Privacy Policy — Voltaxion Limited

Voltaxion Limited Data Controller Effective 1 January 2026 Version 1.0

1. Who we are

Voltaxion Limited ("Voltaxion", "we", "us") is a private company limited by shares incorporated in the Hong Kong Special Administrative Region. We act as the data controller in respect of personal data collected through voltaxion.com and in connection with our B2B commercial activity.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, on what legal basis, how long we retain it, with whom we share it, and the rights you have. It is designed to be consistent with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the United Kingdom GDPR and the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486).

2. The data we collect

Voltaxion is a B2B service. We do not knowingly collect data from consumers. The personal data we collect relates to the individuals who interact with us on behalf of a business:

Application and contact data — name, business email address, business phone number, job title, the name and country of registration of the company you represent, your estimated purchase volume and product interests, and any free-text message you send us via our forms or by email.
KYC and onboarding data — once an application is approved, we collect company registration documents, beneficial ownership information, identification documents of authorised signatories, and proof of trading address. This data is processed under our regulatory obligations.
Commercial data — quotations issued, orders placed, payments made, shipping addresses, and transaction history associated with your business account.
Technical data — IP address, browser type, device type, operating system, referring page, and aggregated usage statistics collected automatically when you visit voltaxion.com. We use a minimal set of strictly-necessary cookies and an aggregated analytics measurement (no cross-site tracking, no advertising cookies).

3. How we use your data

We use personal data for the following purposes:

To respond to your enquiries and process your application for access to our wholesale catalog;
To perform KYC, sanctions screening and ongoing customer due diligence;
To issue quotations, process orders, invoice you, deliver goods and provide after-sales support;
To comply with our legal, tax, customs and accounting obligations;
To detect, prevent and investigate fraud, payment diversion and abuse of our services;
To maintain and secure voltaxion.com and our internal systems; and
To send you operational communications and, where you have not objected, occasional commercial updates about our catalog and services.

4. Legal bases for processing

Under the GDPR, we rely on the following legal bases:

Performance of a contract (Art. 6(1)(b)) — to process applications, quotations, orders and shipments;
Compliance with a legal obligation (Art. 6(1)(c)) — for KYC, sanctions, tax, customs and accounting records;
Legitimate interests (Art. 6(1)(f)) — to operate, secure and improve our business, to prevent fraud, and to send operational updates to existing business contacts. Where we rely on legitimate interests, you have the right to object — see section 7;
Consent (Art. 6(1)(a)) — for any marketing communication where consent is required by applicable law. Consent can be withdrawn at any time.

5. Who we share your data with

We do not sell personal data. We share personal data only where necessary and with appropriate safeguards:

Voltaxion group entities operating the regional hubs in Hong Kong, Shenzhen, Dubai, Rotterdam and Miami, on a need-to-know basis;
Service providers acting on our instructions (email hosting, accounting, KYC vendors, banks, payment institutions, freight forwarders, customs brokers, cloud infrastructure providers);
Regulators, law-enforcement bodies, courts and tax authorities, where we are legally required to disclose; and
Professional advisors (lawyers, auditors) bound by confidentiality.

All third parties are bound by written contracts that restrict their processing of personal data to our instructions and require appropriate technical and organisational security measures.

6. International transfers

Voltaxion operates internationally. Personal data may be transferred to, and processed in, jurisdictions outside your country of residence, including Hong Kong, mainland China, the United Arab Emirates, the Netherlands and the United States. Where such transfers involve personal data subject to the GDPR, we put appropriate safeguards in place, including the European Commission's Standard Contractual Clauses, and we conduct transfer impact assessments where required.

7. Your rights

Subject to applicable law you have the right to:

Access the personal data we hold about you and obtain a copy;
Request the correction of inaccurate or incomplete data;
Request erasure where applicable (this right is limited where we are required by law to retain records);
Object to processing based on legitimate interests, and to direct marketing at any time;
Request restriction of processing in certain circumstances;
Request portability of data you have provided to us, in a structured machine-readable format;
Withdraw any consent you have given, without affecting the lawfulness of processing prior to withdrawal; and
Lodge a complaint with a supervisory authority (in the EU, your national data protection authority; in Hong Kong, the Office of the Privacy Commissioner for Personal Data).

To exercise any of these rights, contact us at privacy@voltaxion.com. We will respond within thirty (30) days. We may need to verify your identity before acting on the request.

8. Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, and to comply with our legal, accounting and regulatory obligations.

Application data of declined or inactive prospects: up to twenty-four (24) months from last contact;
KYC, transaction, invoicing and customs records: seven (7) years from the end of the relevant fiscal year, in accordance with Hong Kong and EU recordkeeping requirements;
Marketing contact lists: until consent is withdrawn or an objection is received;
Technical logs: typically twelve (12) months.

9. Security

We implement technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include access controls, encryption in transit, segregated administrative environments, regular backups, vendor due diligence and staff confidentiality obligations. No system is perfectly secure, and we cannot guarantee absolute security; we will notify affected individuals and competent authorities of any data breach in accordance with applicable law.

10. Cookies

voltaxion.com uses a minimal set of strictly-necessary cookies required for the website to function. We do not use advertising cookies, cross-site tracking or third-party social-media trackers. You can disable cookies in your browser settings; some site features may not function without them.

11. Children

Voltaxion is a B2B service. Our site and services are not directed at children and we do not knowingly collect personal data from anyone under the age of eighteen (18). If you believe a child has provided us with personal data, contact us so that we can delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top of this page indicates the version in force. Material changes will be communicated to active business contacts by email or via voltaxion.com.

13. Contact

Voltaxion Limited — Data Controller
Privacy queries: privacy@voltaxion.com
General enquiries: hello@voltaxion.com