Privacy Policy

Last updated: 18 March 2025  ·  Effective date: 18 March 2025

1. Who We Are

This Privacy Policy applies to Ruiko Smart Tech. Co., Ltd. ("ECOAIOT", "we", "us", "our"), a technology company specializing in RFID tags and IoT consumables, headquartered in Shanghai, China, with additional operations in Guangzhou, Guangdong, China.

This policy applies to personal data collected through our website at ecoaiot.com, via our contact and inquiry forms, and through any business correspondence with us.

2. Data We Collect

2.1 Information You Provide Directly

• Contact inquiries: Name, company name, business email address, phone number, and the content of your message when you submit our contact or quote request form.
• Business correspondence: Information exchanged via email or messaging platforms in connection with a business inquiry or order.

2.2 Information Collected Automatically

• Server logs: IP address, browser type, operating system, referring URL, pages visited and timestamps — collected automatically by our hosting provider (SiteGround) for security and operational purposes.
• Cookies: See Section 9 for full details.

2.3 Information We Do Not Collect

We do not collect payment card data, government identification numbers, health information, or any special category personal data as defined under GDPR Article 9. We do not operate user accounts or require registration.

3. How We Use Your Data

We use the personal data we collect solely for the following purposes:

• Responding to your product inquiries, quote requests and technical questions.
• Processing and fulfilling business orders and correspondence.
• Maintaining records of business communications as required for commercial operations.
• Improving the performance and security of our website.
• Complying with applicable legal obligations.

We do not use your data for automated decision-making, profiling, or unsolicited marketing without your explicit consent.

4. Legal Basis for Processing (GDPR)

For individuals in the European Economic Area (EEA), United Kingdom, and Switzerland, we process personal data under the following legal bases:

• Legitimate interests (Article 6(1)(f) GDPR): Responding to business inquiries and maintaining records of commercial correspondence is in our legitimate interest as a B2B trading entity.
• Performance of a contract (Article 6(1)(b) GDPR): Where processing is necessary to take steps at your request prior to entering into, or in connection with, a commercial agreement.
• Legal obligation (Article 6(1)(c) GDPR): Where we are required to retain records under applicable law.
• Consent (Article 6(1)(a) GDPR): Where you have given explicit consent, e.g. for optional communications.

5. Data Sharing & Third Parties

We do not sell, rent or trade your personal data. We share data only with:

• Email delivery service: Our contact form is processed server-side on our own hosting infrastructure (SiteGround). Form submissions are delivered directly to our business email and are not shared with third-party form processors.
• SiteGround Spain S.L.: Our web hosting provider, who processes server log data. Their privacy policy is at siteground.com/privacy.
• Professional advisors: Legal, accounting or compliance advisors where required by applicable law.
• Law enforcement or regulators: Where required to comply with a legal obligation or court order.

All third-party processors are required to handle your data in compliance with applicable data protection laws.

6. Data Retention

We retain personal data for no longer than is necessary for the purposes for which it was collected:

• Contact form submissions: Retained for up to 3 years from the date of submission, unless a continuing business relationship warrants longer retention.
• Business correspondence records: Retained for up to 7 years to comply with commercial record-keeping requirements.
• Server logs: Retained by our hosting provider for up to 90 days for security and operational purposes.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): Request deletion of your data, subject to legal retention obligations.
• Restriction: Request that we limit processing of your data in certain circumstances.
• Portability: Request your data in a structured, machine-readable format (EEA/UK).
• Objection: Object to processing based on legitimate interests.
• Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time.

California Residents (CCPA/CPRA)

California residents have the right to know what personal information we collect, the right to delete, the right to opt out of sale (we do not sell data), and the right to non-discrimination for exercising these rights.

Australia (Privacy Act 1988)

Australian residents may access and correct personal information held by us and may complain to the Office of the Australian Information Commissioner (OAIC) if they believe their privacy rights have been breached.

South Korea (PIPA)

We comply with the Personal Information Protection Act (PIPA) for data subjects in South Korea, including provisions on collection, use, and cross-border transfer.

To exercise any of your rights, contact us at the address in Section 13. We will respond within 30 days.

8. International Data Transfers

ECOAIOT is headquartered in China. When you submit data to us, it may be transferred to and processed in China. We ensure appropriate safeguards are in place for such transfers:

• For EEA/UK data: we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms where required.
• For international data transfers: we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms where required.

9. Cookies & Tracking

Our website uses only essential technical cookies required for the site to function correctly. We do not use advertising cookies, tracking pixels, or third-party analytics services (such as Google Analytics) that collect personal data without your explicit consent.

Essential cookies used:

• Session cookies set by our hosting provider for load balancing and security purposes (deleted when you close your browser).

You may disable cookies in your browser settings; however, this may affect the functionality of our website. We do not display cookie consent banners because we do not set non-essential cookies.

10. Children's Privacy

Our website is directed exclusively at business professionals. We do not knowingly collect personal data from individuals under the age of 16. If you believe a minor has submitted data to us, please contact us immediately and we will delete it.

11. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction. These include HTTPS encryption on all pages, access controls on our systems, and using reputable third-party processors with their own security certifications.

No method of internet transmission is 100% secure. We cannot guarantee absolute security but commit to prompt notification in the event of a data breach affecting your rights and freedoms, as required by applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page with an updated effective date. For material changes, we will take reasonable steps to notify affected parties. Continued use of our website after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

For any questions about this Privacy Policy, to exercise your data rights, or to raise a privacy concern:

EEA/UK residents who are not satisfied with our response may lodge a complaint with their local data protection supervisory authority (e.g., the UK ICO at ico.org.uk, or their relevant EU DPA).