RoyalSonic GDPR Compliance Notice

Operated by J.R.D. Company Ltd. · Established May 2001 · Last revised: July 28, 2026 · Governed by the laws of New Taipei City, Taiwan

J.R.D. Company Ltd. (“J.R.D.,” “RoyalSonic,” “we,” “us,” or “our”) complies with the General Data Protection Regulation (GDPR) (EU) 2016/679 regarding the collection, processing, and storage of personal data belonging to residents of the European Union (EU) and the European Economic Area (EEA).

1. RoyalSonic as Data Controller vs. Data Processor

Under the GDPR framework, our role depends on the type of data we handle:

Data Controller: J.R.D. acts as the Data Controller for your account registration, billing information, profile details, and business logs managed via www.royalsonic.com and whmcs.royalsonic.com. We determine the purposes and means of processing this administrative data.

Data Processor: J.R.D. acts strictly as a Data Processor for the actual email content, contact directories, calendars, and file attachments that you upload, transmit, or store using our hosting services. You remain the Data Controller of your email data, and you are solely responsible for ensuring you have a lawful basis to process the personal data of your email recipients.

2. Lawful Basis for Data Processing

We process personal data under the following lawful bases permitted by GDPR Article 6:

• Contractual Necessity (Art. 6(1)(b)): To provision your mailboxes, process your payments, execute server renewals, and deliver the email hosting service you purchased.
• Legal Obligation (Art. 6(1)(c)): To maintain accurate corporate financial records, comply with mandatory local tax auditing laws, and fulfill verified statutory regulatory requirements in New Taipei City, Taiwan.
• Legitimate Interests (Art. 6(1)(f)): To protect our dedicated server nodes (including our ZFS and NVMe storage pools) against malicious activities, monitor sending frequencies to prevent automated spam loops, and guard our IP address network blocks from global blacklisting.

3. Your Data Subject Rights Under GDPR

If you are a resident of the EU or EEA, you possess the following explicit data rights:

• Right of Access (Art. 15): You have the right to request a digital copy of all personal information and account metadata we hold about you.
• Right to Rectification (Art. 16): You can update, correct, or complete any inaccurate profile or billing information at any time directly through your dashboard at whmcs.royalsonic.com.
• Right to Erasure / “Right to be Forgotten” (Art. 17): You may request the total deletion of your personal account data upon terminating your contract.
  Operational Guardrail: Data belonging to canceled or unpaid accounts is instantly suspended and automatically purged permanently from our physical hard drives after a 14-day data retention grace period, making it completely unrecoverable. J.R.D. is not obligated to retain or restore purged data.
• Right to Restriction of Processing (Art. 18) & Data Portability (Art. 20): You may request that we limit the processing of your data or export your profile information in a structured, machine-readable format. Mailbox content exports, if offered, may be subject to technical limits and Fees published at the time of request.
• Right to Object (Art. 21): You have the right to object to any data processing justified under our legitimate interests, subject to our continuing right to process where we demonstrate compelling legitimate grounds (including network security and anti-abuse).

To exercise any of these rights, please open an authenticated support ticket inside your billing portal or contact our compliance team directly at [email protected].

4. International Data Transfers

J.R.D. Company Ltd. is headquartered in New Taipei City, Taiwan, and operates physical hardware pools in data centers provided by infrastructure partners (such as Hetzner Online GmbH).

Your administrative account profiling data is processed securely in compliance with strict operational data controls.

By utilizing RoyalSonic services, you acknowledge and consent to the transmission of your core email traffic across international network channels to facilitate global electronic mail routing.

5. Data Protection Officer (DPO)

We have appointed an internal Data Protection representative to oversee network compliance and data protection practices. If you have any inquiries regarding this notice or require a formal Data Processing Agreement (DPA) to comply with your corporate EU regulatory mandates, please submit a formal request via email to [email protected].

Terms of Service ·
Fair Use Policy ·
Email Use Policy ·
Privacy Policy ·
Refund Policy ·
GDPR