Privacy policy

Effective date: 13 August 2026

This Privacy Policy ( the “Policy”) details how OCSiAl International S.à.r.l. and its Affiliates (hereafter “we”, “our”, the “Company” or “us”) uses and protects Personal Data relating to identified or identifiable natural persons (hereafter “you”, “your” or the “Data Subject”).

This Policy applies to all information you provided us or that we collected during your interaction(s) with us on ocsial.com or tuball.com (the “Site ”).

1. Data Controller

OCSiAl International S.à.r.l., a company established and operating under the laws of the Grand Duchy of Luxembourg, registered with the Luxembourg Registre du Commerce et des Sociétés under number B246650, with its registered office at 1, rue de la Poudrerie.

For the purpose of this Policy, the Company acts as the Data controller on its behalf and on behalf of its Affiliates.

Affiliates means any other person which directly or indirectly controls, or is under common control with, or is controlled by, the Company. As used in this definition, “control” (including with its correlative meanings, “controlled by” and “under common control with”) means, with respect to the Company, the possession, directly or indirectly, of power to direct or cause the direction of management or policies (whether through ownership of securities or partnership or other ownership interests, by contract or otherwise) of a person; provided, however, that O2 Management S.A. shall not be deemed to be an Affiliate of the Company.

2. Types of Data Collected

We collect different types of information (“Data”) for various purposes (as set out below) to allow your use of the Site. We collect Data that allows us to identify the user (“Personal Data”) and to improve the quality of the Site based on your interactions with it (“Usage Data”).

The Personal Data that we collect or that you choose to provide us includes:

Identity Data: email address, first and last name, phone number, language and country from which you interact with us.
Electronic identification Data related to the device you use to access the Site: IP address, operating system, browser type and version, internet service provider, unique device identifier.
Data collected via cookies and trackers

For more information about Cookies and how we use them (including information about the types of cookies used), please, review our full Cookies Policy here.

When using forms such as “Contact us”, “Send us your CV”, “Get a quote” or any other form available on the Site, we will indicate the fields that are compulsory, since these are Data that we need to be able to provide the service you want. Please understand that, if you decide not to share such Data with us, you may be unable to complete the action.

The Usage Data that we collect includes, but is not limited to:

Frequently visited pages of the Site;
Time and date of your visit;
Time spent on the pages you visited;
Other diagnostic Data.

3. Purpose of Data processing and Legal Bases for processing

We may use the Data that you provided to us for the following purposes:

Analysis of usability and quality of the Site: we have a legitimate interest in analysing the Site’s usability and the user’s satisfaction degree. The processing of this Data is also beneficial for you, as the purpose is to improve the user experience and provide a higher quality of service and of the Site. Additional Data can be processed if you consent to it when participating in interactive features of the Site;
Development, performance and making of a purchase or request for a service quote/contract: if you request a quote or contract from our product page, we will process the Data to draft or perform the contract;
Support: we have a legitimate interest in answering your messages and/or requests made on our different contact forms. The processing of this Data is also beneficial to you as it allows us to assist you. We also consider that we have a legitimate interest in using the contact information you provided us with to email you and/or call you. When your request is related to the exercise of your rights (see Section 6), we are legally allowed to process your Data to comply with our legal obligations;
Feedback forms: we will process your Data if you choose to answer to one of our feedback forms. We have a legitimate interest in processing this Data to improve the Site and our products. The processing of this Data is also beneficial to you as it allows us to improve the quality of the services and products we offer to you;
Marketing: we are legally permitted to process your Data for marketing purposes based on the consent that you give us. For example, when you subscribe to our newsletter or when you consent through the cookies;
Fraud: we have a legitimate interest in carrying out the necessary checks to detect and prevent potential fraud or wrongdoing in connection with the Site.

4. Data retention

Analysis of usability and quality of the Site & feedback forms: we will process your Data occasionally for the time during which we proceed to carry out a specific quality action or survey or until we anonymize your browsing Data;
Development, performance and making of the purchase or service quote/contract: we will process your Data for the time necessary for the performance of the contract;
Support: we will process your Data for the time necessary to meet your request or application, as well as for the time established in the regulations that may apply in each case.
Marketing: we will process your Data until you unsubscribe from our newsletter or change your device, browser and/or cookies settings revoking our permission to do so.

Your Data will be retained for the period necessary to fulfil the purposes of processing, as required by applicable law, including to address potential legal claims, and to resolve ongoing disputes or regulatory obligations. Once any potential legal claims are time-barred, we will delete your Personal Data.

5. Recipients

The Company may disclose and transfer your Data to the following categories of recipients:

subcontractors, business partners;
professional advisors (e.g. auditors, lawyers);
other companies of the OCSiAl Group (Affiliates of the Company);
supervisory bodies or public authorities.

