Gavilion Privacy Policy
Last updated: [9th October 2026]
1. Introduction
Gavilion respects your privacy. Gavilion is operated by Twin Hydraulics Engineering Sdn Bhd ("Gavilion", "we", "us", or "our"). We are committed to handling your personal information fairly, transparently, and responsibly, wherever you are located.
This Privacy Policy explains:
- what personal information we collect and why;
- how we use, disclose, store, and protect it;
- your choices and rights regarding your information; and
- how to contact us or raise a concern.
2. Personal Information We Collect
The information we collect depends on how you interact with us.
(a) Information you provide
- Account information: name, email address, phone number, company name, job title or position, and login credentials.
- Transaction and billing information: billing and delivery addresses, purchase history, order details, and payment-related information. Payments are processed by our payment provider, Airwallex, which handles payment details under its own privacy policy (https://www.airwallex.com/terms/privacy-policy). We do not store full payment card numbers.
- Warranty and product information: product serial numbers, purchase details, warranty registrations, claims, and installation or support records.
- Communications: enquiries, support requests, feedback, complaints, and other correspondence.
- Surveys and feedback: responses to questionnaires, surveys, and feedback activities.
- In-person interactions: information collected by our sales representatives at trade counters, trade shows, customer sites, or business events.
(b) Information from third parties
- Business information providers, which may supply details about your role and the organisation you represent.
- Authorised dealers, distributors, or partners, where they supply information about a customer or a warranty claim.
(c) Information collected automatically
- Technical and usage data: browser type, device type, operating system, pages visited, and referring website.
- Security data: information processed by fraud-prevention and bot-detection services, including Google reCAPTCHA. Google may process IP addresses and device information for this purpose under its own privacy terms (see Section 8 and Appendix I: Cookie Policy).
- Cookies and similar technologies: described in Section 8 and Appendix I: Cookie Policy.
We do not use cookies to store shopping cart contents. Cart details are stored securely in our database and linked to your account.
Mandatory and optional information. Some information is required to create an account, process orders, deliver products, provide warranty services, or meet legal obligations. Where information is mandatory, we will indicate this when we collect it. If you do not provide mandatory information, we may be unable to provide the relevant service. Other information is optional.
Data minimisation. We collect only the personal information that is reasonably necessary for the purposes described in this policy.
3. How We Use Personal Information
We use personal information for the purposes below and on the legal bases listed. Where a law requires a particular basis, we rely on that basis.
Purpose |
Examples of information used |
Legal basis (where applicable) |
|
Creating and managing your account |
Contact, company, and account details |
Performance of a contract; legitimate interests |
|
Processing and fulfilling orders |
Contact, delivery, billing, and transaction details |
Performance of a contract |
|
Responding to enquiries and support requests |
Contact details, support history |
Legitimate interests (customer service); performance of a contract |
|
Registering products and handling warranty claims |
Contact, product, and warranty records |
Performance of a contract; legal obligation |
|
Sending service messages about orders, products, or accounts |
Contact and account details |
Performance of a contract; legitimate interests |
|
Surveys and feedback |
Contact details, responses |
Consent where required; otherwise legitimate interests |
|
Marketing communications |
Contact details, company information, marketing preferences |
Consent where required; otherwise legitimate interests, with an opt-out |
|
Fraud prevention, security, and abuse detection |
Account, transaction, and security records |
Legitimate interests; legal obligation |
|
Improving our website, products, and services |
Usage and technical data (aggregated where possible) |
Legitimate interests |
|
Complying with legal, tax, accounting, and regulatory obligations |
Transaction and billing records |
Legal obligation |
We use personal information only for the purposes for which it was collected, for closely related purposes you would reasonably expect, or as permitted or required by law. If we need to use information for a new purpose, we will tell you and, where required, seek your consent first.
4. Automated Decision-Making
We do not make decisions that have legal or similarly significant effects on you solely through automated processing. Automated fraud-prevention checks may limit or flag a transaction, and a person reviews these where required by law. You may ask for a human review of any such decision.
5. Sharing Personal Information
We do not sell personal information. We may disclose it only in the following circumstances:
- Service providers and contractors: hosting, payment processing (including Airwallex), shipping and logistics, IT and security, customer support tools, and professional advisers. They must use the information only on our instructions.
