Privacy Policy
How we collect, use, share and protect personal data when you use this website, contact us, or place an order.
Last updated: [DATE] · Version [VERSION]
This is a structured draft covering the data categories, legal bases, third parties and retention periods required under GDPR. It must be reviewed by a qualified lawyer and adjusted to your actual processing activities. Items marked [CONFIRM] require verification against what you really do.
1 · Who we are
Foshan Hongcheng Electronic Technology Co., Ltd. (佛山市弘诚电子科技有限公司), trading as Hongcheng, is a phone case sourcing and production partner based in Foshan, Guangdong, China.
For the purposes of the EU General Data Protection Regulation (GDPR), Hongcheng is the data controller for personal data collected through this website.
| Registered name | Foshan Hongcheng Electronic Technology Co., Ltd. |
| Registered address | [REGISTERED_ADDRESS] |
| Business licence no. | [LICENCE_NUMBER] |
| Privacy contact | sales@hongchengelec.com |
| Telephone | +86 136 4030 5916 |
| EU representative | [NONE / NAME — see section 8] |
Article 27 GDPR requires a non-EU controller to appoint an EU representative when it offers goods or services to data subjects in the Union. Occasional B2B supply into EU member states may or may not trigger this depending on how your business operates and whether you target data subjects (as opposed to businesses) in the EU. [CONFIRM with your lawyer.] If required, name the representative in section 8.
2 · What personal data we collect
We collect only what we need to quote, produce and ship an order, or to answer your enquiry.
2.1 Data you give us
| Data | When | Purpose |
|---|---|---|
| Name, company name, job title | Enquiry form, email, WhatsApp | Preparing quotations, correspondence, invoicing |
| Email address and/or telephone / WhatsApp number | Enquiry form, email, WhatsApp | Responding to you, order updates, shipping coordination |
| Delivery address, consignee details | When placing an order | Shipping, customs documentation, import compliance |
| Bank and payment details | When placing an order | Payment execution, tax and accounting obligations |
| Files you attach (logos, artwork, reference images) | Enquiry form | Quoting accuracy and production specification |
| Order history, specification agreements, inspection records | During an order | Production, quality control, dispute resolution |
2.2 Data collected automatically
| Data | Source | Purpose |
|---|---|---|
| IP address, browser type, device, referring page | Server and analytics logs | Security, troubleshooting, site performance |
| Pages visited, time on page, navigation path | Analytics cookies (Google Analytics 4) | Understanding which content is useful |
| Cookie preferences | Your browser | Remembering your consent choices |
The table above assumes Google Analytics 4 and a contact form service. [CONFIRM the exact list of processors in section 6.] Every third-party tool that can set a cookie or receive personal data must be listed there and, where required, blocked until consent.
2.3 What we do not collect
- We do not collect special category data (health, biometrics, political or religious views, sexual orientation) and ask that you do not send it.
- We do not collect data from children. Our products are not intended for anyone under 18.
- We do not buy or receive contact lists from third parties.
3 · Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Responding to enquiries, preparing quotations, sample arrangements | Consent (Art. 6(1)(a)) — and performance of a contract where you are already a customer |
| Taking, producing, inspecting and shipping an order | Performance of a contract (Art. 6(1)(b)) |
| Invoicing, customs documentation, tax and accounting compliance | Legal obligation (Art. 6(1)(c)) |
| Defending claims, handling complaints and disputes | Legitimate interests (Art. 6(1)(f)) — our interest in defending our legal position |
| Website analytics, understanding how the site is used | Consent (Art. 6(1)(a)) where analytics cookies are non-essential |
| Reaching you by email or WhatsApp about an existing order | Legitimate interests (Art. 6(1)(f)) — service of a contract you have entered into |
Anything we send that is not about an existing order — newsletters, product announcements, promotional messages — needs consent or a separate legitimate-interest assessment, plus an opt-out in every message. [CONFIRM what marketing you actually send.] If the answer is "none", say so here rather than leaving it vague; a clear statement is safer than an unused clause.
4 · Who we share it with
We do not sell personal data. We share it only with the parties who need it to fulfil your order or operate this website:
- Partner factories — for production, we share the specification, quantities, packaging artwork and, where required for labels, the consignee information.
- Freight forwarders and customs agents — to ship and clear your order.
- Payment providers — to process payments.
- Professional advisers — accountants, customs brokers, lawyers where relevant.
- Service providers running this website — hosting, CDN, analytics, form handling, email. Listed in section 6.
- Authorities — where disclosure is required by law, for example customs and tax authorities.
When we pass your details to a production factory in China, both parties are independent controllers for that transfer, which needs an Article 28 arrangement where we determine the purposes and means, or the factory acts as our processor where we instruct it as such. [LEGAL REVIEW REQUIRED — this is the clause most likely to be missed and most likely to be questioned in a B2B privacy audit.]
5 · International transfers
We are established in China. If you are in the European Economic Area, the United Kingdom or Switzerland, personal data you send us will be transferred to China.
