Privacy Notice and Data Protection

Below we inform you about the collection of personal data when using our website. Personal data is data that is personally referable to you, for example, name, address, e-mail addresses.

I. Name and address of party responsible

The party responsible in the sense of the EU General Data Protection Regulation and other national data protection laws of the Member States as well as other provisions of data protection law is:

whokeys Ltd.

FLAT/RM B,4/F,KINGSWELL COMM TOWER 171-173 LOCKHART RD WANCHAI

Hong Kong

E-Mail:service@whokeys.com

www.whokeys.com

II. Name and address of the representative in the Union

The representative in the Union under Article 27 of the GDPR is:

24 Po Wah Building

Central and Western District

HongKong

III. Name and address of the data protection officer

The data protection officer of the party responsible is:

Mrs. Lily Xu

FLAT/RM B,4/F,KINGSWELL COMM TOWER 171-173 LOCKHART RD WANCHAI

Hong Kong

E-Mail:service@whokeys.com

IV. General information about data processing 1. Extent of processing of personal data

We only collect and use personal data of our users insofar as this is necessary to provide a functional website as well as our contents and services. The collection and use of personal data of our users takes place regularly only with the user's consent. An exception applies in those cases in which prior consent cannot be obtained for real reasons and the processing of the data is permitted by legal regulations.

2. Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 lit. a) EU General Data Protection Regulation (EUDATAP) serves as the legal basis for the processing of personal data. In the processing of personal data necessary for the performance of a contract to which the data subject is a party, Article 6 (1) lit. b) EUDATAP shall serve as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures. Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 (1) lit. c EUDATAP serves as the legal basis. If processing is necessary to maintain a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Art. 6 (1) lit. f EUDATAP serves as the legal basis for processing.

3. Data erasure and storage duration

The personal data of the person concerned will be deleted or blocked as soon as the purpose of storage is eliminated. In addition, such storage may take place if provided for by the European or national legislator in EU regulations, laws or other regulations to which the controller is subject. Blocking or deletion of the data also takes place when a storage period prescribed by the standards mentioned expires, unless there is a need for further storage of the data for conclusion of a contract or fulfillment of the contract.

V. Provision of the website and creation of log files 1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer. The following data is collected here:

(1) Information about the browser type and version used

(2) The operating system of the user

(3) The Internet service provider of the user

(4) The IP address of the user

(5) Date and time of access

(6) Websites from which the user's system reaches our website

(7) Websites accessed by the user's system through our website

The data is also stored in the log files of our system. A storage of this data together with other personal data of the user does not take place.

2. Legal basis for data processing

Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 lit. a) EU General Data Protection Regulation (EUDATAP) serves as the legal basis for the processing of personal data. In the processing of personal data necessary for the performance of a contract to which the data subject is a party, Article 6 (1) lit. b) EUDATAP shall serve as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures. Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 (1) lit. c EUDATAP serves as the legal basis. If processing is necessary to maintain a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Art. 6 (1) lit. f EUDATAP serves as the legal basis for processing.

2.Legal basis for data processing

The legal basis for the storage of data and logfiles is Art. 6 (1) lit. f) EUDATAP.

3.Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this the IP address of the user must remain saved for the duration of the session.The data is stored in logfiles to ensure the functionality of the website. In addition, the data serves us to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context. Our legitimate interest in data processing according to Art. 6 (1) lit. f) EUDATAP also lies in these purposes.

4.Duration of data storage

The data will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

If the data is stored in logfiles, this is the case after seven days at the latest. A further saving is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment of the calling client is no longer possible.

5.Possibility of opposition and removal

The collection of data for the provision of the website and the storage of the data in log files is essential for the operation of the website. There is consequently no contradiction on the part of the user.

VI. Use of cookies 1. Description and extent of data processing

In order to make the visit to our website attractive and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your device. Some of the cookies we use are deleted after the end of the browser session, ie after the closure of your browser (so-called transient cookies). Other cookies remain on the device and allow us or our affiliate to recognize your browser on your next visit (persistent cookies).

