Data Controller
The data controller is YOTOR Commercial International Ltd, whose registered office is located at: Suite 404, The Catalyst, Silicon Avenue, 72201 Ebene Cybercity, Mauritius. Contact: contact@yotorltd.com, +33 6 36 48 88 64.
In addition to the GDPR, our processing complies with the Mauritius Data Protection Act 2017.
YOTOR has not appointed a data protection officer, as this is not mandatory for its activities. For any question about your data, write to contact@yotorltd.com.
Data Processed, Purposes, Legal Bases and Retention Periods
Browsing the Website
- Data
- IP address, date and time of connection, pages viewed, browser and operating system type, recorded automatically in the hosting provider’s technical logs.
- Purpose
- Displaying the website and ensuring its security and proper operation.
- Legal basis
- Our legitimate interest in providing a secure and available website (Article 6(1)(f) GDPR).
- Retention
- A limited period set by the hosting provider for the security of the service. We do not use this data for any other purpose.
Contact and Quotation Requests
- Data
- Surname, first name, company, position, email address, telephone, country and the content of your request (product, quantities, destination), sent by form, email or telephone.
- Purpose
- Answering your request and, where applicable, preparing an offer.
- Legal basis
- Pre-contractual steps taken at your request (Article 6(1)(b) GDPR); for other requests, our legitimate interest in answering the people who contact us (Article 6(1)(f)).
- Retention
- Three years from your last contact, then deletion. If a business relationship begins, the periods in the next section apply.
Business Relationships with Customers and Suppliers
- Data
- Business contact details of your staff, correspondence, offers, contracts, shipping documents and invoicing information.
- Purpose
- Performing contracts, organizing shipments and managing invoicing and payments.
- Legal basis
- Performance of the contract (Article 6(1)(b) GDPR) and compliance with our legal obligations, in particular accounting and tax obligations (Article 6(1)(c)).
- Retention
- Throughout the business relationship, then three years after it ends. Accounting and contractual records are kept for the periods required by applicable law, up to ten years.
Business-to-Business Prospecting
- Data
- Surname, first name, position, company, business email address and telephone.
- Source
- Publicly available sources (company websites, professional directories and networks) or direct exchanges with you.
- Purpose
- Presenting our offers relating to your professional activity.
- Legal basis
- Our legitimate interest in developing our business (Article 6(1)(f) GDPR). You may object at any time, without giving reasons, by following the instructions in each of our messages or by writing to contact@yotorltd.com.
- Retention
- Three years from collection or from your last contact. If you object, we keep only the information needed to respect your objection, for three years.
Defending Our Rights
- Data
- Only the data strictly necessary.
- Purpose
- Establishing, exercising or defending legal claims.
- Legal basis
- Our legitimate interest (Article 6(1)(f) GDPR).
- Retention
- The applicable limitation period.
Mandatory Information
When you contact us, the information marked as mandatory is needed to handle your request: without it, we cannot reply. All other information is optional.
Recipients
Your data is accessible only to:
- authorized YOTOR staff, within the limits of their duties;
- our business partners (producers, exporters, freight forwarders), where necessary to prepare or carry out a transaction concerning you, and only for the data relevant to that transaction;
- our technical service providers, acting on our instructions: Netlify, Inc. (website hosting and form reception) and Google (Google Workspace business email);
- administrative or judicial authorities, where required by law.
We do not sell or rent your data.
Transfers Outside the European Union
Our registered office is located in Mauritius and our partners work in particular in India. Our service providers Netlify and Google may process data in the United States. Your data may therefore be processed outside the European Union.
Where data is transferred from the European Union, it is protected by one of the mechanisms provided for by the GDPR: an adequacy decision of the European Commission, in particular the EU-U.S. Data Privacy Framework under which our certified service providers operate, or the standard contractual clauses adopted by the European Commission. Failing that, a transfer only takes place where it is necessary for the performance of a contract or of pre-contractual steps taken at your request (Article 49(1)(b) GDPR).
You may obtain a copy of the applicable safeguards by writing to contact@yotorltd.com.
Security
We implement appropriate technical and organizational measures to protect your data: encrypted connections to the website (HTTPS), access restricted to authorized persons only, and accounts protected by strong passwords and multi-factor authentication.
Your Rights
Under the GDPR and the French Data Protection Act, you have the following rights:
- right of access to your data (Article 15 GDPR);
- right to rectification of inaccurate or incomplete data (Article 16);
- right to erasure of your data (Article 17);
- right to restriction of processing (Article 18);
- right to portability of the data you have provided to us, where processing is based on a contract or on your consent (Article 20);
- right to object, at any time and without giving reasons for business prospecting (Article 21);
- right to set instructions regarding your data after your death (Article 85 of French Law No. 78-17 of 6 January 1978).
To exercise your rights, write to contact@yotorltd.com stating your request. We reply within one month, which may be extended by two months for complex requests; we will inform you if so. If we have reasonable doubts about your identity, we may ask you for proof.
If you believe your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or with the data protection authority of your country of residence.
You may also contact the Data Protection Office of Mauritius, 5th Floor, SICOM Tower, Wall Street, Ebene, Mauritius.
Automated Decision-Making
We do not make any decision based solely on automated processing, including profiling, that would produce legal effects concerning you.
Intended Audience
This website is intended for businesses. It is not directed at minors.
Changes to This Policy
We may amend this policy to reflect changes in our activities or in the regulations. The date of the last update is shown at the top of this page.