GDPR & Data Protection
Last updated: August 14, 2026
At OS Tools, we take data privacy seriously. While we are based in Hong Kong, we are committed to honouring the spirit and principles of the General Data Protection Regulation (GDPR) for all users, including those in the European Economic Area (EEA) and the United Kingdom. This page explains how we handle your data, the protections we have in place, and how you can exercise your rights.
Our Role as a Data Processor
OS Tools operates primarily as a data processor. When you upload email lists or other data to use our tools, we process that data strictly to perform the service you have requested — nothing more. We do not retain, sell, or share your uploaded data with third parties, and we do not use it for any purpose beyond completing your job.
We adhere to the GDPR principles of data minimisation, purpose limitation, and storage limitation. Uploaded data is deleted or anonymised once your job is complete and results are made available.
How We Handle Your Data Securely
Encryption in Transit & at Rest
All data is transmitted over TLS-encrypted connections and stored with AES-256 encryption.
Strict Access Control
Only authorised systems have access to your data. No staff member can view your uploaded email lists — only aggregated results.
Automatic Data Deletion
Uploaded lists are deleted from our servers once processing is complete. We do not retain customer data beyond what is necessary.
Incident Response
We maintain an incident response plan. In the event of a data breach, affected users will be notified promptly.
Data Storage Location
Our platform is hosted and data is processed in Hong Kong. If you are located in the EEA or UK, please be aware that your data may be transferred to and processed in Hong Kong, which is outside the EEA. We apply appropriate safeguards to ensure your data is handled in accordance with GDPR-equivalent protections, including contractual commitments with our infrastructure providers.
Your Rights Under GDPR
If you are located in the EEA or UK, you have the following rights regarding your personal data:
Right to Access
You can request a copy of the personal data we hold about you.
Right to Rectification
If your data is inaccurate or incomplete, you can ask us to correct it.
Right to Erasure (Right to be Forgotten)
You can request deletion of your personal data when it is no longer necessary for the purpose for which it was collected.
Right to Data Portability
You can request a copy of your data in a structured, machine-readable format.
Right to Object to Processing
You have the right to object to certain types of data processing under specific conditions.
Right to Restriction
You can request that we limit the processing of your data in certain circumstances.
Most rights can be exercised yourself in seconds: sign in and go to Account → Privacy to download a JSON copy of your data, withdraw cookie consent, or permanently delete your account. For any other request, email help.organicsupremacy@gmail.com. We respond to verified requests within one month.
Lawful Basis for Processing
We process your personal data on the following legal bases:
- Contract performance — to provide you with the Services you have signed up for.
- Legitimate interests — to improve our platform, detect fraud, and ensure security.
- Legal obligation — to comply with applicable laws and regulations.
- Consent — where you have opted in to specific communications (e.g., marketing emails).
Data Retention
- Uploaded data (e.g. email lists): Deleted immediately after job completion and results are delivered.
- Account data: Retained while your account is active; deleted or anonymised within 24 months of account closure.
- Transaction records: Retained as required by applicable financial regulations.
- Log and security data: Retained for up to 12 months.
Right to Lodge a Complaint
If you believe we have not handled your data in accordance with applicable law, you have the right to lodge a complaint with your local data protection authority. For EEA residents, this is the supervisory authority in your country of residence. For UK residents, this is the Information Commissioner's Office (ICO) at ico.org.uk.
Contact Us
For any data protection or GDPR-related inquiries, please reach out to us:
OS Tools