European Data Protection
Your GDPR Rights
As a European customer, you have comprehensive rights under the General Data Protection Regulation (GDPR). This page explains your rights and how to exercise them when dealing with Refinox.shop and Advan Hong Kong Technology Limited.
Last Updated: December 7, 2025 | GDPR Article 13 & 14 Compliant
1. Who This Applies To
European Union Coverage
You have GDPR rights if you are:
- EU/EEA Residents: Located in any EU or European Economic Area country
- UK Residents: Protected under UK GDPR following Brexit
- EU Citizens Abroad: EU citizens temporarily outside the EU
- EU Businesses: Companies established in the EU purchasing from us
Our Obligations
The data controller is Advan Hong Kong Technology Limited (Business Registration No. 80583797), RM 1307 13/F Kenbo Commercial Building, 335-339 Queen's Road West, Hong Kong. We process your data when you:
- Visit Refinox.shop or interact with our website
- Place a Cash on Delivery (COD) order by submitting your name, phone number and delivery address
- Contact customer support
- Interact with our advertising (Google Ads)
We sell exclusively on a Cash on Delivery basis. There is no online payment, no card or wallet processing, no shopping cart, and no user accounts or logins. You pay in cash (or as offered locally) when your order is delivered.
Cross-Border Data Processing
We are a Hong Kong company processing EU personal data, making us subject to GDPR Article 3(2). Your European rights apply regardless of our location.
EU Processor and Point of Contact
To fulfil and deliver your Cash on Delivery orders inside the European Union, the controller relies on an EU-based data processor (Art. 28 GDPR):
- Adamanta Sp. z o.o.
- ul. Jodlowa 25, 20-825 Lublin, Poland (EU)
- KRS 0001078676 | NIP/VAT PL7123467638 | REGON 527332151
Adamanta acts on the controller's documented instructions and receives your name, telephone number and delivery address in order to process and ship your order from within the EU, collect the Cash on Delivery payment, and handle returns. Adamanta is also our EU establishment and point of contact for European customers.
Legal Basis for Each Purpose
- Order fulfilment, delivery, COD collection and returns: performance of a contract (Art. 6(1)(b) GDPR).
- Customer support and handling your requests: performance of a contract and our legitimate interest in assisting you (Art. 6(1)(b) and 6(1)(f) GDPR).
- Compliance with accounting, tax and legal obligations: legal obligation (Art. 6(1)(c) GDPR).
- Analytics and advertising measurement (Google Analytics, Google Ads, Microsoft Clarity via Google Tag Manager): your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
- Securing the website and preventing abuse: our legitimate interest (Art. 6(1)(f) GDPR).
2. Your Eight Fundamental Rights
📋 Right to Information
Be informed about how your personal data is collected, used, and processed. This includes purposes, legal basis, retention periods, and your rights.
Immediate
👁 Right of Access
Request a copy of all personal data we hold about you, including how it's processed, where it came from, and who we share it with.
30 Days
✏️ Right to Rectification
Correct inaccurate personal data or complete incomplete information. This includes updating contact details, preferences, and account information.
30 Days
🗑 Right to Erasure
Request deletion of your personal data when processing is no longer necessary, unlawful, or you withdraw consent.
30 Days
⏸ Right to Restrict Processing
Limit how we use your data while we resolve disputes about accuracy, lawfulness, or legitimate interests.
30 Days
📦 Right to Data Portability
Receive your personal data in a structured, machine-readable format to transfer to another service provider.
30 Days
🚫 Right to Object
Object to processing based on legitimate interests, direct marketing, or profiling. We must stop unless we have compelling legitimate grounds.
30 Days
⚖️ Rights Related to Automated Decision-Making
Protection against decisions based solely on automated processing, including profiling, that significantly affect you.
