Privacy Policy

1. Who We Are

Moon Plast ("we", "us", "our") is a plastic products manufacturer registered and operating in the Democratic Republic of Congo (DRC).

• Trading name: Moon Plast
• Country of establishment: Democratic Republic of Congo
• Phone: +243 9129 82119
• Privacy contact: privacy@moonplastdrc.com

This Privacy Policy applies to personal data collected through our website (the "Site") and describes how we handle your data in compliance with:

• The DRC Digital Code (Loi n° 23/010 du 13 mars 2023) and its data governance provisions
• The DRC Constitution, Article 32 (right to privacy)
• The African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention)
• The EU General Data Protection Regulation (GDPR — Regulation 2016/679), where applicable to visitors from the European Economic Area
• OHADA Uniform Act obligations applicable to our commercial operations

2. Data We Collect

We collect only the data you voluntarily provide through our contact form:

We do not collect any special categories of personal data (health, biometric, political opinions, religion, etc.), payment card data, or data from minors under 16.

We also collect standard server logs (IP address, browser type, pages visited, timestamps) automatically via our hosting infrastructure solely for security and performance monitoring. These logs are not linked to identifiable individuals for marketing purposes.

3. Legal Basis for Processing (GDPR)

For visitors from the EEA, our processing is based on the following lawful grounds under GDPR Article 6:

• Article 6(1)(b) — Contract / pre-contractual steps: processing your contact form data to respond to product or partnership inquiries.
• Article 6(1)(f) — Legitimate interests: server log retention for security and fraud prevention. Our legitimate interest does not override your rights because logs are not used for profiling or marketing.

4. How We Use Your Data

• Respond to your inquiry, order request, or partnership question
• Follow up on ongoing business discussions you initiate
• Maintain records of business correspondence as required by OHADA commercial law
• Detect and prevent fraudulent or abusive use of the Site

We do not use your data for automated profiling, behavioural advertising, or sale to third parties.

5. Data Sharing and International Transfers

Your data is shared only as follows:

• Email delivery (SMTP): Contact form submissions are delivered via an SMTP provider (Google Gmail). Google may process data on servers located outside the DRC, including in the EU and USA. Google applies Standard Contractual Clauses and other GDPR-compliant safeguards for international transfers.
• Hosting infrastructure: Our website is hosted on cloud infrastructure that may process server log data in multiple jurisdictions.

We do not sell, rent, or otherwise disclose your personal data to unrelated third parties, advertisers, or data brokers.

6. Data Retention

• Contact form submissions: retained in our email inbox for up to 3 years from the date of last contact, in accordance with OHADA commercial correspondence requirements, then deleted.
• Server logs: retained for a maximum of 90 days for security monitoring, then automatically purged.

7. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — request deletion of your data (subject to our legal retention obligations)
• Right to restriction — ask us to limit processing while you contest accuracy or our legal basis
• Right to data portability — receive your data in a structured, machine-readable format (EEA residents)
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where we rely on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, email privacy@moonplastdrc.com with your name and a description of your request. We will respond within 30 days. We may ask you to verify your identity before processing your request.

EEA residents have the right to lodge a complaint with their local data protection authority if they believe we have processed their data unlawfully.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction, consistent with the security requirements of DRC Digital Code Loi n° 23/010 and GDPR Article 32. These measures include:

• HTTPS/TLS encryption for all data in transit
• Restricted access to contact form submissions (accessible only by authorised personnel)
• Regular review of our security practices

In the event of a personal data breach that poses a risk to your rights, we will notify the relevant authorities and affected individuals in accordance with applicable law.

9. Cookies

We use only strictly necessary cookies required for the website to function. We do not use analytics, advertising, or tracking cookies. See our Cookie Policy for full details.

10. Children

Our Site is directed at businesses and adults. We do not knowingly collect personal data from children under the age of 16. If you believe a child has submitted data through our Site, please contact us immediately at privacy@moonplastdrc.com.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in law or our practices. The "Last updated" date at the top of this page will always show when it was last revised. For material changes, we will post a notice on the Site. Your continued use of the Site after changes are posted constitutes acceptance of the revised policy.

12. Contact Us

For any questions or requests relating to this Privacy Policy or your personal data, contact us at: