Privacy Policy — Bold Heart

Controller Information

Developer: Shanxi Yongyi Technology Co., Ltd.

Trading as: Bold Heart

Registered Address: No. 8 Huaxin Avenue, Jiangxian Economic and Technological Development Zone, Yuncheng City, Shanxi Province, 044000, China

Email: contact@boldheart.lat

Phone: +1 719 745 3788

1. Introduction

Shanxi Yongyi Technology Co., Ltd., operating under the brand Bold Heart, is a computer systems design and integrated systems engineering company registered in China. This Privacy Policy explains what personal data we collect, why we collect it, how we process it, and what rights you have regarding your data.

We are committed to protecting your privacy and handling your data transparently. This policy applies whenever you visit our website, communicate with us, or use any service provided by Bold Heart, regardless of your location.

Important: If you do not agree with any term of this Privacy Policy, please discontinue use of our website and services immediately.

2. Types of Data We Collect

We collect two categories of data: information you provide directly and information collected automatically through your interaction with our digital services.

Information You Provide

Contact Data: Full name, email address, phone number, company name, job title.

Communication Data: Messages, inquiries, support requests, and any attachments you send to us via email or contact forms.

Business Data: Project requirements, technical specifications, system descriptions, and other information shared during the course of a business relationship.

Information Collected Automatically

Usage Data: Pages visited, time spent on pages, referral sources, click patterns, and interaction data.

Device Data: IP address, browser type and version, operating system, device type, screen resolution.

Cookie Data: Session identifiers and preference cookies as described in Section 6.

3. Purposes of Data Processing

We process your personal data only for specific, legitimate purposes. Each purpose is tied to a legal basis under applicable data protection law.

Service Delivery: To respond to your inquiries, fulfill contracts, provide technical support, and deliver our systems integration services. Legal basis: performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR).
Communication: To send service-related announcements, respond to support tickets, and manage ongoing business relationships. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
Website Improvement: To analyze how visitors use our site so we can improve content, navigation, and user experience. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
Legal Compliance: To comply with applicable laws, regulations, and legal requests from competent authorities. Legal basis: legal obligation (Article 6(1)(c) GDPR).
Marketing: Only with your explicit consent will we send you information about our services, industry insights, or company updates. Legal basis: consent (Article 6(1)(a) GDPR).

4. Legal Basis for Processing (GDPR)

For individuals in the European Economic Area (EEA), the United Kingdom, and Switzerland, we rely on the following legal bases under the General Data Protection Regulation when processing your personal data:

Consent (Article 6(1)(a): When you have given clear permission for us to process your data for a specific purpose, such as receiving marketing communications.
Contract (Article 6(1)(b): When processing is necessary to fulfill a contract with you or to take steps at your request before entering into a contract.
Legal Obligation (Article 6(1)(c): When we are required to process your data to comply with a legal obligation, such as record-keeping for tax or regulatory purposes.
Legitimate Interests (Article 6(1)(f): When processing is necessary for our legitimate interests or those of a third party, provided your rights and interests do not override those interests. Our legitimate interests include improving our services, maintaining the security of our systems, and managing our business operations.

5. Data Sharing and Third Parties

We do not sell your personal data. We may share your data with trusted third parties only when necessary to provide our services or comply with legal obligations:

Service Providers: Hosting providers, email delivery services, analytics platforms, and customer relationship management tools that process data on our behalf under strict data processing agreements.
Professional Advisors: Legal counsel, accountants, and insurance providers when required for compliance, dispute resolution, or risk management.
Authorities: Law enforcement, regulators, or other government bodies when we are legally required to disclose information.

All third-party service providers are contractually bound to process your data only in accordance with our instructions and to maintain appropriate security measures. They are not permitted to use your data for their own purposes.

6. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyze traffic, and remember preferences.

Essential Cookies: Required for the website to function properly. These cannot be disabled and do not require consent. They include session cookies and security cookies.
Analytics Cookies: Help us understand how visitors interact with our website by collecting anonymous data about page visits, time spent, and navigation paths.
Preference Cookies: Remember your settings and choices to provide a personalized experience on future visits.

