SMART BITS

Effective Date: September 30, 2026

1. Introduction

SMART BITS PHONE ACCESSORIES LIMITED, whose registered office is located at Sky Business Centres, 57 Clontarf Road, Dublin 3, D03 A7P0, Ireland (referred to as “we”, “us” or “our” in this Privacy Policy), is committed to protecting the privacy rights and personal data of all users who visit our e-commerce website www.smartbitsphone.com (referred to as the “Website”) and use our services for purchasing mobile phone accessories and related products. Your privacy is of paramount importance to us, and this Privacy Policy is designed to clearly inform you of the types of personal data we collect, the purposes for which we process your information, the parties with whom we may share your data, the duration for which we retain your personal data, and the full scope of rights you hold regarding your personal information, in full compliance with applicable data protection laws.

This Policy applies to all personal data processing activities carried out through our Website, related mobile applications (if any), customer service channels, and all sales, marketing and after-sales services we provide to you. By accessing, browsing the Website or completing a purchase order on our platform, you confirm that you have fully read, understood and agreed to the terms outlined in this Privacy Policy. If you do not agree with any part of this Policy, please do not access our Website or use our services. As the data controller for all personal data collected through our platform, we strictly abide by the General Data Protection Regulation (EU) 2016/679 (GDPR), the Data Protection Acts 1988 to 2018 of Ireland, the Privacy and Electronic Communications (Regulations) 2011 (as amended), and the UK GDPR when providing services to users located in the United Kingdom, ensuring all processing of your personal data follows the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

2. Definition of Personal Data

For the purposes of this Policy, “personal data” refers to any information relating to an identified or identifiable natural person (“you”, the “user” or “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This definition includes all categories of sensitive personal data as defined by applicable law, such as information related to payments, contact details, and any other information that can be linked back to you as a unique individual. The personal data we collect through your use of our services is clearly distinguished from user-uploaded content that you voluntarily make public on our platform where permitted, and we will never process such data outside the scope set out in this Policy.

3. Categories of Personal Data We Collect

We only collect personal data that is necessary for the specific, explicitly stated and legitimate purposes outlined in this Policy, in compliance with the “data minimisation” and “legitimate and necessary” principles required by data protection legislation. The categories of personal data we may collect include:

• ‌Account and Registration Information‌: When you create a user account on our Website, we will collect your username, valid email address, contact phone number, and any additional information you voluntarily provide to complete your account profile.
• ‌Order and Transaction Information‌: When you place an order on our platform, we collect your full delivery name, detailed delivery address, payment card or payment method billing information, order details, purchase history, transaction amount, and related order notes to process and fulfil your purchase.
• ‌Technical and Usage Data‌: When you browse our Website, we automatically collect certain technical information including your internet protocol (IP) address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, device information, the uniform resource locators (URLs) you click through to and from our site, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.
• ‌Marketing and Preference Information‌: We may collect your preferences related to receiving marketing communications, product interests, feedback you submit to us through surveys, customer service interactions, and any information you voluntarily provide when participating in our promotional activities or loyalty programs.
• ‌Sensitive Personal Data‌: In general, we do not intentionally collect special categories of sensitive personal data as defined by GDPR, including information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. The only limited exceptions are payment-related financial data necessary to process your transactions, and in limited scenarios for cross-border deliveries where we may collect relevant information required for customs clearance, which we will only process with your explicit separate consent.

We explicitly state that we will never collect information related to your occupation without your explicit written separate consent, and we will never force you to provide non-essential personal information to access the core shopping functions of our Website. For ordinary daily purchases of mobile phone accessories from our platform, we do not require you to provide legal identification document numbers unless you are completing a cross-border order that requires customs clearance verification, at which point we will clearly notify you of the purpose of collecting this information and obtain your separate specific consent before any collection takes place.

4. Purposes of Processing Your Personal Data

We will only process your personal data for the explicit, legitimate purposes disclosed at the time of collection, and will never further process your data in a manner incompatible with these purposes. The core processing purposes include:

