Privacy Policy

What MarketSaves collects when you order or write to us, why, who receives it, how long it is kept and how to use your rights under the General Data Protection Regulation (GDPR).

Last updated 29 September 2026

On this page · 13 sections

11.Who is responsible for your data

The data controller — the company that decides how your personal data is used — is WHATECH MOBILE CO., LIMITED. It is the seller: it buys the goods it sells, takes your order, confirms it by phone, sends it out, collects payment on delivery and deals with returns and warranty claims.

The same company built this website and runs it, runs its advertising and its Google Ads campaigns, and holds the advertising accounts. Whatever your question is — an order, a parcel, a return or your data — WHATECH MOBILE CO., LIMITED is the one to ask, at help@marketsaves.com.

Controller: WHATECH MOBILE CO., LIMITED
Person responsible: Huanbin Lin
Address: Room 505, 5th floor, Beverley Commercial Centre, 87-105 Chatham Road South, Tsim Sha Tsui, Kowloon, Hong Kong
Data protection email: privacy@marketsaves.com
General email: help@marketsaves.com
Answer time: Data protection requests within 30 days

We have not appointed a data protection officer, because our activity does not fall within the cases in which the GDPR requires one. Requests about your data go to the dedicated address above and are handled by the customer service team of WHATECH MOBILE CO., LIMITED.

22.Our advertising and your data

Adverts for MarketSaves are placed by WHATECH MOBILE CO., LIMITED itself. The Google Ads accounts that show them are registered in its name; it pays for them and is answerable for every advert they carry. An order placed from one of our country offer pages comes to WHATECH MOBILE CO., LIMITED like any other order: Who receives your data lists everyone who handles it.

What those accounts report back to us are statistics: how many people saw or clicked an advert, how many orders followed and what they were worth. If you accept advertising cookies, Google can link such an event to an online identifier; if you decline, the tag stays in its restricted state and no advertising cookie is set. That choice is yours to make and to change, and the Cookie Policy lists every cookie involved.

Google acts as a controller in its own right for the data collected through its tools, under its own privacy policy. We exchange only what the section on recipients describes.

33.What we collect

When you order

The order form asks for: delivery country, first name, last name, phone number, address, town or city and postcode. Email and delivery notes are optional. With the form we store the product, quantity and total, the date and time, the IP address the form was sent from and, if you arrived through an advert, the campaign label contained in the link. We do not collect payment data: you pay the courier in cash.

When you order from a country offer page

The country offer pages (addresses beginning /go/pl/, /go/es/ or /go/lt/) have a shorter order form: name, phone number and address. Two more things go with it. First, the IP address the order came from, plus basic technical details about your browser, used among other things to recognise fake orders. Second, the campaign parameters in the link that brought you: the utm tags and the subid, or Google's click id when the link has no subid. All of it comes to us with the order, as described under Who receives your data.

When we phone you

The confirmation call checks the order and the address, and it comes from our own call centre. We note the outcome (confirmed, changed, cancelled, not reached). If a call is ever recorded, you are told at the start of the call and can object.

When you write to us

The contact form collects the topic, your name, your email address, an optional order reference, your message and the IP address. If you email us, we receive whatever you choose to write and attach.

When you return an item

For a refund we ask for the name of the account holder and the IBAN. These are used for that transfer only.

When you browse

The site keeps four small entries in your browser's own storage, and a country offer page up to three more; they are what make the shop and its order forms work, and all of them are read only by this site. It sets a cookie only where you have agreed to one. Our hosting provider keeps technical logs (IP address, time, page requested, browser type) to serve the pages and keep the service secure, for up to 12 months as set out in How long we keep it. Each entry is named, with its purpose and lifetime, in the Cookie Policy.

We do not ask for, and ask you not to send, special categories of data such as health information. We do not buy data about you from third parties.

44.Why we use it and on what legal basis

Taking your order, phoning you to confirm it, delivering it and collecting payment through the courier

Data: Order form details, order contents
Legal basis: Performance of the contract and steps taken at your request before it (Art. 6(1)(b) GDPR)

Handling withdrawals, returns, refunds and guarantee claims

Data: Order details, messages, photos you send, bank account for the refund
Legal basis: Performance of the contract (Art. 6(1)(b)) and legal obligations under consumer law (Art. 6(1)(c))

Keeping accounting and tax records

Data: Name, address, order contents and amounts, refund records
Legal basis: Legal obligation (Art. 6(1)(c))

Answering messages sent through the contact form or by email

Data: Name, email, topic, order reference, message
Legal basis: Your consent given with the form (Art. 6(1)(a)); where the message concerns an order, performance of the contract (Art. 6(1)(b))