Transient cookies are automatically deleted when you close the browser. These include in particular the session cookies. These store a so-called session ID, with which various requests from your browser can be assigned to the common session. This will allow your computer to be recognized when you return to our website. The session cookies are deleted when you log out or close the browser.

The following data is stored and transmitted in the persistent cookies:

(1) Information about participants of our affiliate program, tvia whose link a customer has entered our shop

2. Legal basis for data processing

The legal basis for the processing of personal data using cookies is Art. 6 (1) lit. f) EUDATAP.

3. Purpose of data processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For this it is necessary that the browser is recognized even after a page change.

We need cookies for the following applications:

(1) Shopping cart

(2) Login payment process

(3) Measuring the performance of participants in the affiliate program

The user data collected by technically necessary cookies will not be used to create user profiles.

For these reasons, our legitimate interest also lies in the processing of personal data in accordance with Art. 6 (1) lit. f) EUDATAP.

4. Duration of data storage and possibility of opposition and removal

Cookies are stored on the computer of the user and transmitted by this to our site. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Already saved cookies can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may not be possible to use all the functions of the website to the full.

VII. Newsletter 1. Description and extent of data processing

With your consent, you can subscribe to our newsletter, which informs you about our current interesting offers. The advertised goods and services are named in the declaration of consent. To register for our newsletter, we use the so-called double-opt-in procedure. This means that after you have registered, we will send you an e-mail to the e-mail address specified in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month. In addition, we store your IP addresses and times of registration and confirmation. The purpose of the procedure is to prove your registration and, if necessary, to clarify possible misuse of your personal data. The only requirement for sending the newsletter is your e-mail address. After your confirmation, we will save your e-mail address for the purpose of sending you the newsletter.

2. Legal basis for data processing

The legal basis is Art. 6 (1) lit. a) EUDATAP.

3. Purpose of data processing

The collection of the e-mail address of the user serves to deliver the newsletter.

4. Duration of data storage

The e-mail address will be stored for as long as the subscription to the newsletter exists.

5. Possibility of opposition and removal

You can revoke your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can declare the cancellation by clicking on the link provided in each newsletter e-mail, by e-mail to service@whokeys.com or by sending a message to the contact details stated in the imprint.

VIII. Registration 1. Description and extent of data processing

On our website, we offer users the opportunity to register by providing personal information. The data is entered into an input mask and transmitted to us and stored. A transfer of the data to third parties takes place only as far as our partner companies need the data for order processing. The following data is collected during the registration process on our website:

(1) Gender

(2) First and Last Name

(3) E-Mail address

(4) Address

(5) Password

At the time of registration, the following data is also stored:

(1) IP-Address

(2) Date and time of registration

As part of the registration process, the consent of the user to process this data is obtained.

2. Legal basis for data processing

In the case of consent, the legal basis for processing the user's data is Art. 6.(1) lit. a EUDATAP. If the registration serves the fulfilment of a contract of which the user is a party or the execution of pre-contractual measures, the additional legal basis for the processing of the data is Art. 6.(1) lit. b) EUDATAP.

3. Purpose of data processing

A registration of the user is necessary to fulfill a contract with the user or to carry out pre-contractual measures.

4. Duration of data storage

The data will be deleted as soon as it is no longer necessary for the purpose of its collection. This is the case during the registration to fulfill a contract or to carry out pre-contractual measures when the data is no longer necessary for the execution of the contract. Even after the conclusion of the contract, there may be a need to store personal data of the contracting party in order to comply with contractual or legal obligations.