By agreeing to this Policy, you provide us with an unconditional and unequivocal consent to any possible disclosure and transfer of your Data to the recipients as described above and such consent shall be deemed sufficient for the purpose of our compliance with General Data Protection Regulation of the European Union (if applicable to you).

6. Transfer of Data Outside the European Union

For service efficiency purposes, some of your Data, including Personal Data, may be transferred to, maintained and processed on computers located outside of your country or other governmental jurisdiction where the Data protection laws may differ from those in your jurisdiction, including situations when the Data processing may occur out of a territory of a Member State of the European Union (the “EU”) or another signatory state to the European Economic Area Treaty (the “EEA”) if applicable to you.

When transferring your Data internationally, we implement adequate safeguards to ensure your Data remains secure, relying on recognized mechanisms such as the EU’s Standard Contractual Clauses (SCCs) and any necessary supplementary measures required by applicable data protection regulations. For your reference, the full text of the SCCs is available at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en .

If you are using tuball.cn (or any other .cn website), your Personal Data will be stored on servers located in China and in accordance with P.R.C. law.

7. Your Rights in Connection with the Data

To the extent permitted by the applicable laws, you, as the Data Subject, are entitled to:

Request access to the Data that we have on you;
Request to rectify (correct) any inaccurate Data that we have. You also have the right to ask us to complete the information you believe is incomplete. When you voluntarily share your Personal Data with us via any method, you confirm its accuracy and truthfulness and agree to promptly inform us of any updates or changes. You are solely responsible for any harm, loss, or damage arising from incomplete, inaccurate, or false information provided in the forms available on the Site. Please note that, unless explicitly permitted under this Privacy Policy, you must only submit your own Personal Data, not the Personal Data of any third party;
Request to erase your Personal Data if it is no longer needed for any of the purposes set out above or when we are no longer legally authorized to process and use it;
Request to restrict the processing of your Personal Data. This includes the ability to temporarily suspend the processing in specific situations or ask that we retain the Data for a longer period if you require it for a valid reason;
Object to the processing of your Personal Data.

You may revoke your consent to process your Data at any time. If processing is based on consent or required to fulfil a contract (as set out in Section 3), you also retain the right to request Data portability. This allows you to receive your Personal Data in a structured, widely recognized, and machine-readable format, enabling seamless transfer to another organization without obstruction from our side.

To exercise your rights specified above, you shall send us a request by registered mail or by email at:

Data Protection Manager
1, rue de la Poudrerie,
L-3364 Leudelange
DPM@ocsial.com

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We will then have one calendar month starting from the day we received the request to respond. Occasionally it could take us longer than a month if your request is particularly complex or you have made several requests. In this case, we will notify you and keep you updated.

Additionally, you may file a claim before the responsible data protection regulatory authority. In Luxembourg, you can contact the National Commission for Data Protection.

Commission Nationale de Protection des Données
Service des réclamations
15, Boulevard du Jazz, L-4370 Belvaux
Tel.: (+352) 26 10 60 -1

8. Security of Data

We securely store your Data on a company-managed virtual server in the European Union, hosted by Microsoft Azure (https://azure.microsoft.com/en-us/support/legal/). In addition, we limit access to your Personal Data to employees, agents, contractors and other third parties who have business need to know. They will only process your Personal Data on our instructions, and they are subject to a duty of confidentiality.

While we shall use commercially acceptable means to protect your Data, we cannot guarantee its absolute security, since no method of transmission over the Internet or method of electronic storage is 100% secure.

The Company will take steps reasonably necessary to ensure that your Data is treated securely and in accordance with this Policy, and no transfer of your Data will take place to an organization or a country unless there are adequate controls in place ensuring the security of your Data.

9. Links to Third-Parties Sites

Our Site may contain links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

10. Children’s Privacy

Our Site does not address anyone under the age of 18 ("Children" or “Child”).

We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your Child has provided us with Data, please contact us. If we become aware that we have collected Data from Children without verification of parental consent, we will immediately remove that information from our servers.

11. Changes to the Privacy Policy

We may update our Policy whenever we consider it appropriate. If significant changes occur, we will notify you on the Site (for example banners and pop-ups) or through an email alert. We recommend that you periodically check this Policy for any adjustments, as it is always accessible on the Site. Changes to this Policy become effective immediately upon their posting on the Site.

12. Contact Us

If you have any question regarding this Policy or identify any misuse of your Data and/or any violation in respect of the Data provided to us, please contact us:

By email: DPM@ocsial.com
Address: 1, rue de la Poudrerie, L-3364 Leudelange, Luxembourg

13. Availability of this Privacy Policy in Other Languages

This Privacy Policy is also available in other languages. In the event of any conflict between the English version and any translations of this Privacy Policy, the English version shall prevail.