Privacy Policy

1. Who we are, and who to contact

This website, gearotons.com, is operated by Move the Needle Limited, a company incorporated in Hong Kong (company number 2838963). We sell Gearotons servomotor products and related hardware. In this policy, "we", "us" and "our" mean Move the Needle Limited, and "you" means a visitor to or customer of this website.

For any question about this policy or your personal data — including a request to see, correct or delete it — contact the Data Privacy Officer:

2. What we collect, and whether you have to give it

Information you give us when you order

When you buy from us, you enter your name, email address, telephone number, billing address and shipping address into a form on our checkout page. The form fields are provided by our payment provider, Stripe, but the details are sent to us, and we then store them with Stripe, along with the contents and value of your order, so we can take payment and fulfil it.

Supplying this information is required in order to buy from us — we cannot take payment, ship goods or keep the tax records Hong Kong law requires without it. If you would rather not provide it, you can browse the site without giving us anything; you simply cannot complete an order.

We never receive or store your full card number. Card details are entered directly into Stripe's payment interface and handled by Stripe. We see only the outcome of the payment and a partial card reference, such as the last four digits and the card brand.

Invoices

If you use our invoice or pay-later option, we generate an invoice record containing your order details and the contact and address information above. It is held inside our payment provider's systems, and the invoice record itself is additionally encrypted. Your name, email address, telephone number and addresses are also held there in ordinary, unencrypted form, so that payments can be taken and supported. Invoice payment links are cryptographically signed so they cannot be altered or forged.

The link to your invoice is itself the key to it. Anyone who has that link can view the invoice, so please treat it like a password and do not post it publicly. We never send that link to Google or to any advertising or analytics service.

Your approximate location, to choose a currency

We show prices in one of eight currencies and try to pick the right one for you. To do that we look up the approximate country associated with your IP address using ipapi.co, a third-party service. We do not ask for, and do not collect, your precise device location. You can always override the detected currency using the selector in the site header.

Information collected automatically

• Your cart is stored in your own browser's local storage. It stays on your device and is not transmitted to us until you begin checkout.
• Analytics data. We use Google Analytics 4 to understand how the site is used: pages viewed, approximate location, device and browser type, how you arrived, and interactions such as adding an item to a cart or completing a purchase. This is collected using cookies and similar identifiers. See §7 for where this does and does not happen.
• Advertising data. When you arrive from one of our Google ads, Google adds a click identifier to the web address. We store it in your browser for up to 90 days and attach it to any resulting order, so we can tell which advertising led to which sale.

3. Why we use it

We use your information only for the purposes listed above and purposes directly related to them. If we ever want to use it for something else, we will ask you first.

Where the law requires a legal basis for processing (for example in the UK and EEA), we rely on: performance of a contract for order fulfilment; legal obligation for tax and accounting records; and legitimate interests for fraud prevention, site security and measuring our own advertising.

4. Sharing your information with Google for advertising measurement

We advertise on Google. To measure whether our advertising works, we share limited information about purchases with Google, which performs ad measurement services on our behalf.

This includes a one-way encrypted (hashed) version of your email address, and of your telephone number if you gave us one. When you complete a purchase these are converted in your own browser into an irreversible cryptographic hash (SHA-256) before being sent. Google does not receive your email address or telephone number itself — only these hashes, which Google compares against hashes of its own signed-in users to determine whether an advertisement led to a sale. Google calls this "enhanced conversions".

We also send Google the value, the currency, an order reference number, and the products the order contained — their names, quantities and unit prices. We do not send your name, your postal address, or the link to your invoice.

Google states that it will not share this data with other advertisers, and that it may share it only where required to meet applicable law, regulation, legal process or an enforceable governmental request.

We do not sell your personal data, and we do not exchange it for money or for anything else of value.

If you would rather this did not happen, you can:

• control advertising personalisation at Google Ads Settings;
• install the Google Analytics Opt-out Browser Add-on;
• block or delete cookies through your browser settings; or
• email info@gearotons.com and ask us to stop. We will act on that request.

Google explains how it handles data on behalf of businesses at business.safety.google/privacy.

5. Who we share it with

These are all of them. We do not share your personal data with anyone else.

