This Privacy Policy explains how the developer XuYue Ecom and the operating company XuYue Ecom (XiuYue E-Commerce Co., Ltd.), with its registered place of business at 134 Minzhu Group, Mianjiang Village, Gugang Town, Liuyang City - 410000, China (CN), collect and handle personal data through the website at xirtech.my and through the parcel counter desk services described on this site.
XuYue Ecom builds computer systems for parcel counters and runs a working counter desk in Liuyang. Good record keeping is the heart of that work, and the same discipline applies to personal data. We keep the collection small, the purpose clear and the retention short. This document is written so that a reader with no legal training can follow it from beginning to end.
Who we are
The website at xirtech.my is operated by XuYue Ecom (XiuYue E-Commerce Co., Ltd.), a company registered in China with its place of business at 134 Minzhu Group, Mianjiang Village, Gugang Town, Liuyang City - 410000, China (CN). The developer name XuYue Ecom appears throughout this policy for clarity, and both names refer to the same organisation and the same counter desk team.
For the purposes of applicable data protection law, XuYue Ecom (XiuYue E-Commerce Co., Ltd.) is the controller of the personal data described in this policy. That means the company decides why data is collected and how it is handled. Where a client supplies data to us for a project carried out at the counter desk, the client usually remains the controller of that data and we act as a processor on the instructions of the client.
We deliberately keep our organisation small so that questions about data reach a person rather than a queue. If you write to the address on our contact page you will receive a reply from a member of the counter team who can open the relevant record.
Scope of this policy
This policy covers personal data collected through the public website at xirtech.my, through emails and telephone calls to the counter desk, and through the parcel and order records that we handle when providing computer systems design services. It applies to visitors, prospective clients, existing clients, suppliers and any person whose data reaches the desk in the course of business.
The policy does not cover data held by our clients inside systems that we develop for them, except where we are engaged to operate those systems for the client. It also does not cover the practices of third party websites that we link to, because those websites control their own data.
Where a specific contract between XuYue Ecom (XiuYue E-Commerce Co., Ltd.) and a client contains data protection terms that differ from this policy, the contract terms govern the relationship with that client. This policy then describes how we handle personal data in the absence of stricter contractual commitments.
Data we collect
The data we collect falls into a small number of clear groups. We collect only what a given task needs, and we do not gather personal data simply because a field is easy to add.
Contact and enquiry data
When you send a message through our contact form, by email or by telephone, we receive the name you give us, the email address or telephone number you use, the subject of your message and the content of the message itself. If you choose to include an order number or a bay number, that becomes part of the enquiry record.
Business and project data
For clients and suppliers we hold business contact details, company names, billing information, meeting notes and written store notes that describe a project carried out at the counter desk. These notes may contain the names of individual staff members who attend a counter visit or an order sitting.
Technical and usage data
Our web server records the standard technical information that any browser sends: an internet protocol address, the type and version of the browser, the page visited, the time of the visit and the referring address. We do not use this information to build a profile of an individual, and we do not combine it with contact data.
Parcel and order data
Where a client asks us to operate or support a parcel record system, the data inside it may include recipient names, delivery addresses, order numbers, weights and shipping references. This data belongs to the client and is handled only on the instructions of that client.
How data is collected
Most data reaches us because a person chooses to send it. You may complete the contact form, write an email, make a telephone call, attend a counter visit or sit at an order sitting. In each case the data is given to the desk directly by the person concerned or by the client that person represents.
A smaller amount is collected automatically when you browse the site, as described in the technical section above. We do not buy contact lists, we do not scrape personal data from other websites, and we do not obtain personal data from data brokers.
When a client sends us project material, that material may include personal data about the client staff or the client customers. We treat such material as confidential and process it only for the purpose of the project described in the client instruction.
Lawful basis for processing
We rely on a limited set of lawful grounds, and we choose the ground before processing begins rather than after the fact.
- Performance of a contract. We process data where it is needed to provide a service, to prepare a quotation, to carry out a project or to bill a client.
- Legitimate interests. We process data where it is needed to run the counter desk safely and honestly, for example to answer an enquiry, to keep a project record or to protect the website from abuse. We weigh those interests against the rights of the individual before relying on them.
- Consent. Where the law requires consent, for example for certain kinds of marketing, we ask for it clearly and we keep a record of when it was given.
- Legal obligation. We process data where a law requires us to keep it, for example accounting and tax records.
If we need to process data for a new purpose that is not covered by the original ground, we will either obtain a fresh consent or explain the new purpose and the relevant lawful basis before processing begins.
How we use data
We use personal data for the following purposes, and for no others without a new notice.
- To answer enquiries sent to the counter desk and to follow up on a conversation that has been started.
- To prepare quotations, proposals and project plans for prospective clients.
- To deliver computer systems design services, including the six counter services described on the services page.
- To operate the parcel record systems that clients have asked us to run or support.
- To maintain accounting records, invoices and tax filings as required by law.
- To keep the website secure and to detect unusual or abusive traffic.
- To improve our own written materials and the clarity of the information we give clients.
We do not use personal data for automated decision making that produces legal effects, and we do not profile individuals for advertising purposes. The counter desk depends on reading records carefully, and careful reading and automated profiling are different things.
Service providers
Service providers that process personal data on our behalf are selected carefully and are required to protect the data. Each provider is bound by a written agreement that sets out the purpose of processing, the security measures, the rules for sub-processing and the return or deletion of data at the end of the engagement.
