Privacy & Data Protection Policy

1Introduction

Samway Global Limited (“Samway Global”, “we”, “us” or “our”) respects the privacy and protection of personal information.

This Privacy & Data Protection Policy explains how we collect, use, disclose, store and protect personal information when you:

• visit our website
• contact us
• request information or a quotation
• use our sourcing or procurement services
• enter into a business relationship with us
• communicate with us
• otherwise interact with Samway Global

This Policy is intended to comply with applicable UK privacy and data-protection legislation, including, where applicable:

• the UK General Data Protection Regulation (“UK GDPR”)
• the Data Protection Act 2018 (“DPA 2018”)
• the Privacy and Electronic Communications Regulations 2003 (“PECR”)
• the Data (Use and Access) Act 2025 (“DUAA”), as amended and in force from time to time

The DUAA amends the existing UK data-protection framework rather than replacing the UK GDPR, DPA 2018 or PECR. The ICO confirms that all data-protection provisions of the DUAA are now in force.

2Data Controller

For personal information that we process for our own business purposes, the data controller is:

Samway Global Limited
Company Number: 17496452
110 Aubrey Road
Small Heath
Birmingham
B10 9DF
United Kingdom

Email: [email protected]
Website: samwayglobal.com

3Personal Information We May Collect

Depending on your relationship with us, we may collect and process the following categories of information.

3.1Identity Information

This may include:

• name
• job title
• position
• business role
• other information necessary to identify you in a professional capacity

3.2Contact Information

This may include:

• email address
• telephone number
• business address
• postal address
• other business contact details

3.3Business Information

This may include:

• company name
• company registration information
• business activities
• industry
• purchasing requirements
• sourcing requirements
• other professional information

3.4Enquiry and Correspondence Information

This may include information contained in:

• enquiry forms
• emails
• telephone communications
• quotation requests
• messages
• correspondence
• meeting records
• other communications with us

3.5Transaction and Contract Information

This may include:

• quotations
• purchase orders
• contracts
• invoices
• payment records
• shipping information
• product requirements
• other information relating to commercial transactions

3.6Technical Information

When you use our website, we may process certain technical information where applicable, such as:

• IP address
• browser type
• device type
• operating system
• website activity
• approximate technical location information
• information generated through cookies or similar technologies

The exact information collected depends on the technologies actually installed and operating on our website.

4How We Collect Personal Information

We may collect personal information:

• directly from you
• when you submit an enquiry
• when you request a quotation
• when you contact us by email or telephone
• when you enter into a contract with us
• when you place or discuss an order
• from your company or organisation
• from publicly available business sources
• from suppliers or business partners
• from professional service providers
• through our website
• through cookies and similar technologies where applicable

Where we obtain personal information from another source, we will provide the privacy information required by applicable law, subject to any lawful exception.

5Why We Use Personal Information

We may use personal information for purposes including:

• responding to enquiries
• providing quotations
• understanding customer requirements
• providing sourcing and procurement services
• identifying and communicating with suppliers
• coordinating product samples
• coordinating manufacturing
• arranging quality inspections
• coordinating shipping and logistics
• managing customer and supplier relationships
• entering into and performing contracts
• administering payments
• maintaining commercial records
• providing customer service
• investigating complaints
• preventing fraud and misuse
• protecting our website and systems
• maintaining information security
• complying with legal and regulatory obligations
• establishing, exercising or defending legal claims
• managing debt and payment recovery
• conducting lawful business-to-business marketing
• improving our website and services where permitted
• other purposes explained to you at the time your information is collected

6Lawful Bases for Processing

We will process personal information only where there is an appropriate lawful basis under applicable data-protection law.

Depending on the circumstances, the lawful basis may include:

6.1Contract

We may process personal information where necessary to:

• enter into a contract
• perform a contract
• manage an existing commercial relationship
• take steps at your request before entering into a contract

6.2Legitimate Interests

We may process personal information where necessary for our legitimate interests, provided that those interests are not overridden by the individual’s rights and freedoms.

Our legitimate interests may include:

• operating our business
• managing customer and supplier relationships
• communicating with business contacts
• providing and improving our services
• protecting our business and property
• maintaining security
• preventing fraud
• recovering debts
• managing legal claims
• conducting lawful B2B marketing

Where we rely on legitimate interests, we will consider whether the processing is necessary and whether the individual’s rights and interests require additional protection.

6.3Legal Obligation

We may process personal information where necessary to comply with a legal or regulatory obligation, including accounting, tax, regulatory, reporting or other legal requirements.

6.4Consent

Where applicable law requires consent, we will request it in an appropriate manner.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

7Business-to-Business Marketing

Samway Global is primarily a B2B business.

We may communicate with business contacts about our services where permitted by applicable law.

Electronic marketing is subject to PECR as well as data-protection legislation. The applicable rules can differ depending on the type of recipient and communication.

Where consent is required, we will obtain the appropriate consent.

You may object to direct marketing at any time by contacting:

[email protected]

Once you object to direct marketing, we will stop using your personal information for that purpose, subject to any limited information that may need to be retained to record and respect your objection.

8Who We May Share Personal Information With

Where necessary and lawful, we may share personal information with:

• manufacturers
• suppliers
• sourcing partners
• inspection companies
• freight forwarders
• shipping companies
• logistics providers
• customs and clearance providers
• payment providers
• banks
• accountants
• lawyers
• insurers
• professional advisers
• website hosting providers
• IT and technology providers
• communications providers
• regulators
• government authorities
• courts
• law-enforcement authorities where legally required

We do not sell personal information to third parties.