5. Possibility of opposition and removal

As a user, you have the option of canceling the registration at any time. You can change the data stored about you at any time. Contact us at the address given in the imprint or write an e-mail to service@whokeys.com. If the data is necessary for the fulfillment of a contract or for the execution of pre-contractual measures, a premature deletion of the data is only possible, as far as contractual or legal obligations do not preclude a deletion obligation

IX. Use of our webshop

If you would like to order in our webshop, it is necessary for the conclusion of the contract that you give the personal data, which we need for the completion of your order. Required data for the processing of contracts are marked separately. Further information is voluntary. We process the data provided by you to process your order. For this purpose, we may pass on your data to third parties. The legal basis for this is Art. 6 (1) lit. b) EUDATAP:

Due to commercial and tax regulations, we are obliged to store your address, payment data and order data for a period of ten years. However, after two years we will restrict the processing of your data, i.e. your data will only be used to comply with legal obligations

X. Contact form and e-mail contact 1. Description and extent of data processing

On our website is a contact form available, which can be used for electronic contact. If a user accepted this option, the data entered in the input mask will be transmitted to us and saved. These data are:

(1) E-Mail address

(2) Time of e-mail dispatch

For the processing of the data in the context of the sending process your consent is obtained and referred to this privacy statement.

Alternatively, contact via the provided e-mail address is possible. In this case, the user's personal data transmitted by e-mail will be stored.

In this context, there is no disclosure of the data to third parties. The data is used exclusively for processing the conversation.

2. Legal basis for data processing

In the event of consent, the legal basis for processing the user's data is Art. 6.(1) lit. a) EUDATAP. The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 (1) lit. f) EUDATAP. If the e-mail contact aims at the conclusion of a contract, then additional legal basis for the processing is Art. 6 (1) lit. b) EUDATAP.

3. Purpose of data processing

The processing of the personal data from the input mask serves us only to process the contact. In the case of contact via e-mail, this also includes the required legitimate interest in the processing of the data.

The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

4. Duration of data storage

The data will be deleted as soon as it is no longer necessary for the purpose of its collection. For the personal data from the input form of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the relevant facts have been finally clarified.

The additional personal data collected during the sending process will be deleted at the latest after a period of seven days.

5. Possibility of opposition and removal

The user has the possibility at any time to revoke his consent to the processing of the personal data. If the user contacts us by e-mail, he may object to the storage of his personal data at any time. In such a case, the conversation can not continue.

Contact us at the address given in the imprint or write an e-mail to service@whokeys.com.

All personal data stored in the course of contacting will be deleted in this case.

XI. Note about Google Analytics

This website uses Google Analytics, a web analysis service of Google Inc. (Google). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, if IP anonymization is activated on this website, your IP address will be cut back by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with further services associated with website and Internet use.

The IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data.

You may refuse the use of cookies by selecting the appropriate settings on your browser. However, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available under the following link:

http://tools.google.com/dlpage/gaoptout?hl=de.

We use Google Analytics to analyse and regularly improve the use of our website. The statistics we collect allow us to improve our services and make them more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Art. 6.(1)lit. f) EUDATAP.

Third Party Information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. User terms: http://www.google.com/analytics/terms/de.html, Overview of data protection: http://www.google.com/intl/de/analytics/learn/privacy.html, as well as the data protection declaration: http://www.google.de/intl/de/policies/privacy.

You can revoke your consent at any time with future effect by sending an e-mail to service@whokeys.com.

XII. Google Remarketing

This website uses the Google Remarketing application. This is a process by which we would like to address you again. This application allows you to see our ads after visiting our website as you continue to use the Internet. This is done by means of cookies stored in your browser, through which your usage behavior when visiting various websites is recorded and evaluated by Google. This is how Google determines your previous visit to our website. A combination of the data collected during the remarketing with your personal data, which may be stored by Google, does not occur according to Google. In particular, according to Google, pseudonymization is used in remarketing. The legal basis for the use of Google Analytics is Art. 6.(1)lit. f) EUDATAP. Our legitimate interest lies in our marketing interests and to inform you about our products and services.

XIII. Your rights

You have the following rights with respect to the personal data concerning you:

1. Right of information,

2. Right of rectification or erasure,

3. Right of restriction of processing,

4. Right to object to the processing,

5. Right of data portability,

6. In addition, you may in principle revoke your prior consent to the collection, processing and use of your personal data at any time with effect for the future. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.

You also have the right to complain about our processing of your personal data at a data protection supervisory authority.

As of May 2018