30 Days
3. How to Exercise Your Rights
Request Process Timeline
1
Submit Request
Email support@refinox.shop with your request type and provide identity verification details
2
Identity Verification
We verify your identity within 72 hours using your order details (such as order number, name and delivery address) for security
3
Request Processing
Our privacy team reviews and processes your request, gathering relevant data and documentation
4
Response Delivery
Complete response sent within 30 days via secure email with all requested information or actions taken
Required Information for Requests
- Full Name: The name used for your order
- Contact Details: The email address and/or phone number you used to contact us or place your order
- Request Type: Specific right you want to exercise
- Verification Details: Recent order number and delivery address
- Specific Data: What particular information you're requesting (for access requests)
- Preferred Format: How you want to receive the information
Complex Request Handling
For complex or multiple requests, we may:
- Extend Timeline: Additional 60 days with notification and reasoning
- Request Clarification: Ask for more specific details about your request
- Charge Reasonable Fees: Only for excessive or repetitive requests
- Provide Partial Response: Deliver available data while processing remainder
4. Specific Rights in Detail
Right to Access - What You Can Request
- Personal Data Copy: All information we hold about you in portable format
- Processing Purposes: Why we collect and use your data
- Data Categories: Types of personal data we process
- Recipients: Who we share your data with (our EU processor Adamanta Sp. z o.o. for order fulfilment and delivery; Google for analytics and advertising)
- Retention Periods: How long we keep different types of data
- Source Information: Where we obtained your data if not directly from you
- Automated Decision-Making: Any automated profiling or decision systems used
- Transfer Safeguards: Protections for international data transfers
Right to Erasure - When It Applies
Important Limitations
We cannot delete data if we need it for legal obligations, contract performance, defending legal claims, or legitimate business interests that override your privacy rights.
We will delete your data when:
- Purpose Fulfilled: Data no longer needed for original purpose
- Consent Withdrawn: You withdraw consent and no other legal basis exists
- Unlawful Processing: Data was processed illegally
- Legal Obligation: Deletion required by law
- Valid Objection: You successfully object and no overriding interests exist
Right to Data Portability - Technical Details
- File Formats: JSON, CSV, or XML formats for structured data
- Included Data: Order details (name, phone, delivery address), order history and support communications you have provided
- Direct Transfer: We can send data directly to another service (where technically feasible)
- Security Measures: Encrypted delivery and secure authentication required
5. Automated Decision-Making and Profiling
What We Use Automated Processing For
- Ad Targeting: Google Ads uses automated profiling for relevant advertisements, based on your consent
- Audience Measurement: Google Analytics and Microsoft Clarity help us understand aggregate website usage, based on your consent
Your Rights Regarding Automated Decisions
- Human Review: Request human intervention in automated decisions
- Challenge Decisions: Contest automated decisions that significantly affect you
- Explanation: Understand the logic behind automated decision-making
- Opt-Out: Refuse automated decision-making where possible
Good News
We do not make automated decisions that have legal effects or similarly significant impact without human oversight. Critical decisions, such as cancelling or rejecting an order, always involve human review.
6. Data Transfers and International Processing
Where Your Data Goes
- European Union (Poland): Order fulfilment, delivery, COD collection and returns handled by our EU processor Adamanta Sp. z o.o. in Lublin
- Hong Kong: The data controller, Advan Hong Kong Technology Limited, has access to order and support data
- United States: Google services (Google Analytics, Google Ads, Google Tag Manager) and Microsoft Clarity for analytics and advertising, based on your consent
Transfer Safeguards We Use
Hong Kong has not received a European Commission decision recognising an equivalent level of data protection. Any transfer of your personal data from the EU to Hong Kong (to the controller, Advan Hong Kong Technology Limited) is therefore protected by the following safeguards:
- Standard Contractual Clauses (SCC): EU-approved Standard Contractual Clauses are the legal mechanism for EU-to-Hong Kong transfers
- EU Processing Where Possible: Order fulfilment, delivery and returns are carried out within the EU by Adamanta Sp. z o.o. in Poland
- Technical Measures: Encryption, access controls and data minimisation
Your Rights Regarding International Transfers
- Information: Right to know about transfers and safeguards
- Objection: Object to transfers to specific countries or companies
- Copies: Request copies of safeguard documents
- Complaints: Raise concerns with supervisory authorities
7. Complaints and Enforcement
Supervisory Authority Complaints
If you're unsatisfied with our response, you can lodge complaints with:
- Your Local DPA: Data Protection Authority in your EU country
- Lead Supervisory Authority: Where we have our main EU establishment
- UK ICO: Information Commissioner's Office for UK residents
- One-Stop-Shop: Single point of contact for cross-border complaints
Useful Supervisory Authority Contacts
Judicial Remedies
- Court Proceedings: Right to pursue compensation through courts
- Damages: Material and non-material damages for GDPR violations
- Representative Actions: Consumer organizations can act on your behalf
- Legal Costs: Potential recovery of legal costs for successful claims
Our Commitment
We aim to resolve all GDPR concerns directly with you. Most issues can be resolved through dialogue without the need for formal complaints or legal action.