Privacy Policy

1. Who we are

Golden Origin Commerce LLC (“Golden Origin”, “we”, “us”, “our”) is a limited liability company formed in the State of Wyoming, United States, with its registered office at 30 N Gould St, Ste R, Sheridan, WY 82801, USA. We operate the website goldenoriginllc.com and provide mobile application development and Apple Developer Program enrollment services.

For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), Golden Origin is the data controller for personal data collected through this website and in the course of our client relationships. Where we process data on behalf of a client — for example, handling documentation inside that client’s own developer account — we act as a processor on that client’s documented instructions.

Privacy contact: contact@goldenoriginllc.com

2. Information we collect

2.1 Information you give us

• Enquiry details submitted through our contact form: your name, email address, company or entity name, country of registration, the service you are interested in, your current stage, and the contents of your message.
• Direct correspondence sent to us by email or telephone, including anything you choose to include in it.
• Engagement information provided once you become a client: billing contact details, business registration documents, entity identifiers, the identity of the person authorised to bind your organisation, and project materials.

2.2 Information collected automatically

• Server and delivery logs. Our hosting provider records technical data such as IP address, user agent, requested URL, referrer and timestamp. This is used for security, abuse prevention and diagnostics.
• Form security data. Our form provider processes submission metadata to filter spam.

We do not operate advertising networks, behavioural profiling, or cross-site tracking pixels on this website. We do not use cookies for advertising. If we later introduce analytics or any non-essential cookie, we will update this policy and present a consent mechanism before those cookies are set.

2.3 Information we ask you never to send

Please do not send us passwords, two-factor authentication codes, full payment card numbers, government identification numbers or other highly sensitive credentials through the website form, email or chat. Where an engagement genuinely requires sensitive documentation, we will agree a secure channel with you in writing first.

3. Why we use your information, and our legal bases

Purpose	Data used	Legal basis (GDPR)
Responding to your enquiry and preparing a proposal	Enquiry details, correspondence	Steps taken at your request prior to entering a contract (Art. 6(1)(b))
Delivering the services you have engaged us for	Engagement information, project materials	Performance of a contract (Art. 6(1)(b))
Invoicing, accounting and tax records	Billing contact and transaction details	Legal obligation (Art. 6(1)(c))
Securing the website and preventing abuse	Server logs, form security data	Legitimate interests in operating a secure service (Art. 6(1)(f))
Maintaining records to establish or defend legal claims	Contracts, correspondence	Legitimate interests (Art. 6(1)(f))
Sending service updates you have asked to receive	Name and email address	Consent (Art. 6(1)(a)), withdrawable at any time

We do not use your personal information to make decisions about you by automated means that produce legal or similarly significant effects.

4. How we share information

We share personal information only in the following circumstances:

• Service providers. Vendors who host this website, deliver form submissions, provide business email, and handle invoicing and accounting. They process data on our instructions and are bound by contract.
• Third parties necessary to deliver your engagement. Where the service you hired us for requires it — for example, submitting an application to Apple Inc. or requesting a D-U-N-S Number from Dun & Bradstreet, Inc. on your instructions — information you supply is transmitted to those organisations. Their handling of that data is governed by their own privacy policies.
• Professional advisers such as lawyers and accountants, where reasonably necessary.
• Legal requirements. Where we are required to disclose information by applicable law, regulation, legal process or enforceable governmental request.
• Business transfer. In connection with a merger, acquisition, financing or sale of assets, subject to equivalent protection for your information.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

5. International transfers

We are based in the United States, and our service providers may process data in the United States and other countries. If you are located in the European Economic Area, the United Kingdom or Switzerland, this means your personal data may be transferred outside your jurisdiction.

Where such a transfer takes place, we rely on appropriate safeguards — principally the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) incorporated into our agreements with service providers — together with supplementary technical and organisational measures. You may request further information about these safeguards by contacting us.

6. How long we keep information

• Enquiries that do not become engagements: retained for up to 24 months, then deleted.
• Client engagement records and correspondence: retained for the duration of the engagement and for 7 years afterwards, to meet accounting, tax and limitation-period requirements.
• Invoicing and financial records: retained for the period required by applicable US federal and Wyoming state law.
• Server logs: retained for a short rolling period determined by our hosting provider, typically not exceeding 12 months.

When a retention period ends, we delete the information or irreversibly anonymise it.

7. Your rights

7.1 If you are in the EEA, the UK or Switzerland (GDPR)

You have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have data erased, where one of the grounds in Article 17 applies;
• restrict processing in the circumstances set out in Article 18;
• receive data you provided to us in a portable, machine-readable format, and have it transmitted to another controller where technically feasible;
• object to processing carried out on the basis of our legitimate interests, on grounds relating to your particular situation;
• withdraw consent at any time, where processing is based on consent — this does not affect the lawfulness of processing before withdrawal; and
• lodge a complaint with your national supervisory authority (in the UK, the Information Commissioner’s Office).

7.2 If you are a California resident (CCPA/CPRA)

You have the right to:

• know the categories and specific pieces of personal information we have collected, the sources, the business purpose, and the categories of third parties to whom it was disclosed;
• delete personal information we have collected from you, subject to statutory exceptions;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information — noting that we do not sell or share personal information, and have not done so in the preceding 12 months;
• limit the use of sensitive personal information — noting that we do not use sensitive personal information for purposes requiring a limitation right; and
• non-discrimination for exercising any of these rights. We will not deny you services, charge different prices, or provide a different level of service because you exercised a privacy right.

The categories of personal information we have collected in the preceding 12 months are: identifiers (name, email address, telephone number, IP address); commercial information (services enquired about or purchased); professional or employment-related information (company name, role); and internet activity information (server logs). These are collected directly from you and automatically through our hosting provider, for the business purposes described in Section 3.

7.3 How to exercise your rights

Email contact@goldenoriginllc.com with the subject line “Privacy Request”, telling us which right you wish to exercise. We will acknowledge your request and respond within the timeframe required by applicable law — generally one month under the GDPR and 45 days under the CCPA, each extendable where permitted. We may need to verify your identity before acting, and will ask only for information reasonably necessary to do so. An authorised agent may submit a request on your behalf with written proof of authority.

8. Security

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit over HTTPS, access controls limiting staff access to what their role requires, multi-factor authentication on business-critical accounts, and vendor due diligence. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affecting your personal data occurs, we will notify you and the relevant authorities where required by law.

9. Children

Our services are directed to businesses and professionals. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

10. Third-party links

This website may link to third-party sites, including those of Apple Inc. and Dun & Bradstreet, Inc. We are not responsible for the privacy practices of those sites, and we encourage you to read their policies.

11. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The “Last updated” date at the top of this page shows when it was last revised. Where changes are material, we will take reasonable steps to notify you — for example by email to clients with an active engagement, or by a notice on this website — before the changes take effect.

12. Contact us

Golden Origin Commerce LLC
30 N Gould St, Ste R
Sheridan, WY 82801
United States
contact@goldenoriginllc.com · +1 (929) 567-3914

We have not appointed an EU or UK representative under Article 27 GDPR, as our processing does not currently meet the threshold requiring one. Please direct all privacy enquiries to the address above.