Privacy notice

The controller of the personal data described on this sheet is WHATECH MOBILE CO., LIMITED, the company that sells the goods on this site, ships them and handles returns. “We” and “us” on this sheet mean that company.

For anything about your data, write to desk@outletden.com with “Privacy” in the subject line, use the contact desk form (topic “Privacy request”), or write to the postal address below. We have not appointed a data protection officer, as the law does not require one for a business of our kind and size; privacy requests are handled by the same people who run the desk.

We are a company established in Hong Kong, so the UK General Data Protection Regulation and the Data Protection Act 2018 apply to us.

We also offer goods to people in the European Union. Under Article 3(2) of the EU General Data Protection Regulation (GDPR), that regulation applies to our handling of the personal data of customers and visitors who are in the EU, even though we are established outside it. If you are in the EU, your data is handled under the GDPR as it applies to you, alongside the UK GDPR. Where the two differ, we apply whichever gives you the stronger protection.

Adverts for this site are planned, paid for and managed by a separate company, the advertising operator. It runs the advertising accounts. It is not the seller, takes no orders, ships nothing and is not a party to your contract.

What the operator sees is campaign reporting: how many people saw or clicked an advert and how many orders followed, with their value. We do not pass it your name, address, phone number, email or the content of your order. The advertising tags that make this reporting possible only use cookies if you agree to advertising cookies (section 4.6 and the Cookies and storage sheet).

For this advertising measurement the operator acts on our behalf and on our instructions. We remain responsible to you for it, and you can exercise all the rights in section 9 by writing to us.

Order form. First name, last name, phone number, delivery address (street, town, postcode, country), email if you choose to give one, delivery notes if you write any, the item and quantity ordered and the total. With the order we record the date and time, the IP address it came from and a campaign label showing which advert or page led to the order (a label for the campaign, not a profile of you).

Confirmation call. Whether and when the order was confirmed, corrections you give us (address, quantity) and short notes such as “call back after 17:00”.

Contact desk. The topic you pick, your name, email address, order reference if you give one, the message itself, the date and time, and the IP address the message came from.

Delivery, returns and refunds. Delivery status reported by the courier (delivered, not at home, refused), the content of a withdrawal or guarantee request, photos you send us, and, for a refund, the account holder’s name and IBAN of the account to be credited.

Technical data. Like every website, the servers that deliver this site process your IP address, the time of the request, the page requested and the browser type, in order to send you the page and keep the service secure.

Cookies and browser storage. A few small entries that the site needs to work are written to your browser’s storage. Advertising cookies from Google and Meta are used only if you agree. Every entry is listed by name on the Cookies and storage sheet.

What we do not collect. No card or payment data (you pay the courier in cash), no identity documents, no special categories of data such as health data, and no account or password: there are no customer accounts on this site. We do not buy data about you from anyone.

You are not obliged to give us any data. Without a name, a phone number and a delivery address, though, we cannot confirm or deliver an order, so those fields are required on the order form. Email is optional there.

Where we rely on legitimate interests, we have weighed them against your interests and keep the use narrow. You may object at any time (section 9).

We do not send newsletters, and we do not use your phone number or email for marketing.

Couriers and logistics partners. The warehouse that packs your parcel and the courier that delivers it receive your name, address, phone number and the amount to collect. Couriers act as controllers in their own right for the delivery.

Confirmation-call and customer-service partners. Companies that make the confirmation call or answer customers in your language on our behalf see the order they are confirming. They work under contract as our processors and may not use the data for anything else.

Technical providers. The companies that host this website, run its database, deliver our email and carry the internal notifications that tell our staff an order has arrived. They process data on our instructions as processors.

Advertising platforms, only with your consent. Google (Google Ireland Limited, with Google LLC in the USA) and Meta (Meta Platforms Ireland Limited, with Meta Platforms, Inc. in the USA) receive cookie identifiers, the pages viewed and the fact and value of an order. They also use this data for their own purposes under their own privacy policies.

