Data controller
The controller responsible for processing personal data on this website is:
Longguang Jiuzuan Business Center,
Tenglong Road,
Daling Community,
Minzhi Street,
Longhua District,
Shenzhen City, 518000,
China
Represented by: David Lee
Email: support@randmtornado.com
Purposes and legal bases
We process personal data only to the extent necessary for operating the website, processing orders, communicating with customers, complying with legal obligations or maintaining the security of our systems.
Depending on the processing activity, the following legal bases under the General Data Protection Regulation (GDPR) may apply in particular:
- Art. 6(1)(b) GDPR for pre-contractual measures and performance of a contract.
- Art. 6(1)(c) GDPR for compliance with legal obligations.
- Art. 6(1)(f) GDPR where legitimate interests apply, particularly secure and stable website operation, abuse prevention and internal administration.
- Art. 6(1)(a) GDPR where we obtain consent in a particular case.
Server and access data
When our website is accessed, technically necessary server data may be processed. This may include:
- IP address
- Date and time of access
- Requested URL
- Browser and operating system
- Referrer information, where transmitted
- Technical status and error data
This processing is used for technical delivery, stability, security and error analysis of the website. Where applicable, the legal basis is Art. 6(1)(f) GDPR.
Orders and purchase processing
When you place an order through our WooCommerce shop, we process the information required to process and fulfil the order.
This may include in particular:
- Name
- Billing and shipping address
- Email address
- Telephone number where provided or required for processing
- Products ordered
- Order number, status and time
- Price, currency and transaction information
- Technically necessary order and security data
Processing takes place in particular for performance of the contract under Art. 6(1)(b) GDPR and for compliance with legal obligations under Art. 6(1)(c) GDPR where such obligations apply.
Customer account
Where a customer account is created on RandMTornado.com, we process the information necessary to provide and administer that account.
This includes in particular login and contact information, stored addresses and order information associated with the account.
Processing is used to provide the account functions requested by the user and to process contractual transactions.
Contact by email
When you contact us by email, we process your email address and the information you send in order to handle your enquiry.
Where the enquiry relates to a contract or order, processing takes place in particular on the basis of Art. 6(1)(b) GDPR. For general enquiries, Art. 6(1)(f) GDPR may apply.
support@randmtornado.comTechnically necessary cookies
Our website may use technically necessary cookies or comparable storage technologies so that functions expressly requested by the user can be provided.
These may include cart, session, login and language preferences.
Where storage or access is strictly necessary to provide a digital service expressly requested by the user, prior consent is not required for that technical access under Section 25(2) TDDDG.
Based on our current website configuration, we do not use analytics or advertising cookies from Google Analytics, Meta Pixel or comparable marketing services.
Multilingual content / WPML
RandMTornado.com uses technical functionality to provide multilingual content.
A language selected by the user may be stored technically so that the website can be displayed in the requested language.
We do not use this information to create advertising profiles.
Shop and order administration
We use our own administration and synchronization functions for the internal technical management of our websites and WooCommerce shops.
Order and system data required for internal shop management may be processed between systems managed by us.
The purposes include central order overview, technical administration and operational organization.
Where personal data is involved, the legal basis is Art. 6(1)(b) GDPR for contract processing and/or Art. 6(1)(f) GDPR for efficient and secure internal administration.
Payment services
For credit or debit card payments, we use a payment service provided through Wintopay and integrated with WooCommerce.
As part of payment processing, the following information may in particular be transmitted to or processed by the payment infrastructure:
- Order and reference number
- Payment amount and currency
- Information about products ordered
- Name
- Billing and shipping address
- Email address
- Telephone number, where provided
- IP address
- Browser or User-Agent information
Where processing is necessary for payment processing relating to an order, it takes place in particular for performance of the contract under Art. 6(1)(b) GDPR.
Where data is processed for technical security or abuse and fraud prevention, Art. 6(1)(f) GDPR may additionally apply.
The Wintopay plugin currently in use employs, among other things, technical services on domains within the cartadicreditopay.com infrastructure for payment processing.
Analytics, advertising and tracking
At the date of this policy, services such as Google Analytics, Google Tag Manager, Meta Pixel, Microsoft Clarity, Hotjar or comparable advertising and analytics services are not integrated into the publicly delivered website.
If this changes, we will update this policy accordingly and use any consent mechanisms required by law.
Recipients of data
Personal data is disclosed only where necessary for performance of a contract, technical operation, compliance with a legal obligation or on another valid legal basis.
Categories of recipients may include hosting and IT service providers, shipping and logistics providers, and the Wintopay payment service used for credit or debit card payments together with the payment infrastructure used by its plugin.
Processing outside the EU / EEA
The controller is established in China. Personal data may therefore also be processed outside the European Union or European Economic Area.
Where the requirements of Articles 44 et seq. GDPR apply to a specific transfer of personal data, the applicable data-protection requirements must be observed.
Controllers without an establishment in the European Union may be subject to additional obligations under Article 27 GDPR when offering goods or services to persons in the EU.
How long do we store data?
Personal data is generally stored only for as long as necessary for the relevant processing purpose.
Data may also be retained where statutory retention or documentation obligations apply, or where the information is required to establish, exercise or defend legal claims.
Once the purpose no longer applies and relevant retention periods have expired, the data is deleted or anonymized unless another legal basis permits further processing.
Rights of data subjects
Where the statutory requirements are met, data subjects may in particular exercise the following rights:
- Access to personal data
- Correction of inaccurate data
- Erasure
- Restriction of processing
- Data portability
- Objection to certain processing activities
- Withdrawal of consent previously given with effect for the future
To exercise your rights, you can contact us at:
support@randmtornado.comRight to lodge a complaint
In accordance with the GDPR, data subjects have the right to lodge a complaint with a competent data-protection supervisory authority.
This applies in particular to the supervisory authority at their habitual residence, place of work or the place of the alleged data-protection infringement.
Changes to this policy
We update this Privacy Policy when legal requirements or technical services used on RandMTornado.com change.
The current English version is permanently available at /en/privacy-policy/
