EEA/UK privacy rights, cookie policy, and data processing addendum.
This addendum supplements our Global Privacy Policy for people in the United Kingdom and the European Union / European Economic Area (EU/EEA). It explains the legal basis for each use of your data, how we protect transfers outside the UK and the EU/EEA, your rights and how to complain, and which cookies the website uses and whether they need your consent.
1. Scope
This addendum applies where the UK GDPR and the Data Protection Act 2018, or the EU General Data Protection Regulation (EU GDPR), apply to our processing of your personal data through www.archai.co.kr. Read it together with our Global Privacy Policy. If the two differ, this addendum prevails for processing governed by those laws.
2. Controller and representatives
- Controller: Archai Electronics Inc. (주식회사 아카이전자), Room 710, 7th floor, 643 Dongtan-daero, Dongtan-gu, Hwaseong-si, Gyeonggi-do 18468, Republic of Korea. E-mail: h.bai@archai.co.kr. Telephone: +82-33-731-7778.
- UK representative (Article 27 UK GDPR): ARCHAI POWERTECH LTD, First Floor, Swan Buildings, 20 Swan Street, Manchester, England, M4 5JW. E-mail: h.bai@archai.co.kr.
- EU representative (Article 27 EU GDPR): none designated. Our processing of personal data of people in the European Union is occasional, does not include special categories of personal data or personal data relating to criminal convictions and offences, and is unlikely to result in a risk to their rights and freedoms (Article 27(2)(a) EU GDPR). You can contact the controller directly.
- Data protection officer: none appointed, because we are not required to appoint one (Article 37 UK GDPR and EU GDPR).
You can contact the controller or our UK representative about any matter relating to your personal data.
3. Purposes and legal bases
| Purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Answering your inquiry and discussing a possible project | Name, organisation, work e-mail address, project brief, e-mail correspondence | Steps taken at your request before entering into a contract, where you contact us on your own behalf (Art. 6(1)(b)); otherwise our legitimate interest in answering business inquiries and building relationships with customers and partners (Art. 6(1)(f)) | 3 years after our last exchange with you |
| Keeping records of inquiries; establishing, exercising or defending legal claims | As above | Our legitimate interest in keeping accurate records of business communications and protecting our legal position (Art. 6(1)(f)) | As above |
| Delivering and securing the website; protecting the contact form against spam and abuse | IP address, request details, browser information, security cookies, bot-detection signals | Our legitimate interest in running a secure and available website (Art. 6(1)(f)) | Runtime logs: up to 7 days; cookies: section 8 |
| Opening the website in a suitable language | Country derived from your IP address at the time of the request (not stored); archai_lang cookie | Our legitimate interest in showing the website in a language you are likely to understand (Art. 6(1)(f)); for the cookie, see section 8 | Country: not stored; cookie: 1 year |
| Complying with legal obligations and lawful requests | Any of the above, as required | Legal obligation under UK law (UK GDPR) or EU or Member State law (EU GDPR) (Art. 6(1)(c)); for obligations under other laws that apply to us, such as Korean law, our legitimate interest in complying with them (Art. 6(1)(f)) | As required by the relevant law |
Where we rely on legitimate interests, we have weighed them against your interests and rights and recorded that assessment. Contact us if you would like more information.
You are not required by law or contract to give us your data. Without your name, e-mail address and project brief we cannot answer through the contact form; you can telephone us instead.
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. We do not ask for, and you should not send us, special categories of personal data such as health data.
4. Recipients
Section 5 of the Global Privacy Policy lists the recipients: Cloudflare, Inc. (hosting, delivery, security, database and storage, as our processor; Cloudflare also processes some network and security data as an independent controller), our e-mail provider Alibaba Cloud (Alibaba Mail), our affiliate Yoono Energy Technology (Jiangsu) Co., Ltd. in China (as our processor, operating the server on which our internal content-management system runs), authorised Archai staff, and authorities where the law requires. We do not otherwise share inquiries with our group companies in the United Kingdom or China.
