only the cookieless signals remain: no Google cookie, no advertising identifier. What Google does with the data is set out in the cookie notice and under how Google uses it.

This site uses no Meta (Facebook, Instagram) pixel.

The advertising accounts those tools report to are in the name of WHATECH MOBILE CO., LIMITED, which pays for them and answers for them.

We do not sell personal data, we do not rent it out, and we do not pass it to anyone for their own marketing.

06Data sent outside the European Economic Area

We are established in Hong Kong, and some of the organisations above are based in, or use servers in, other countries outside the European Economic Area — the United States among them.

The European Commission has not adopted an adequacy decision for Hong Kong. When you place an order, the details we need to take it, confirm it and deliver it reach us in Hong Kong because that transfer is necessary to perform the contract between you and us (Article 49(1)(b) GDPR).

For everything else we rely on the safeguards the law provides: the standard contractual clauses adopted by the European Commission in Decision 2021/914, signed with each provider that sits outside the European Economic Area — Vercel in the United States among them — together with the technical measures that go with them, encryption in transit and access limited to the people who need it. Ask at privacy@gadibox.com and we will send you a copy of the clauses that cover your data.

07How long we keep it

Real periods, counted from the event named, not "as long as necessary":

• A completed order, with the invoice and the delivery record: 7 years from the end of the financial year, the period the Hong Kong Inland Revenue Ordinance sets for business records.
• An order that was never confirmed — the phone rang out, or you decided against it on the call: 90 days, then it goes.
• Messages sent through the contact form or by email: 24 months after the last reply, so a warranty question can be traced back to what was said.
• Technical logs — IP address, browser, the pages a request touched: 12 months, kept for security and for tracing abuse.
• Your cookie answer: 12 months from the day you gave it, after which the notice asks again.
• Withdrawal and refund records: 7 years, with the accounting records they belong to.

At the end of a period the record is deleted, or stripped of everything that points back to a person and kept only as a number in a total.

08Children

This shop sells household, garden, car, personal care and gadget items to adults. It is not aimed at anyone under 16, we do not market to that age group, and we do not knowingly collect their personal data.

If you are a parent or guardian and believe a child has sent us something, write to privacy@gadibox.com and we will delete it.

09How Google uses it

We advertise on Google, so this deserves its own section rather than a line in a list.

The Google tag is loaded from the first page in its restricted state. Google Consent Mode v2 is in place, with every advertising and analytics signal set to denied until you accept: in that state the tag writes no cookies and sets no advertising identifier, and it sends only cookieless signals — that a page was seen, when, and on the thank-you page the conversion with the order value. It stays that way if you decline. If you accept advertising cookies, the consent signal is updated and the tag works normally, with its cookies.

From those cookieless signals Google Ireland Limited learns that a page was seen and whether a visit ended in an order, with the order value and a reference number that means nothing outside our own records; it uses them to measure our campaigns whatever you choose, and we rely on our legitimate interest in knowing what our advertising sells. With your agreement it also uses its advertising cookies: it can then tie a visit to the advert it followed and to the pages of the shop it touched, report on our campaigns more precisely and show our products to you again elsewhere.

What Google does not get from the pages of this shop: your name, your address, your phone number, the contents of a message you sent us, or what you hand the driver. We do not upload customer lists to it.

Google is an independent controller for what it does with the data afterwards; its own account of that is in the Google privacy policy (policies.google.com/privacy), and you can limit the use made of it in Google's ad settings (adssettings.google.com).

10What you can ask of us

At no cost, you can ask us to:

• Show you what we hold about you and give you a copy.
• Correct anything that is wrong or incomplete.
• Erase your data where we have no legal duty to keep it.
• Restrict what we do with it while a question is being settled.
• Hand it over in a machine-readable format, to you or to another company.
• Stop any use based on our legitimate interests, and any marketing use, without telling us why.
• Withdraw consent to advertising cookies, at any moment, as explained in the cookie notice.

Write to privacy@gadibox.com from the address you ordered with, or quote the order number, so that we can find the right records. An answer comes within 30 days, and it costs you nothing.

If a request is unusually broad we may ask you for one more detail to narrow it down — never as a way of putting it off.

11If you are unhappy with our answer

Tell us first, at privacy@gadibox.com — most things are settled in one exchange of emails.

You do not have to stop there. You may complain to the data protection authority of the country where you live or work, or where you think the problem happened; every EU and EEA country has one, and the complaint is free. Where we are established, the authority is the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk).

12Contact, and changes to this notice

For anything about personal data: privacy@gadibox.com. For an order, a parcel or a return: info@gadibox.com. By post, to Huanbin Lin at Room 505, 5th floor, Beverley Commercial Centre, 87-105 Chatham Road South, Tsim Sha Tsui, Kowloon, Hong Kong.

If we change the way data is used, this page and the date at the top change with it. A change that affects you materially — a new processor, a new purpose — is also announced on the site, and we do not apply it retrospectively to data already collected.