Protecting the shop against abuse: repeated fake orders, automated form submissions, serial refusal of parcels

Data: IP address and basic details of the browser, time of submission, phone number, delivery outcome of earlier orders
Legal basis: Legitimate interest in running a cash-on-delivery service that is not abused (Art. 6(1)(f))

Knowing, in aggregate, which adverts lead to orders

Data: The campaign label carried by the link that brought you to the site, stored with the order; on the country offer pages, the campaign parameters of the link (Google's click id among them when the link has no subid), kept with the order
Legal basis: Legitimate interest in measuring advertising without identifying visitors (Art. 6(1)(f))

Establishing, exercising or defending legal claims

Data: Whatever part of the above is relevant to the claim
Legal basis: Legitimate interest (Art. 6(1)(f))

Measuring which adverts lead to an order, and showing our adverts again to people who have visited the shop

Data: Online identifiers, cookie data, pages viewed, order value and order reference
Legal basis: Your consent, given in the cookie choice and revocable at any time (Art. 6(1)(a))

Where we rely on legitimate interest, we have weighed it against your interests and keep the processing to what the purpose needs. You can object at any time; see Your rights. We do not send newsletters or marketing messages, and we do not sell or rent personal data to anyone.

55.Who receives your data

This is the whole list. Nobody outside it receives anything. Anyone acting as our processor works on our written instructions and may not use your data for anything of their own.

Vercel Inc.Processor, under a data processing agreement · United States: Our hosting provider and the registrar of our domain: hosts this website and delivers its pages. Everything you type into a form passes through its systems, and its technical logs, kept for up to 12 months, hold the request, the time and the IP address.
Your data comes to usService providers working on our instructions: Where a service provider works for us — for the telephone confirmation of your order, or for technical operations — it acts on our instructions, sees only what that task needs and may not use it for anything of its own.
The courier or postal operator in your countrySeparate controller for the delivery · Your own country: Receives your name, delivery address, phone number and the amount to collect at the door, because a parcel cannot be delivered without them. The courier is chosen per country; we tell you which one on the confirmation call, or whenever you ask.
Customs authoritiesPublic authorities · Where a parcel crosses a border: Where a parcel crosses a border that requires a declaration, the details that country's rules oblige us to state.
Accountants, auditors and legal advisers; public authoritiesSeparate controllers, bound by professional duties · Hong Kong: Order and payment records where bookkeeping, an audit, a legal claim or a legal obligation requires it. Authorities receive data only on a valid request.
Our bankSeparate controller · Hong Kong: The account details you give us for a refund, and the amount, so that the transfer can be made.

When, and only when, you have accepted advertising cookies, browsing and conversion data also reaches Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for Google Ads. Decline, and the tag stays in the restricted state described in the Cookie Policy: no cookies and no advertising identifiers. The advertising accounts those tools report to are in the name of WHATECH MOBILE CO., LIMITED, which pays for them and answers for them. This site uses no Meta (Facebook, Instagram) pixel.

No one outside this list sees your order. We do not sell personal data, we do not trade them, and we do not hand them to anyone for their own marketing. Should we one day add a mailing service or an order-management system, this list is updated before the first record reaches it.

66.Google, and what it would ever learn about you

We buy advertising from Google, and a Google tag runs on these pages to tell us which adverts lead to an order. Google Ireland Limited provides the service in Europe. What the tag may do depends entirely on the answer you give to the cookie choice, and the rest of this section sets out exactly what that means.

Consent decides first

The tag is wired with Google Consent Mode v2, set to denied before any visitor says anything. In that state it stores nothing, reads nothing and cannot recognise a browser from one visit to the next; advertising identifiers are redacted. Only if you switch advertising on in the cookie choice is the state updated to granted, and only then may cookies be written. Turn it off again and the denied state returns with the next page you load.

What Google would receive

that a page of this shop was opened, which page, and when;
the usual request details any web server sees: browser, language, approximate location from the IP address, the advert or search that brought you;
on the confirmation page only: that an order was completed, its value in euro, the currency and the order reference, so that one conversion is counted once.

What Google never receives

Your name, your phone number, your delivery address, your email and the contents of anything you wrote to us. There is no payment data to send in the first place: you pay the courier in cash, so this site never holds a card number. We do not upload customer lists to Google and we do not use its enhanced conversion features, which would involve sending hashed contact details.

For the data it collects through its own tools Google is a controller in its own right, under its own privacy policy, and you can limit personalised advertising in the advert settings of your Google account. The cookies themselves, with their names and lifetimes, are listed in the Cookie Policy.