5. International transfers
When you submit the contact form, you send your data directly to us in the Republic of Korea. We then use service providers in other countries. The safeguards are:
| Recipient | Country | Safeguard |
|---|---|---|
| Archai Electronics Inc. | Republic of Korea | EU: Commission Implementing Decision (EU) 2022/254 on the adequate protection of personal data by the Republic of Korea. UK: the Data Protection (Adequacy) (Republic of Korea) Regulations 2022. |
| Cloudflare, Inc. | United States, where the inquiry database is stored, and other countries where Cloudflare data centres are located | EU: the EU–U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), under which Cloudflare, Inc. is certified (Data Privacy Framework List: www.dataprivacyframework.gov). UK: the UK Extension to the EU–U.S. Data Privacy Framework (the Data Protection (Adequacy) (United States of America) Regulations 2023). Other countries, and as a fallback: EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914), with the UK International Data Transfer Addendum, in Cloudflare's data processing addendum. |
| Alibaba Cloud (Alibaba Mail) | Republic of Korea | The adequacy decisions for the Republic of Korea listed above |
| Yoono Energy Technology (Jiangsu) Co., Ltd. (our affiliate, as our processor) | China | No adequacy decision. EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914, Module Two: controller to processor) with the UK International Data Transfer Addendum, in our intra-group processing agreement. Inquiries pass through the server in China while our staff review them and are not stored there. |
You can ask us for a copy of these safeguards; commercial terms may be redacted.
6. Your rights
Under the UK GDPR and the EU GDPR you have the right to:
- access your personal data and receive a copy (Article 15);
- rectification of inaccurate data (Article 16);
- erasure (Article 17);
- restriction of processing (Article 18);
- data portability for data you gave us that we process on the basis of a contract (Article 20);
- object at any time to processing based on our legitimate interests (Article 21); we will then stop unless we have compelling legitimate grounds or need the data for legal claims;
- withdraw consent at any time where we rely on consent, without affecting earlier processing.
To exercise these rights, contact us as set out in section 2. We respond within one month. For complex or numerous requests we may extend this by up to two further months and will tell you why. We do not charge a fee unless a request is manifestly unfounded or excessive. We may ask for information to confirm your identity.
7. Complaints
To us. You can complain to us about how we use your personal data by e-mail to h.bai@archai.co.kr, by post to the address in section 2 or by telephone. Where the UK GDPR applies, we will acknowledge your complaint within 30 days of receiving it, look into it without undue delay, keep you informed of progress and tell you the outcome.
To a supervisory authority. You can also complain to a regulator, whether or not you have complained to us first:
- United Kingdom: the Information Commission (ICO), https://ico.org.uk/make-a-complaint/, helpline 0303 123 1113.
- EU/EEA: the data protection authority in the Member State where you live or work, or where you believe the infringement took place. The list of authorities is at https://www.edpb.europa.eu/about-edpb/our-members_en.
8. Cookie Policy
8.1 What cookies are
Cookies are small text files that a website stores in your browser. The same rules apply to other technologies that store information on, or read information from, your device.
8.2 Cookies used on this website
| Cookie | Set by | Purpose | Duration | Consent needed? |
|---|---|---|---|---|
archai_lang | Archai (first party) | Remembers the language you chose in the language menu (en or ko) and overrides the location-based default. Set only when you choose a language. | 1 year | No. UK: exempt because its sole purpose is to adapt the website to your preference (Privacy and Electronic Communications Regulations 2003, Schedule A1, paragraph 6); you can object at any time (section 8.3). EU/EEA: no cookie banner is needed because the cookie is set only when you choose a language, and the language menu tells you that your choice is remembered for one year. |
cf_clearance | Cloudflare, on our domain | Records that your browser passed a security check (challenge) shown by Cloudflare. Set only when such a check is shown. | 30 minutes | No. Strictly necessary for security. |
8.3 How to object or remove cookies
- Language cookie: to object, use Forget my choice in the language menu, which deletes
archai_lang; the website will not set it again unless you choose a language again. You can also delete the cookie in your browser settings. Without it, the website opens in the default language for your location. - Security cookie: you can block or delete it in your browser settings, but you may then be unable to continue past a security check when one is shown.
8.4 Location-based default language
This is not a cookie, and nothing is stored on your device. When you open the home page, Cloudflare derives your country from your IP address and we use it only to choose Korean or English for that request. We do not store the country, although Cloudflare's short-term runtime logs may record request details (see section 7 of the Global Privacy Policy). Choosing a language in the language menu overrides it.
8.5 What we do not use
The website uses no analytics, advertising, social media or other tracking cookies or pixels, and loads no third-party content.
9. Changes
We update this addendum together with the Global Privacy Policy. The current version and its effective date are shown at the top of this page.