- Independent recipients: Third-party suppliers that provide product information, catalogue data, pricing, availability, or related services may receive relevant product access records in connection with the services described in Section 13(c). Such suppliers act as independent recipients and handle personal information in accordance with their own privacy notices and applicable terms.
- Authorised dealers, distributors, and retailers: where needed to fulfil an order, provide a product, or handle a warranty or support request.
- Business transfers: in connection with a merger, acquisition, restructuring, or sale of assets, subject to appropriate protections.
- Legal and protective purposes: where required or authorised by law, to respond to lawful requests, to enforce our terms, or to protect the rights, property, or safety of Gavilion, our customers, or others.
- With your consent: where you have asked us to share information or have otherwise agreed.
6. International Transfers
Gavilion operates internationally, and personal information may be stored, processed, or accessed in locations where Gavilion, its affiliates, or service providers operate.
Where we transfer personal information across borders, we take steps required by applicable law. These may include:
- transferring to countries recognised as providing adequate protection;
- using standard contractual clauses or equivalent contractual safeguards; or
- other lawful transfer mechanisms.
A current list of the countries where personal information is regularly disclosed is available on request at general@gaviliongroup.com.
7. Marketing Communications
We send marketing communications about our products, services, promotions, and events only where permitted by law. Where consent is required, we ask for it. You can opt out at any time by:
- updating your preferences in the "My Profile" section of your My Account page;
- using the unsubscribe link in any marketing email; or
- contacting us at general@gaviliongroup.com.
We may still send non-marketing service messages, such as order confirmations, warranty notices, and important account or safety information.
We may use aggregated or de-identified information for business, statistical, and reporting purposes. Such information does not identify you. We will not identify you in any published or shared material without your permission, unless required or permitted by law.
8. Cookies and Similar Technologies
We use cookies and similar technologies only for essential website functions and security. These include maintaining your login session and protecting the website from spam and automated abuse through Google reCAPTCHA.
We do not currently use cookies for advertising, marketing, behavioural profiling, or third-party analytics. If we introduce any non-essential cookies in the future, we will update this policy and obtain consent where required by law.
Full details, including how to manage cookies in your browser, are in Appendix I: Cookie Policy.
9. Security
We take reasonable technical and organisational measures to protect personal information against loss, misuse, interference, unauthorised access, modification, and disclosure. These include:
- encryption in transit and, where applicable, at rest;
- password protection and access controls for electronic records;
- staff training and confidentiality obligations;
- secure storage and restricted physical access for paper records; and
- regular reviews of our security practices.
Your Gavilion account is protected by your username and password. Please keep your credentials confidential.
No method of transmission or storage is completely secure. If we become aware of a data breach affecting personal information, we will assess it, take steps to contain and remediate it, and notify affected individuals and regulators where required by applicable law.
10. Data Retention
We keep personal information only as long as necessary for the purposes described in this policy, or as required by law. Retention periods depend on the type of information and the purpose for which it is held. When information is no longer required, we securely delete or de-identify it.
11. Your Rights and Choices
Depending on where you live, you may have some or all of the following rights. We apply these rights to all users, wherever they are located, where practical.
- Access: to know whether we hold personal information about you and to receive a copy.
- Correction: to have inaccurate, incomplete, out-of-date, or misleading information corrected.
- Update: you can view and update much of your information at any time in the "My Profile" section of your My Account page.
- Deletion: to request deletion of your personal information, subject to legal and business retention requirements.
- Portability: to receive your information in a structured, commonly used, machine-readable format, where applicable.
- Objection and restriction: to object to certain processing, including direct marketing, or to request restriction of processing.
- Withdrawal of consent: where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before it was withdrawn, and may limit some services.
- Automated decisions: to request human review of certain automated decisions (see Section 4).
- Non-discrimination: we will not treat you differently for exercising your privacy rights.
How to exercise your rights. Contact us at general@gaviliongroup.com or through the privacy contact details in Section 2. We may need to verify your identity before responding. We aim to respond within [TIMEFRAME, e.g. 30 days], or within any shorter period required by law. Where we cannot fulfil a request, we will tell you why, where the law requires it.