• ‌Order Fulfilment and Service Delivery‌: We use your personal data to process your purchase orders, arrange product delivery, verify your identity for transaction security, process payments, handle returns, exchanges and after-sales support, and send you real-time updates related to your order status via email, SMS or other agreed communication channels. This processing is necessary for the performance of the sales contract we enter into with you when you place an order on our Website.
• ‌Website Function Optimization and User Experience Improvement‌: We process your browsing and usage data to troubleshoot technical issues on our Website, optimise page loading speeds, test new features of our platform, analyse user navigation patterns, and personalise your browsing experience to present product displays and service content that better match your preferences, based on our legitimate interest in maintaining a stable, high-performance e-commerce platform that meets user needs.
• ‌Security and Fraud Prevention‌: We process your personal data to verify account identities, detect and prevent unauthorised access to user accounts, fraudulent transactions, malicious attacks and other illegal activities, protect the security of our technical systems, our business operations, and the legitimate rights and interests of all our users. This processing is based on our legitimate interest in ensuring the secure and reliable operation of our e-commerce services.
• ‌Legitimate Marketing Communications‌: With your explicit separate consent where required by applicable law, we may use your email address and contact information to send you promotional newsletters, information about new mobile phone accessory product launches, exclusive discount offers, event notifications and other marketing content related to our products and services. You retain the full right to opt out of receiving such marketing communications at any time, free of charge, by clicking the “unsubscribe” link included in all marketing emails, or by sending an opt-out request to our contact email listed in Section 10 of this Policy.
• ‌Legal Compliance and Regulatory Obligations‌: We may process your personal data when it is necessary for us to comply with our legal obligations under applicable tax laws, commercial regulations, consumer protection legislation, court orders or valid requests from competent public authorities.
• ‌Legitimate Business Analytics‌: We may aggregate and anonymise personal data to generate de-identified business statistical reports, which help us analyse overall platform sales trends, user demographic characteristics, product popularities and market operation status, to guide our product procurement, inventory management and business strategy adjustments. Such anonymised data no longer qualifies as personal data under applicable data protection laws, and we may process and use it without additional restriction in line with relevant regulations.

5. Legal Bases for Processing Your Personal Data

In strict accordance with data protection law requirements, all our processing activities of your personal data are supported by clear and valid legal bases:

1. ‌Contract Performance‌: The processing of your order, delivery, transaction and related service information is necessary for the performance of the purchase contract between you and us, and to take steps at your request prior to entering into that contract when you submit an order on our Website.
2. ‌Legal Obligation‌: Some of our processing activities are necessary for us to comply with our legal obligations, including but not limited to retaining transaction records to meet Irish tax law requirements, and cooperating with legally authorised requests from law enforcement agencies.
3. ‌Legitimate Interests‌: Where relevant, we process your personal data based on our legitimate interests that do not override your fundamental privacy rights, including preventing fraud, optimising our Website functionality, conducting appropriate direct marketing to existing customers, and improving our overall product and service quality, all of which are carried out in a proportionate manner that minimises impact on your privacy.
4. ‌Explicit Consent‌: For any processing activities that rely on your specific separate consent, including sending non-contractual marketing communications to new users, collecting information for non-mandatory market research activities, or processing limited sensitive personal data where permitted by law, we will obtain your freely given, specific, informed and unambiguous consent. You have the full right to withdraw your consent at any time, which will not affect the lawfulness of processing based on consent before its withdrawal.

6. Recipients and Sharing of Your Personal Data

We will never sell, rent or trade your personal data to third parties for their independent marketing purposes without your explicit prior separate consent. We may share your personal data only with the following categories of recipients, to the limited extent necessary to achieve the purposes outlined in this Policy:

• ‌Trusted Third-Party Service Providers‌: We share necessary personal data with carefully selected service providers who perform critical functions on our behalf, including payment processing agencies, logistics and delivery partners, cloud service hosting providers, IT system maintenance providers, email and SMS notification service providers, and professional audit and legal consultants. All such third parties are bound by strict data protection agreements that require them to process your personal data only in accordance with our instructions, comply with all applicable data protection laws, and implement appropriate security measures to protect your information.
• ‌Business Successors‌: In the event of a merger, acquisition, sale of all or a portion of our assets, or other corporate restructuring, your personal data may be transferred to the relevant successor entity, under the terms that the processing of your personal data remains governed by this Privacy Policy, unless you are notified of and required to consent to any material changes to the processing arrangements.
• ‌Competent Public Authorities and Regulatory Bodies‌: We may disclose your personal data if we are required to do so by applicable law, court order, or a valid legally binding request from a government authority, to protect our legal rights, the safety of our users, our staff, or the general public.

7. International Transfers of Personal Data

As an Irish-based e-commerce platform operating within the European Economic Area (EEA), we primarily store and process your personal data on servers located within the EEA. In limited circumstances, it may be necessary for us to transfer your personal data to recipients located in countries outside the EEA, where the level of data protection has not been formally recognised by the European Commission as adequate. In all such cases, we will take all appropriate measures to ensure that the transfer complies strictly with the requirements of Chapter V of the GDPR, including but not limited to entering into standard data protection clauses approved by the European Commission with the overseas data recipients, or implementing other appropriate legally recognised safeguards to ensure your personal data is protected to the same high standard as required under Irish and EU data protection law.

If you are a user located in mainland China and use our services, we confirm that we will comply with the Personal Information Protection Law of the People’s Republic of China and relevant regulations if your personal data is required to be transferred outside of mainland China. We will complete all required legal procedures, including notifying you of the name of the overseas receiving party, contact information, processing purpose, processing method, types of personal data involved, and the methods and procedures for you to exercise your data rights against the overseas recipient, and obtaining your explicit separate consent before any cross-border transfer of your personal data takes place.