• Stripe — payment processing and fraud prevention, and where our invoice records are stored. Our Stripe contract is with Stripe Payments Europe, Limited (Ireland).
• Google — Google Analytics 4 and Google Ads, as described in §4.
• ipapi.co — receives your IP address, to return an approximate country for currency selection.
• Vercel and Amazon Web Services — our hosting providers; the site runs on their infrastructure.
• Cloudflare — parts of our site are delivered through Cloudflare's network, including the country-detection lookup described in §2, so Cloudflare receives your IP address and browser details. It receives no order or account information.
• Shipping carriers and customs brokers — name, address, phone number and a description of the goods, so your order can be delivered and cleared through customs.
• Our accountants, and tax or regulatory authorities — where we are legally required to disclose.

6. Sending data outside Hong Kong

We are based in Hong Kong. Stripe, Google, Vercel, Amazon Web Services, Cloudflare and ipapi.co process data in other countries, including the United States and the European Union. We rely on the contractual protections those providers offer in their standard data processing terms, including the standard contractual clauses where they apply.

7. Cookies, tracking, and Do Not Track

Where the analytics and advertising cookies are set. Google Analytics and Google Ads cookies are set when you arrive on the site — but not if you are visiting from the European Economic Area, the United Kingdom or Switzerland. In those places the law requires us to obtain your consent before setting cookies of this kind, and rather than ask you for consent we simply do not load the Google tag at all. If we cannot determine where you are, we do not load it either.

Everywhere else, these cookies are set without asking you first. If you do not want them, §4 lists the ways to prevent or remove them.

Do Not Track. Some browsers can send a "Do Not Track" signal. There is no common industry standard for how a website should respond to one, and we do not currently respond to Do Not Track signals. We also do not currently respond to Global Privacy Control signals. The controls in §4 do work, and we will act on an email request.

Tracking across other websites. Google, as a third party, may use the cookies it sets on this site to recognise your browser on other websites that also use Google's advertising or analytics services. That is what makes it possible for Google to tell us that an advertisement led to a sale. No other third party collects personally identifiable information about your activity across websites through this site.

8. How long we keep it

We keep order and invoice records for at least seven years from the end of the financial year in which the transaction was completed. We are required to retain them for that period under Hong Kong law — the Inland Revenue Ordinance and the Companies Ordinance both require business and accounting records to be kept for seven years — and we may keep them longer where a warranty or a legal claim is still possible.

Order and invoice records are held inside our payment provider's systems as well as our own, and are retained there in line with that provider's own practices and our legal obligations.

Analytics data is retained for 14 months.

Being straight with you about deletion: once an invoice has been issued it becomes a financial record that we are legally obliged to keep, and our payment provider does not permit a completed invoice to be deleted. So we cannot promise to erase a completed order on request. What we can do, and will do, is delete or anonymise anything that is not part of that statutory record — see §9.

9. Your rights

Everyone, wherever you are, can ask us to:

• tell you whether we hold personal data about you, and give you a copy of it;
• correct anything that is wrong;
• stop sharing your data with Google for advertising measurement;
• delete anything we are not legally required to keep. Where a statutory retention period applies (see §8) we will tell you which record we have to keep, and why.

To exercise any of these, email info@gearotons.com or write to the Data Privacy Officer at the address in §1. We may need to verify your identity before acting.

We will respond to a request to see or correct your data within 40 days, as Hong Kong's Personal Data (Privacy) Ordinance requires. If we cannot complete it in time we will tell you so in writing before the 40 days are up, explain why, and finish as soon as we can. We do not charge a fee for either kind of request.

If you are in the UK or the EEA, you additionally have rights to restrict or object to processing, to data portability, and to withdraw consent where we rely on it. We aim to answer within one month. You may also complain to your national data protection authority.

If you are in Hong Kong, you may complain to the Office of the Privacy Commissioner for Personal Data.

We will not treat you differently for exercising any of these rights.

10. Children

This website is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact info@gearotons.com and we will delete it.

11. Security

The site is served over HTTPS. Card data is handled entirely by Stripe and never reaches our servers. The invoice record is additionally encrypted, and invoice payment links are cryptographically signed to prevent tampering. No system is perfectly secure, but we take reasonable measures to protect your information.

12. Reviewing this policy, and changes to it

You can review this policy at any time at gearotons.com/privacy, and it is linked from the footer of our shop and information pages, and from the checkout screen itself. If you believe anything in it is inaccurate, or you want to request a change to the personal data we hold about you, email info@gearotons.com and we will respond within 40 days.

If we make a material change to this policy we will update the effective date at the top of this page and post a notice of the change on this page. Where we have your email address because you have ordered from us, and the change materially affects how we use your data, we will also email you.