Privacy policy

1. Who we are

Billionesia LLC (“Billionesia”, “we” or “us”) is the company responsible for your personal data under this policy. Many privacy laws call this the “controller”. We sell brands’ products on marketplaces around the world as their authorized reseller.

The quickest way to reach us about privacy is the privacy requests form. You can also write to the Privacy Officer at the address above. We are a small company and don’t have a statutory data protection officer. Our Privacy Officer handles every privacy question, request and complaint.

2. Who this policy covers

• Visitors to billionesia.com
• People who contact us through a form, by email or by phone
• People at brands, suppliers and partners we work with or talk to about working together
• Shoppers who buy a product we sell on a marketplace

It doesn’t cover how marketplaces, carriers or other companies handle data for their own purposes. They have their own privacy policies. A marketplace that shows our listing is responsible for what it collects on its own site.

If you bought from a marketplace, we received your details from it rather than from you. This policy explains what we do with them.

3. What we collect

What we keep from your visit

Every website receives your IP address and browser details, because it can’t send you a page without them. We don’t keep a record of who visited or what they read. There are only two exceptions:

• Stopping abuse. When you send a form, your IP address is scrambled and held in memory for one hour to limit repeated messages. It is never saved with your message.
• Faults. If a request fails with a server error, the server’s error log can record the IP address, browser, address requested and time. We use this only to fix faults and deal with attacks.

What we don’t want

Please don’t send us sensitive data through the forms. That includes health details, government ID numbers, passwords, or payment card details. We don’t knowingly collect it, and if we find it, we delete it.

4. How we use it, and our legal reasons

Privacy laws such as the GDPR require a legal reason for each use. These are ours:

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see your rights).

What we don’t do

• We don’t sell personal data, rent it out, or share it for advertising.
• We don’t build profiles of you or make decisions about you by automated means alone.
• We don’t add you to a mailing list because you wrote to us. If we ever offer one, we will ask first, and you can leave at any time.

Do you have to give us your details?

You can read the whole site without giving us anything. If you write to us, we need the fields marked as required in order to reply. If we work together, we need certain details to run the agreement and meet legal duties.

5. How long we keep it

We may keep something longer if the law requires it, or if it is needed for a dispute or investigation that is under way. If an enquiry becomes a working relationship, the details move into our business records.

6. Who can see it

Inside Billionesia, only people who need your details for the purposes above can see them, including contractors and companies under common ownership who help us run the business. They must keep your details confidential.

Companies that provide services to us

Others we share with, only when needed

• To complete orders: marketplaces, carriers, warehouses, and customs and tax agents
• To run our business: accountants, lawyers and other professional advisers, who must keep it confidential
• When the law requires it: courts, regulators, tax authorities and police, when we receive a valid legal demand or must protect people’s rights and safety
• If the business changes hands: a buyer or successor in a merger, sale or reorganization, who must keep treating your data in line with this policy. We will tell you if this changes how your data is handled

7. Where your data goes

We work across borders, so your data may be handled outside your country:

• Our server is in Bangalore, India, in a DigitalOcean data center. Form messages are stored there.
• We are a US company, so your details may be read and used in the United States.
• People who work with us may read messages from other countries, including India.
• Orders go wherever they need to in order to reach the shopper.

The privacy laws in these countries may differ from yours, and government access rules differ too. This policy applies wherever your data is.

If you are in the EU, the UK or Switzerland

• When you write to us, you send your details directly to a company outside your country.
• We then store them with our hosting provider, DigitalOcean, LLC, a US company, on a server in India. The European Commission hasn’t issued an adequacy decision for India. Billionesia itself isn’t certified under the EU-US Data Privacy Framework.
• For hosting, we rely on the safeguards in DigitalOcean’s Data Processing Agreement: its certification under the Data Privacy Framework and the UK and Swiss extensions, with the European Commission’s Standard Contractual Clauses (GDPR Article 46) and the UK Addendum as a fallback.
• As an extra protection, saved form messages are encrypted and the server doesn’t hold the key, so the hosting provider can’t read them.

You can read that agreement at the link above, or ask us for a copy and more detail through the privacy requests form.

8. How we protect it

• Secure connections on every page, with browsers told to use nothing else
• Form messages encrypted as they arrive, with the key kept off the server
• The site runs sealed off in its own container with no network access, on a server with a firewall and key-only administrator access
• Access limited to the people who need it, and automatic deletion on the schedule above

Our security page has the full detail. No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant regulators as the law requires.

9. Your rights

We give these rights to everyone, wherever you live, even if the law where you are doesn’t require it. There are some legal limits. For example, we may have to keep tax records.