The advertising operator. Campaign statistics only, as described in section 3.

Banks, advisers and authorities. Our bank when we send a refund; accountants, auditors and legal advisers under a duty of confidentiality; and tax authorities, courts or regulators where the law obliges us.

Your order is placed from the EU with a company in the United Kingdom. The European Commission has recognised the United Kingdom as providing an adequate level of data protection, and the United Kingdom recognises the EEA in the same way, so data moves between the two on that basis.

Some of our technical providers, and the advertising platforms, are based in the United States or process data there. For those transfers we rely on an adequacy decision where the provider has joined the EU–US Data Privacy Framework (and its UK extension), and otherwise on the standard contractual clauses approved by the European Commission, with the UK addendum where UK law applies, together with additional safeguards where they are needed.

You can ask us for a copy of the safeguards that apply to a particular transfer.

Orders that were delivered, with their delivery and refund records: for as long as tax and accounting law obliges us to keep business records, which is at least six years after the end of the financial year of the order and can be up to ten years where EU rules on VAT for distance sales apply. After that they are deleted or made anonymous.

Orders that were never confirmed, or were cancelled before dispatch: up to 12 months, so that we can answer questions and spot repeated fake orders, then deleted or made anonymous.

Contact desk messages: up to 24 months after the last message in the conversation, unless they belong to an order, a return or a guarantee claim, in which case they are kept with that record.

Bank details given for a refund: kept with the refund record for the accounting period above and used for nothing else.

IP addresses held to prevent abuse, including blocks: up to 12 months from the last event.

Entries in your own browser: until you clear them or change your choice; advertising cookies expire as listed on the Cookies and storage sheet.

Where a dispute is open, the relevant records are kept until it is closed and any limitation period has passed.

Access. To know whether we hold data about you and to receive a copy of it.

Rectification. To have wrong or incomplete data corrected.

Erasure. To have data deleted where we no longer need it, where you withdraw consent or where you validly object. Records we must keep by law (section 8) are restricted instead of deleted until the period ends.

Restriction. To have the use of your data paused while a question about it is settled.

Portability. To receive the data you gave us for your order in a common machine-readable format, or have it sent to another controller where that is technically feasible.

Objection. To object, on grounds relating to your situation, to any use we base on legitimate interests. We stop unless we have compelling grounds that override yours or need the data for legal claims.

Withdrawing consent. For advertising cookies: at any time through “Cookie settings” in the footer of every page. Withdrawal does not affect what was lawfully done before it.

To use a right, write to desk@outletden.com. We may ask for a detail of your order (for example the phone number used) to be sure we are talking to the right person. We answer within one month; if a request is complex we may extend that by up to two months and will tell you so within the first month.

Please tell us first: most things can be fixed with one email. You also have the right to lodge a complaint with a supervisory authority at any time.

The authority for the country where we are established is: Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk).

If you live in the EU, you may instead complain to the data protection authority of the country where you live or work, or where you think the infringement took place. That authority will deal with your complaint in your own language.

The site is served only over an encrypted connection. Forms are protected by time-limited security tokens against forged requests, and repeated submissions from one connection are limited. Order and message records sit in an access-controlled database that only authorised staff and the partners in section 6 can reach, each for their own task.

No system is perfectly secure. If a breach is likely to put your rights at high risk, we will tell you and the competent authority without undue delay, as the law requires.

This site is meant for adults. Orders may be placed only by people aged 18 or over, and we do not knowingly collect data from children. If you believe a child has sent us data, tell us and we delete it.

We do not take decisions about you by purely automated means that have legal or similarly significant effects. The one automatic control is the abuse limit in section 5: several orders from one connection within minutes are blocked automatically. If that catches you by mistake, write to us and a person puts it right.

When the way we handle data changes, this sheet changes with it and the revision date in the header moves. If a change matters to an order in progress, we tell you directly. The version shown here is the one in force.