Our hosting and email providers are located in more than one country. Where a provider stores data outside China, we take reasonable steps to confirm that the transfer is permitted and that the provider applies appropriate safeguards.
We review the list of providers at regular intervals. A provider that cannot meet our standards is replaced, and any data it holds is returned or deleted according to the agreement.
International transfers
Because the counter desk serves clients in different countries, personal data may be transferred outside the country in which it was collected. When this happens we rely on a lawful transfer mechanism and we apply the safeguards required for the destination.
The safeguards may include a written agreement that covers data protection obligations, a set of clear security measures and a commitment to notify us promptly if a problem occurs. We keep a record of each transfer arrangement so that it can be reviewed and updated.
If you would like to know which mechanism applies to a particular transfer, write to the desk and we will explain it in plain language.
Retention periods
We keep personal data only as long as a clear purpose exists. When the purpose ends, the data is deleted or anonymised.
- Enquiries that do not lead to a project are kept for twelve months and then deleted, unless a longer period is agreed with the person concerned.
- Project records for active clients are kept for the duration of the project and for a further thirty six months, so that an order sitting can refer to an earlier decision.
- Accounting and tax records are kept for the period required by law, which is currently ten years for the records that fall within that requirement.
- Technical server logs are kept for ninety days and are then deleted automatically.
Where the same record must be kept for a legal obligation and for a project purpose, we keep the single copy and restrict its use to the legal purpose once the project purpose has ended.
Security measures
We protect personal data with technical and organisational measures that match the sensitivity of the data. Access to client records is limited to the members of the counter team who need it for their work, and access is reviewed when a role changes.
Our systems are protected by encryption in transit, by strong authentication for administrative accounts and by regular software updates. The physical counter area is supervised during business hours, and paper records that contain personal data are stored in a locked drawer at the end of each day.
We keep a written procedure for suspected data breaches. If a breach is likely to create a risk for individuals, we notify the affected people and the relevant authority without undue delay, and we describe what happened, what was affected and what we have done to reduce the risk. We will never hide a breach in order to protect the reputation of the company.
Your rights
Depending on where you live, you may have the following rights in relation to the personal data that we hold about you.
- Right of access. You may ask for a copy of the personal data we hold about you, together with an explanation of how it is used.
- Right to correction. You may ask us to correct data that is inaccurate or incomplete.
- Right to deletion. You may ask us to delete data where there is no remaining lawful reason for us to keep it.
- Right to restriction. You may ask us to limit the use of data while a question about its accuracy or use is being resolved.
- Right to object. You may object to processing that relies on legitimate interests if you believe the balance is wrong.
- Right to portability. You may ask for data that you provided to be returned in a structured and commonly used format.
- Right to withdraw consent. Where processing relies on consent, you may withdraw it at any time without affecting processing that has already happened.
To exercise a right, write to askus@xirtech.my and describe what you would like us to do. We will confirm your identity, protect your data and respond within thirty days. If the request is complex, we will tell you why more time is needed. There is no charge for a normal request.
If you are not satisfied with our response, you may complain to a supervisory authority in the country where you live, where you work or where the alleged problem took place.
Privacy for Children
The counter desk and this website serve business clients. They are not directed at children, and we do not knowingly collect personal data from a child under the age of sixteen.
If a client sends us project material that contains data about a child, the client is responsible for providing that data only where it has a lawful basis. We handle such data with extra care and keep it only for the duration of the project.
If you believe that we hold personal data about a child and that the data was collected without a proper basis, write to the desk and we will investigate and delete the data where appropriate.
Marketing and communication
We do not send marketing messages to people who have not asked for them. If a client asks to receive updates about the counter desk, we will send only the material that was requested and we will offer a clear way to stop at any time.
Service messages that relate to a current project or an open order are not marketing, and we may send them even where a marketing consent has been withdrawn, because they are needed to deliver the service.
You may change your communication preferences by writing to the desk or by using the unsubscribe link in any message that offers one. We will honour the change within seven days.
Third party links
The website may contain links to websites that we do not operate. We provide those links to help a reader reach related information, but we do not control the privacy practices of the destinations.
Before you send personal data to a linked website, read that website privacy notice and decide whether you are comfortable with its practices. Our policy stops at the point where you leave xirtech.my.
If you find a link on our site that leads to harmful or misleading content, write to the desk and we will review and remove it.
Changes to this policy
We review this policy at least once a year, and we update it when our practices change. When we make a material change, we update the last updated date at the top of the page and, where the change affects people who have already contacted us, we provide a direct notice.
Continued use of the website after an updated policy takes effect means that the new version applies to the data described in it. If a change needs consent, we will ask for it separately and we will not treat silence as agreement.
Earlier versions of the policy are kept with the project records so that the history of a client relationship can be read accurately.
Contact and complaints
Questions, requests and complaints about privacy should be sent to the counter desk. Write to askus@xirtech.my, call +16064465103 during business hours, or write to XuYue Ecom (XiuYue E-Commerce Co., Ltd.), 134 Minzhu Group, Mianjiang Village, Gugang Town, Liuyang City - 410000, China (CN).
Please describe the data concerned and the outcome you would like. A member of the team will acknowledge the message, keep you informed of progress and give a clear answer. If we cannot resolve the matter to your satisfaction, we will explain what further options are open to you.
We keep a written record of every privacy complaint and the action taken, and we review those records at each policy review so that the same problem is not repeated.