77.Transfers outside the European Economic Area

We are established in Hong Kong, and some of the organisations above are based in, or use servers in, other countries outside the European Economic Area — the United States among them. Two journeys leave the European Economic Area, and none is hidden in a footnote.

To us, in Hong Kong

The seller is established in Hong Kong, so the details on your order form are read there. The European Commission has issued no adequacy decision for Hong Kong. The transfer rests on Article 49(1)(b) of the GDPR — it is necessary to perform the contract you asked for — and carries only what taking, confirming, dispatching and invoicing an order needs.

To providers in the United States

Our hosting provider, Vercel, is a company incorporated in the United States. For that transfer, and for any other provider that sits outside the European Economic Area, we rely on the standard contractual clauses adopted by the European Commission in Decision 2021/914, signed as part of the provider's data processing agreement, together with the technical measures that go with them: traffic encrypted in transit and access limited to the people who need it. Where a provider is additionally certified under the EU–US Data Privacy Framework, that certification applies as well.

You may ask for a copy of the clauses that cover your data, with commercial terms removed, by writing to privacy@marketsaves.com. Apart from the two destinations above, we transfer personal data to no other country.

88.How long we keep it

Confirmed orders and their delivery, refund and guarantee records: 7 years after the end of the financial year in which the order was placed: the period for which the Hong Kong Inland Revenue Ordinance requires business records to be kept.
Orders that were never confirmed (we could not reach you, or you cancelled on the call): 90 days from the last call attempt, then deleted or stripped of everything that identifies you.
Contact form messages and emails: 24 months after the last message in the conversation. A message that belongs to an order is filed with the order and follows its period instead.
Bank details given for a refund: Filed with the refund record for the same 7-year accounting period, and used for that one transfer and nothing else.
IP addresses attached to orders and messages: 12 months, then removed from the record while the rest of it stays.
Technical logs at the hosting provider (request time, page, IP address, browser): No longer than 12 months, after which they are overwritten.
Your cookie choice: 12 months in your own browser, counted from the day you chose. After that the card asks again. We keep no copy on our side.
Blocks placed on an IP address or phone number for abuse: While the block is needed, and no longer than 12 months.

Where a dispute or a legal claim is open when a period ends, the data it concerns are kept until the matter is closed.

99.Your rights

Under the GDPR you can, at no cost:

access your data and receive a copy;
have inaccurate data corrected;
have data erased when we no longer have a reason to keep them (records the law obliges us to keep cannot be erased early);
ask us to restrict processing while a question about the data is settled;
object to processing based on legitimate interest, on grounds relating to your situation;
receive the data you gave us in a structured, commonly used format, or have them sent to another controller (portability), where processing is based on contract or consent;
withdraw consent at any time, without affecting what was done before: for cookies, use the "Cookie settings" control in the footer.

Write to privacy@marketsaves.com or use the contact form with the topic "Privacy request". We may ask for information that confirms your identity, such as the phone number used for the order. We answer within one month; the law allows two further months for complex requests, and we would tell you if we needed them.

1010.Complaining to a supervisory authority

If you think we have handled your data unlawfully, we would like the chance to put it right first. You also have the right to lodge a complaint with a data protection authority. The authority that supervises us is:

Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk)

You may instead complain to the data protection authority of the EU country where you live or work, or where the matter occurred.

1111.What happens if you do not give data; automated decisions

The fields marked as required in the order form are needed to conclude and perform the contract: without a name, a phone number and a full address we cannot confirm or deliver an order. Optional fields can be left empty without any consequence. Advertising cookies are always optional.

We do not make decisions about you that are based solely on automated processing and that have legal or similarly significant effects. The site automatically limits how many forms can be sent from one connection in a short time; if this stops a genuine order, contact us and a person will look at it.

1212.Security and children

Pages and forms travel over an encrypted connection. Every form carries a one-time token that blocks forged and automated submissions, and the number of submissions from one connection in a short time is capped. Order records are reachable only by the staff, and the service providers working on our instructions, who have a reason to see them, through accounts that are individually authenticated. No system is perfect; if a breach were ever to put your rights at risk, you and the supervisory authority would hear it from us within the time the law sets.

Children

This shop is meant for adults and nothing in it is aimed at children. We do not knowingly collect data from anyone under 16, and the site is not advertised to that age group. A contract of sale also needs an adult behind it. If you believe a child has sent us data or placed an order, write to privacy@marketsaves.com: we cancel the order and erase the record, and we do not need a reason.

1313.Changes to this policy

We update this page when our processing or the law changes. The date at the top is the date of the current version. If a change affects how we use data we already hold in a way you would not expect, we tell you before it takes effect, by email where we have your address.