Regional rights. Additional rights may apply under laws such as the EU and UK GDPR, the California Consumer Privacy Act (as amended), Canada's PIPEDA, Singapore's PDPA, Malaysia's PDPA, Brazil's LGPD, and Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. Where a regional law provides rights not listed above, we will honour them. [OPTIONAL: Insert region-specific supplements if you need them, e.g. for California residents.]
12. Children's Privacy
Our Services are intended for business customers and are not directed at children. We do not knowingly collect personal information from anyone under [16 / 18, depending on jurisdiction]. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.
13. API Privacy
This section applies where you or your systems access Gavilion through an application programming interface (API), webhook, or integration provided by Gavilion ("API Services").
(a) Information processed through the API
- Account identifiers, company details, and contact information associated with the API client or user.
- Order, delivery, billing, product, and warranty data that you send to or request from the API.
- Technical logs, including request times, endpoints called, IP address, and response status, used for security, troubleshooting, performance, and abuse detection.
We limit API processing to the data needed for the endpoint being used.
(b) Airwallex integration
Where Gavilion's systems connect to the Airwallex API, we exchange payment and transaction data with Airwallex, such as order references, payment amounts and currency, payer and payee names and contact details, and payment status. Airwallex processes this data under its own privacy policy (https://www.airwallex.com/terms/privacy-policy). We use it only to take and reconcile payments and to meet our financial record-keeping obligations.
(c) Product Access Data
Gavilion may share records of product access and usage with relevant suppliers, manufacturers, or service providers for analytics, product management, service improvement, and related business purposes. These records indicate which products have been accessed by customers and do not include customer names, contact details, customer account identifiers, or other information that directly identifies an individual customer. Any recipient of such information processes it in accordance with its own privacy practices and applicable legal obligations.
14. Third-Party Links and Services
Our Services may link to third-party websites or services that we do not control. Their privacy practices are governed by their own policies, and we are not responsible for them. Please review those policies before providing personal information.
15. Making a Privacy Complaint
If you have any questions about this Privacy Notice or how we collect, use, disclose, or otherwise process your personal data, please email us at general@gaviliongroup.com.
If you believe that we have not complied with applicable data protection or privacy laws, or if you have concerns about how we have handled your personal data that we have been unable to resolve, you may have the right to lodge a complaint with the relevant data protection authority or privacy regulator in:
- the country in which you reside;
- the country in which you work; or
- the country in which the alleged infringement or breach occurred.
We encourage you to contact us first so that we have an opportunity to address your concerns before you lodge a complaint with a regulator.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our business operations, services, technology, legal requirements, or how we collect, use, disclose, or otherwise process personal data.
Any changes will be published on this page and will become effective from the date specified in the updated "Last Updated" notice. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.
______________________________________________________________________________________
Appendix I: Cookie Policy
Last updated: [9th October 2026]
1. What cookies are
Cookies are small text files placed on your device when you visit a website. They can be session cookies (deleted when you close your browser) or persistent cookies (kept for a set period).
2. Cookies we use
We use cookies only for essential website functions and security.
Cookie type |
Purpose |
Duration |
|
Essential session cookies |
Maintain your login session, authenticate you, manage account access, and remember session-specific preferences |
Session or [DURATION] |
|
Security (Google reCAPTCHA) |
Help protect the website from spam, fraud, bots, and automated abuse |
As set by Google |
Disabling essential cookies may prevent the website, login, or secure areas from working properly.
3. Third-party cookies
The only third-party cookies we use are those set by Google reCAPTCHA. Google processes information such as IP address, browser and device information, and interaction data to distinguish humans from automated systems. Google's handling of this information is governed by its own terms:
- Google Privacy Policy: https://policies.google.com/privacy
- Google Terms of Service: https://policies.google.com/terms
We do not use third-party advertising, marketing, analytics, or social media tracking cookies.
4. Managing cookies
Most browsers let you view, delete, or block cookies, either for specific websites or entirely. Instructions are usually found in your browser's help documentation.
5. Changes
We may update this Cookie Policy from time to time to reflect changes in our website, technology, legal requirements, business practices, or the use of cookies. If we introduce non-essential cookies and consent is required by law, we will obtain your consent before placing those cookies. Any updates will be published on this page and will take effect from the date indicated by the updated "Last Updated" date in this Cookie Policy.