HOME / PRIVACY
Privacy Policy
Effective 2026-01-01 · Last updated 2026-08-01 · GDPR & CCPA compliant. 1BOM International Limited ("we") is the data controller.
1 · What We Collect
- Business Contact
- Name, company name, business email, phone, country/region · collected when you request a quote, register, or contact us
- Transaction Data
- Purchase orders, invoices, shipping addresses, payment method (last-4 of card / bank tokens only — full details processed by Stripe/PayPal)
- Communication
- Email threads, chat transcripts, RFQ history — retained for support and dispute resolution
- Technical
- IP address, browser, pages visited, referrer · via cookies (see Cookie Policy)
2 · Why We Process
- Legitimate Interest
- Fulfilling B2B commercial transactions · providing quotes · shipping · invoicing · after-sales support
- Legal Obligation
- Tax records (7 years) · export control screening · anti-money-laundering compliance
- Consent
- Marketing emails (optional) · newsletter subscription · beta product invitations
3 · Your GDPR / CCPA Rights
- Access
- Request a copy of your data · we respond within 30 days
- Rectification
- Correct inaccurate data · one email to dpo@1bom.com
- Erasure
- Delete your account/data · subject to tax record retention (7 years for invoices)
- Portability
- Receive your data in machine-readable JSON/CSV
- Object
- Opt out of marketing at any time · one-click unsubscribe in every email
- Restrict
- Limit processing during dispute resolution
- Withdraw Consent
- For consent-based processing · no effect on lawful processing already completed
4 · Data Sharing
- Payment Processors
- Stripe (US) · PayPal (US) · Wise (UK) · for payment processing only
- Shipping Carriers
- DHL · FedEx · UPS · address only for delivery
- Cloud Infrastructure
- AWS (US/EU) · Cloudflare (global) · for hosting and CDN
- Compliance Screening
- OFAC · BIS · EU sanctions lists · automated screening only
- We Do Not Sell
- Your data is never sold to third parties for marketing or profiling
5 · Data Residency
- Primary
- Hong Kong (APAC region)
- EU Buyers
- Data replicated to Frankfurt AWS region · GDPR-compliant transfer via SCCs
- US Buyers
- Data replicated to Virginia AWS region
- Backups
- Encrypted at rest (AES-256) · encrypted in transit (TLS 1.3)
6 · Retention
- Contact / Communication
- 3 years from last interaction · then anonymized
- Transaction Records
- 7 years (tax compliance requirement)
- Website Analytics
- 26 months (Google Analytics default)
- Marketing Consent
- Until withdrawal + 6-month grace
7 · Contact · Data Protection Officer
- DPO Email
- dpo@1bom.com
- Postal
- Attn: DPO · 1BOM International Limited · [HK registered address]
- Response Time
- Within 30 days per GDPR Article 12(3)
- Supervisory Authority
- You may lodge a complaint with your local DPA if you feel we've mishandled your data