Last updated 1 November 2026
Privacy policy
Who we are, what we collect when you send an enquiry, how long we keep it, and how to have it deleted. Written to be read, not to be survived.
1. Who is responsible for your data
This website is operated by Yangzhou Viorna International Trading Co., Ltd. (扬州维奥娜国际贸易有限公司), trading as Gymmill. We are a manufacturer and exporter of gym accessories based in Yangzhou, Jiangsu, China. We are the data controller for the information described below.
| Item | Detail |
|---|---|
| Data controller | Yangzhou Viorna International Trading Co., Ltd. (扬州维奥娜国际贸易有限公司) |
| Registered / trading address | Jiangdu District, Yangzhou, Jiangsu, China, China |
| Contact for privacy matters | Jeffrey@gymmill.com |
| Data Protection Officer | Not appointed — we are below the threshold in Art. 37 GDPR. Privacy questions go to the address above and are answered within 30 days. |
| Supervisory authority | You may complain to the data protection authority of your own EU member state. We would rather you told us first. |
| Last updated | 1 November 2026 |
2. What we collect, and why
We collect as little as we can get away with. There is no newsletter, no account, no tracking pixel, and no advertising on this site.
When you send an enquiry or ask for a sample
You give us your name, email address, company, country, the message you write, and any artwork or reference photo you attach. We use it for one thing: to prepare your mock-up, quote or sample, and to answer you. We do not add you to a mailing list, and we do not pass your details to another supplier.
Attachments are stored with the enquiry. If your artwork contains a trademark you do not own, you are responsible for that — we ask for written confirmation before production.
When you browse
Our server records the IP address, browser, page requested and time of each request, and deletes those logs after 30 days. This is standard web hosting security, not profiling.
When you contact us on WhatsApp
The green button opens a chat in WhatsApp, operated by Meta. Nothing is sent to us until you press send. Once you do, the conversation is governed by WhatsApp's own privacy policy as well as this one.
Analytics — only if you agree
We would like to know which pages buyers actually read, so we can write better ones. Google Analytics 4 sets cookies and is not loaded at all unless you press “Allow analytics” on the banner. If you press “Essential only”, or simply ignore the banner, no analytics cookie is written and no request reaches Google from your browser.
3. How long we keep it
| What we hold | Details | Kept for | Legal basis |
|---|---|---|---|
| Enquiry form submission | Name, email, company, country, message, attached artwork | 24 months | Pre-contractual steps at your request — Art. 6(1)(b) |
| Sample and quote records | What we quoted, at what MOQ, to whom | 24 months after the last order | Contract performance — Art. 6(1)(b) |
| Invoices and shipping documents | Order value, address, VAT/EORI where given | 7 years | Legal obligation to keep accounting records |
| Server access logs | IP address, browser, page requested, timestamp | 30 days | Legitimate interest in security and uptime — Art. 6(1)(f) |
| Analytics (Google Analytics 4) | Pages read, approximate location, device | 14 months | Consent — Art. 6(1)(a). Loaded only if you press Allow |
4. Who we share it with
We do not sell data, and we do not share it with anyone for marketing. The following service providers process it on our behalf:
| Who | What they do for us | Where | Transfer safeguard |
|---|---|---|---|
| FormSubmit | Delivers the enquiry form to our mailbox | United States | Standard contractual clauses |
| Hostinger | Hosts this website and our email | European Union / Lithuania | Within the EU |
| Google Ireland Ltd | Google Analytics 4 — only after you press Allow | EU / United States | Standard contractual clauses |
| Meta Platforms (WhatsApp) | Only if you choose to message us there | EU / United States | Standard contractual clauses |
Where data leaves the EU/EEA, the transfer relies on the European Commission's Standard Contractual Clauses. We will send you the details of the relevant safeguard if you ask.
5. Cookies
This site sets no cookies at all until you press “Allow analytics”. Your cookie choice itself is stored in your browser's local storage (not a cookie, and not sent to us) so the banner does not reappear on every page.
After consent, Google Analytics 4 sets _ga and _ga_<id>, both expiring after 14 months. We have enabled IP anonymisation. You can withdraw consent at any time by clearing this site's data in your browser — the banner will return and analytics will stop.
6. Your rights
Under the GDPR you can ask us to:
- Give you a copy of everything we hold about you (Art. 15)
- Correct anything wrong (Art. 16)
- Delete it — we will, unless we are required to keep an invoice for tax purposes (Art. 17)
- Restrict what we do with it while a question is open (Art. 18)
- Hand it over in a machine-readable file (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent for analytics at any time (Art. 7(3))
Write to Jeffrey@gymmill.com and we will answer within 30 days. We will not charge you, and exercising a right will never affect how we quote or how fast we reply.
7. What we do not do
- No advertising or retargeting pixels
- No selling or renting contact data
- No automated decision-making or profiling that affects you
- No marketing emails unless you ask us to send them
- No collection of data from anyone under 16 — this is a business-to-business site
8. Changes
If we change how we handle data, we will update this page and change the date at the top. Material changes affecting existing enquiries will be emailed to the address you gave us.
9. Questions
Email Jeffrey@gymmill.com or message us on WhatsApp. A real person answers, usually within 12 working hours, Monday to Saturday, GMT+8.
Still have a question about your data?
Ask before you send anything. We would rather answer a privacy question than lose an order over it.