How to use them

• Use the privacy requests form, or write to Billionesia LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA.
• It’s free. We may charge a reasonable fee or decline only if a request is clearly unfounded or excessive, where the law allows it.
• We check it’s you. We usually reply to the email address on the request. We ask only for what we need to confirm who you are, and we use it only for that.
• Someone can act for you. An authorized agent or representative can ask for you, with proof they are allowed to.
• Timing. We aim to reply within 30 days. If a request is complex, we will tell you why and may take longer where the law allows.
• Complaints. Choose “Make a complaint” on the same form. We will acknowledge it within 30 days and tell you the outcome.
• If you disagree. You can appeal by using the same form and choosing “Appeal a decision”. A different person will look at it wherever we can arrange that, and we aim to reply within 45 days. If you are still unhappy, you can go to your regulator.

10. More for your region

European Economic Area, United Kingdom and Switzerland

This policy gives the information the GDPR and UK GDPR require. Sections 4 and 7 cover legal reasons and transfers. If you are in the UK, you have the right to complain to us as well as to the Information Commissioner’s Office. Choose “Make a complaint” on the privacy requests form. We will acknowledge it within 30 days, look into it, keep you updated, and tell you the outcome without undue delay.

California

We may be below the size at which the California Consumer Privacy Act applies, but we follow its notice and rights voluntarily. In the last 12 months we have collected these categories, for the purposes in section 4:

We don’t collect sensitive personal information on purpose, and we don’t sell or share personal information, including that of people under 16. Section 5 gives how long we keep each type. You can ask to know, delete and correct, and you won’t be treated worse for doing so. California residents can also ask for details of disclosures for direct marketing under the “Shine the Light” law, and we make none.

Other US states

Depending on where you live, state laws may give you rights to access, correct and delete your data, to get a copy, and to opt out of sale, targeted advertising and certain profiling. We don’t sell personal data or use it for targeted advertising or profiling, so there is nothing to opt out of. You can appeal any decision as described in section 9. Nevada residents: we don’t sell covered information.

Do Not Track and Global Privacy Control

We don’t track visitors over time or across other sites, and we don’t let anyone else do so through this site, so there is nothing for these signals to switch off. If that ever changes, we will treat a Global Privacy Control signal as a valid opt-out.

Canada, Australia and New Zealand

You can access and correct your personal information and complain to us or your regulator. Your details are likely to be disclosed to or handled in the United States and India, where recipients may not be bound by the same local rules. Our Privacy Officer is the person accountable for privacy at Billionesia.

India

Our server is in India. You can ask to access, correct or erase your personal data, name someone to act for you if you can’t, and raise a grievance with our Privacy Officer using the privacy requests form. You can also take a complaint to the Data Protection Board of India.

Brazil

You have the rights in section 9 under the LGPD, including confirmation of processing, anonymization, and information about who we share with. The privacy requests form is your channel to the person responsible for privacy at Billionesia.

South Africa, Singapore and Japan

You can reach our Privacy Officer through the privacy requests form or at our address. In South Africa, companies have privacy rights too, so a business can use this form as well. You can also go to your regulator, listed below.

United Arab Emirates and Saudi Arabia

You can use the rights in section 9 through the privacy requests form. The regulators are the UAE Data Office and the Saudi Data and AI Authority.

Elsewhere

The rights in section 9 apply wherever you are. If the law where you live gives you more, we will honor it. Tell us where you live when you write, so we can apply the right rules.

Your regulator

11. Cookies and tracking

This site sets no cookies and uses no analytics or tracking. If you close the notice bar, your browser remembers that until you close the tab, and nothing else is stored. Our cookie notice has the detail.

12. Children

This site is for businesses and isn’t meant for anyone under 18. We don’t knowingly collect children’s personal data from this site. If you think a child has sent us their details, please tell us and we will delete them. A shopper’s order may be placed for a child, but we don’t ask about or record that.

13. Links to other sites

Our pages link to government, marketplace and news sites as sources. When you follow a link, that site’s own privacy policy applies. We tell browsers not to pass on which of our pages you came from.

14. Changes to this policy

We review this policy at least once a year and whenever how we handle data changes. The date at the top shows the latest version. If a change matters to people whose details we hold, we will tell them directly where we can. You can ask for an earlier version through the privacy requests form.

15. Questions and complaints

Please come to us first, and we will try to put it right. Use the privacy requests form or write to the Privacy Officer, Billionesia LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA. You always have the right to complain to your regulator, and section 10 lists them.