8. Retention Period of Your Personal Data

We will not retain your personal data for longer than is strictly necessary to fulfil the specific purposes for which the personal data is processed, in compliance with the storage limitation principle of data protection law. Our standard retention schedule is as follows:

• Basic account information including your username, registered email address, delivery contact information submitted in your account profile: we retain this data for the full duration that you keep your user account active on our platform. If you choose to permanently delete your account, we will erase all such related personal data within 14 working days, subject to the limited exceptions outlined below.
• Browsing records and Website usage behavioural data: we retain this data for a maximum period of 12 months after the date of your access to the relevant web page, after which we anonymise or permanently delete such data.
• Purchase history, transaction records and related order information: we retain these records for a period of 7 years after the completion of the relevant transaction, to meet the requirements of Irish commercial law, tax law, and product after-sales warranty obligations, after which such data will be securely archived or deleted.
• Marketing preference records: we retain this data for the full period during which you consent to receiving marketing communications from us, and we will mark your contact information on our global marketing suppression list within 3 working days after you submit an opt-out request, retaining that suppression marking permanently to ensure we do not send you unwanted marketing content in the future.

After the relevant retention period expires, we will either securely delete or permanently anonymise your personal data, to ensure that it can no longer be linked to you as an identifiable natural person. Where we are required to retain your personal data for longer periods to meet specific legal, tax or audit requirements, we will isolate the relevant data from active processing systems, and restrict such processing exclusively to meet those specific regulatory requirements for the duration of the extended retention period.

9. Your Rights as a Data Subject

Under applicable Irish and EU data protection laws, you hold a comprehensive set of rights regarding your personal data processed by us. You may exercise the following rights at any time, free of charge, by submitting a request to us via the contact details provided in Section 10 of this Policy:

• ‌Right of Access‌: You have the right to obtain a confirmation from us as to whether or not personal data concerning you is being processed, and where that is the case, to access a copy of your personal data, together with information about the processing purposes, categories of personal data, recipients of your data, the planned retention period, and all other information required by Article 15 of the GDPR.
• ‌Right to Rectification‌: You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement. You can directly modify most of your basic account and contact information on the account settings page of our Website at any time.
• ‌Right to Erasure (“Right to be Forgotten”)‌: You have the right to obtain from us the erasure of personal data concerning you without undue delay, under the circumstances specified by applicable law, including where the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, where you withdraw your consent on which the processing is based, or where you object to the processing and there are no overriding legitimate grounds for the processing. This right does not apply where the processing is necessary for compliance with a legal obligation that requires processing by Union or Member State law to which we are subject, or for the establishment, exercise or defence of legal claims.
• ‌Right to Restriction of Processing‌: You have the right to obtain from us restriction of processing of your personal data, where one of the following conditions applies: you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data; the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; or you have objected to processing pursuant to our legitimate interests, pending the verification whether our legitimate grounds override your grounds.
• ‌Right to Data Portability‌: You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from us, where the processing is based on consent or on a contract, and the processing is carried out by automated means.
• ‌Right to Object‌: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on our legitimate interests, including profiling based on those provisions. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. You also have the absolute right to object at any time to processing of your personal data for direct marketing purposes, in which case we will immediately cease processing your personal data for such marketing purposes.
• ‌Right to Withdraw Consent‌: Where processing of your personal data is based on your explicit consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
• ‌Right to Lodge a Complaint‌: If you believe that our processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with the relevant data protection supervisory authority, in particular in the European Union Member State of your habitual residence, place of work or place of the alleged infringement. For users in Ireland, the relevant supervisory authority is the Data Protection Commission of Ireland.

We will respond to any valid data subject request you submit within one month of receipt of the request. For complex or large volumes of requests, we may extend the response period by a maximum of two additional months, for which we will notify you within one month of receipt of your request, explaining the reasons for the delay. We will not charge any fee for processing your data subject request unless your request is manifestly unfounded, excessive or repetitive, in which case we may charge a reasonable administrative fee or refuse to act on the request. To verify your identity before processing your request, we may request you to provide additional necessary information to confirm that you are the user to whom the requested personal data relates.

10. Contact Information

If you have any questions, comments, concerns or requests related to this Privacy Policy or our personal data processing practices, you can contact our designated data protection representative at the following contact details at any time:
Company Name: SMART BITS PHONE ACCESSORIES LIMITED
Contact Address: Sky Business Centres, 57 Clontarf Road, Dublin 3, D03 A7P0, Ireland
Contact Email: [email protected]
Contact Telephone Number: +353 1 853 2533

11. Updates to This Privacy Policy

We may revise and update this Privacy Policy from time to time as required by changes to our business operations, new product and service launches, or updates to applicable data protection laws and regulatory requirements. We will notify you of any material changes to this Policy via a prominent notice on the homepage of our Website, and by sending an email notification to your registered email address before the changes take effect. The updated version of the Policy will be marked with a new “Effective Date” at the top of the document. Your continued access to our Website and use of our e-commerce services after the effective date of the updated Privacy Policy will constitute your acknowledgement and agreement to the revised terms. We encourage you to review this Privacy Policy periodically each time you visit our platform, to stay fully informed of how we protect your personal data.