We only share information where there is a legitimate business, contractual or legal reason to do so.

9International Transfers

As Samway Global operates internationally and sources products from Vietnam and other countries, personal information may sometimes be transferred to or accessed from countries outside the United Kingdom.

This may occur where we communicate with:

• manufacturers
• suppliers
• inspection providers
• logistics providers
• professional advisers
• other service providers located outside the UK

Where a transfer is subject to UK international-transfer requirements, we will use an appropriate lawful transfer mechanism or safeguard where required.

Depending on the circumstances, this may include:

• an applicable UK adequacy regulation
• the UK International Data Transfer Agreement (“IDTA”)
• the UK Addendum to standard contractual clauses
• appropriate safeguards recognised under applicable law
• another lawful transfer mechanism

10Data Security

We take reasonable technical and organisational measures designed to protect personal information against:

• unauthorised access
• unlawful processing
• accidental loss
• destruction
• alteration
• unauthorised disclosure
• other forms of misuse

However, no website, electronic communication or storage system can be guaranteed to be completely secure.

Where a personal-data breach occurs, we will assess and respond to the breach in accordance with applicable law.

11Data Retention

We will not retain personal information for longer than reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

Retention periods may vary depending on the nature of the information.

As a general guide:

Enquiries and correspondence:
Normally retained for as long as reasonably necessary to manage the enquiry and business relationship, generally up to two years after meaningful contact ends unless a longer period is justified.

Contracts, orders and commercial records:
Retained for as long as reasonably necessary for contractual administration, accounting, legal, regulatory and dispute-resolution purposes.

Financial and accounting records:
Retained for the period required by applicable tax, accounting and legal requirements.

Marketing records:
Retained while the marketing relationship continues and, where necessary, to maintain records of objections or consent.

Complaints and disputes:
Retained for as long as reasonably necessary to investigate, resolve and document the matter and to deal with any resulting legal or regulatory requirements.

Where a fixed retention period is not appropriate, we will consider factors including the nature of the information, the purpose of processing, legal requirements and the possibility of claims or disputes.

12Your Data Protection Rights

Subject to applicable legal conditions and exemptions, you may have rights including:

• the right to be informed
• the right of access
• the right to rectification
• the right to erasure
• the right to restrict processing
• the right to object
• the right to data portability where applicable
• the right to withdraw consent where processing is based on consent
• rights relating to certain automated decision-making and profiling

These rights are not absolute and may be subject to legal conditions and exemptions.

13Right to Object to Direct Marketing

You have an absolute right to object to the processing of your personal information for direct marketing purposes.

If you object to direct marketing, we will stop processing your personal information for that purpose, subject to any limited processing necessary to record and respect your objection.

14How to Exercise Your Rights

To exercise a data-protection right or ask a privacy-related question, contact:

Samway Global Limited
Email: [email protected]

We may need to verify your identity before responding to certain requests.

We will deal with valid requests within the timeframe required by applicable law.

15Special Category Data

We do not ordinarily request or intentionally collect special category personal data through our website or normal B2B sourcing activities.

Special category data may include information concerning matters such as health, biometric information, racial or ethnic origin, political opinions, religious beliefs or sexual orientation.

Please do not provide sensitive personal information through our website unless it is genuinely necessary for a specific purpose.

Where we process special category information, we will do so only where an appropriate legal condition applies.

16Children’s Information

Our website and services are primarily intended for businesses and professional users.

They are not directed towards children.

We do not knowingly seek to collect children’s personal information for ordinary business purposes.

If we become aware that information has been submitted by a child in circumstances where it should not have been collected, we will take appropriate steps in accordance with applicable law.

17Automated Decision-Making and Profiling

We do not currently intend to make decisions about individuals based solely on automated processing where those decisions produce legal or similarly significant effects.

If our practices change and such processing is introduced, we will provide the information and safeguards required by applicable law.

18Cookies and Similar Technologies

Our website may use cookies and other technologies that store information on, or access information from, a visitor’s device.

These technologies may include:

• cookies
• tracking pixels
• scripts
• tags
• web storage
• other similar technologies

PECR applies to technologies that store or access information on a user’s device, not just traditional cookies. Where personal data is involved, UK data-protection law may also apply.

Where applicable law requires consent, we will obtain consent before using the relevant non-exempt technology.

Non-exempt technologies should not be pre-enabled before the required consent is obtained.

Our Cookie Policy provides additional information about the technologies actually used on our website.

19Third-Party Websites

Our website may contain links to third-party websites.

We are not responsible for the privacy practices, content, security or data-protection practices of third-party websites.

You should review the privacy policies of third-party websites before providing them with personal information.

20Data Protection Complaints

If you have concerns about how Samway Global has processed your personal information, please contact us first:

[email protected]

We will investigate your concern and respond in accordance with applicable legal requirements.

You also have the right to complain to the UK’s data-protection regulator:

Information Commissioner’s Office (ICO)

Website: ico.org.uk

The ICO is the UK’s independent supervisory authority for data-protection matters.

21Changes to This Policy

We may update this Privacy & Data Protection Policy when:

• our business changes
• our website changes
• our technology changes
• our data-processing activities change
• our service providers change
• applicable law or regulatory guidance changes

The latest version will be published on our website with the applicable effective date.

22Contact Details