You can control cookie settings through your browser preferences. Blocking certain cookies may affect website functionality. We do not use third-party advertising cookies or cross-site tracking cookies.

7. Data Security Measures

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit using TLS 1.2 or higher protocol.
Encryption of sensitive data at rest using AES-256 standards.
Access controls based on the principle of least privilege with multi-factor authentication.
Regular security audits, vulnerability assessments, and penetration testing of our systems.
Employee training on data protection best practices and confidentiality obligations.
Incident response procedures to detect, contain, and remediate security events promptly.

While no system is completely immune to security threats, we continuously review and improve our security posture to minimize risk.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Our retention periods are determined by:

Contractual Data: Retained for the duration of the contract plus seven years to comply with statutory record-keeping requirements.
Communication Data: Retained for two years after the last interaction, unless a longer retention is required for legal or regulatory reasons.
Analytics Data: Retained in anonymized form indefinitely; identifiable data is retained for a maximum of 26 months.
Marketing Consent Records: Retained until you withdraw consent plus one year thereafter for audit purposes.

When data is no longer needed, it is securely deleted or anonymized so that it can no longer be associated with you.

9. Your Rights (GDPR and CCPA)

Depending on your jurisdiction, you may have the following rights regarding your personal data. We will respond to all legitimate requests within the timeframes required by applicable law.

For EEA, UK, and Swiss Residents (GDPR)

Right of Access (Article 15): Request confirmation of whether we process your data and obtain a copy of your personal data.

Right to Rectification (Article 16): Request correction of inaccurate or incomplete data.

Right to Erasure (Article 17): Request deletion of your personal data where there is no compelling reason for continued processing.

Right to Restriction (Article 18): Request temporary suspension of processing in certain circumstances.

Right to Data Portability (Article 20): Receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to Object (Article 21): Object to processing based on legitimate interests, including profiling and direct marketing.

Right to Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Right to Lodge a Complaint: File a complaint with your local data protection supervisory authority if you believe we have violated your rights.

For California Residents (CCPA)

Right to Know: Request disclosure of the categories and specific pieces of personal data we have collected about you.

Right to Delete: Request deletion of personal data we have collected, subject to certain exceptions.

Right to Opt-Out: Direct us not to sell your personal data. We do not sell personal data as defined under the CCPA.

Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

Right to Correct: Request correction of inaccurate personal data maintained by us.

Request Methods: Submit verifiable requests via email to contact@boldheart.lat or by phone at +1 719 745 3788. We will acknowledge receipt within 10 business days and respond within 45 calendar days.

10. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us immediately. We will take steps to delete such data promptly. If we become aware that we have collected personal data from a child without verification of parental consent, we will delete that information from our systems.

11. International Data Transfers

As a company based in China with clients and partners around the world, your personal data may be transferred to and processed in countries outside your jurisdiction of residence, including China, Singapore, Germany, and the United States. When we transfer data across borders, we ensure appropriate safeguards are in place:

Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EEA.
Data Processing Agreements that reflect the requirements of applicable data protection laws.
Binding Corporate Rules where applicable for intra-group transfers.

By submitting your data to us, you acknowledge that your data may be transferred to and processed in jurisdictions that may not have equivalent data protection laws to your home jurisdiction.

12. Third-Party Links

Our website may contain links to external websites, platforms, or services that are not operated by us. Once you leave our website, we have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party site. We encourage you to review the privacy policies of any external websites you visit, particularly if they collect your personal data.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will update the Last updated date at the top of this page and may notify you through a prominent notice on our website or via email if we have your contact information. We encourage you to review this policy periodically to stay informed about how we protect your data.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Developer: Shanxi Yongyi Technology Co., Ltd.

Brand: Bold Heart

Address: No. 8 Huaxin Avenue, Jiangxian Economic and Technological Development Zone, Yuncheng City, Shanxi Province, 044000, China

Email: contact@boldheart.lat

Phone: +1 719 745 3788

Response Time: We aim to respond to all data-related inquiries within 30 days.

Data Protection Officer: For matters specifically concerning data protection and privacy rights, please direct your correspondence to contact@boldheart.lat with the subject line marked Data Protection Request for priority handling.