Where the recipient country does not have an adequacy decision from the European Commission, we rely on the European Commission's Standard Contractual Clauses (SCCs) together with a transfer impact assessment and supplementary measures where required, and — where the transfer concerns UK or Swiss data subjects — the UK and Swiss equivalents.
You may request information about the safeguards we use by writing to sales@hongchengelec.com.
The transfer mechanism must match your actual data flows. If you do not yet have SCCs executed with your partner factories and service providers, you should not claim them in this policy until you do — this is a statement a customer can reasonably audit.
6 · Processors we use
We use the following service providers. Each processes data only on our instructions.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Cloudflare | CDN, DNS, hosting, security | IP address, request logs | Global |
| Google (Analytics 4) | Website analytics | Cookie identifier, usage data | Global |
| Cloudflare (Workers) | Enquiry form receipt | Name, contact, enquiry content, attachments | Global |
| Resend | Transactional and business email | Email address, correspondence, enquiry attachments | United States |
| Meta (WhatsApp Business) | WhatsApp enquiries | Phone number, messages | Global |
| LinkedIn (Microsoft) | Business contact discovery | Professional profile data | Global |
| [PAYMENT PLATFORM — fill before publishing] | Order payment collection and payout | Order reference, amount, billing name and contact details, transaction identifiers | [PLATFORM JURISDICTION] |
| [ACCOUNTING AGENCY — fill before publishing] | Bookkeeping, invoicing and tax filing | Customer and order data, invoicing details, contact and company information | China |
A processor list that names a category instead of a company is arguably worse than an incomplete one, because it implies you have checked and found nothing to disclose.
Fill in the actual legal entity names before publishing. For the payment platform, use the entity name in its terms of service rather than the brand — buyers who trace GDPR requests will go by what is written in the contract.
For the accounting agency, also note three things elsewhere on this page that they handle and that therefore affect your records: how long they retain your data, whether any of it leaves China, and whether a data processing agreement is in place. Section 5 on international transfers already covers the mechanism; confirm the agency is covered by it.
[CONFIRM — add the payment platform entity name and jurisdiction, and the accounting agency name, before this policy is published.]
Every service that can receive or infer personal data belongs here. Do not publish a partial list — an incomplete processor list is arguably worse than none, because it implies completeness.
7 · How long we keep it
| Data | Retention |
|---|---|
| Enquiries that do not become orders | 24 months from last contact |
| Order records, invoices, shipping and customs documents | 10 years from the end of the tax year. Chinese accounting record-keeping rules require long retention for accounting vouchers, ledgers and related records, and our accountant maintains these files on that basis |
| Production specification and inspection records | Duration of the commercial relationship plus the limitation period for claims |
| Tooling and artwork files you supplied | Until you instruct deletion and tooling is de-moulded |
| Enquiry attachments you sent with a form | Deleted within 90 days of the enquiry being resolved, unless the enquiry became an order, in which case they follow the order retention above |
| Server and security logs | 30 days |
| Analytics data | 14 months (Google Analytics default) unless you configure a shorter period |
The 10-year figure is a legal floor, not your choice. It is what Chinese accounting record-keeping rules require for accounting vouchers, ledgers and related records, and it should match what your accountant actually retains — state a shorter period than they keep and you will be asked for data you can no longer produce.
The 90-day attachment period is a commitment we are making, so the Worker and your mail retention need to support it. If you have not yet decided how you will clear old attachments, either delete this row or keep it and enforce it.
8 · Your rights
Where the GDPR applies to you, you have the right to:
- Access — to obtain a copy of the personal data we hold about you (Art. 15).
- Rectification — to have inaccurate or incomplete data corrected (Art. 16).
- Erasure — to have data deleted, where no overriding obligation requires retention (Art. 17).
- Restriction — to limit how we use your data in certain circumstances (Art. 18).
- Portability — to receive your data in a structured, machine-readable format (Art. 20).
- Objection — to object to processing based on legitimate interests, and to object at any time to direct marketing (Art. 21).
- Withdraw consent — at any time, without affecting processing already carried out (Art. 7(3)).
- Complain — to your local supervisory authority. In China, the authority is the local Cyberspace Administration of Guangdong.
To exercise any of these, write to sales@hongchengelec.com. We will respond within [PERIOD] and may ask you to verify your identity first.
We apply the same handling process to all requests regardless of where the request comes from. [LEGAL REVIEW: confirm this is consistent with PIPL obligations on the Chinese side — the two regimes are broadly aligned but not identical, particularly around automated decision-making and breach notification.]
9 · Security
We apply technical and organisational measures appropriate to the nature of the data: access control to order and specification files, encryption in transit for this website, and contractual confidentiality obligations on partner factories handling your artwork and specifications.
Describe what you actually do. Claims about certifications you do not hold, or encryption you have not implemented, create liability. [CONFIRM the actual measures.]
10 · Cookies
This site uses a small number of cookies. We distinguish between those required to operate the site and those used for analytics.
| Category | Examples | Purpose |
|---|---|---|
| Strictly necessary | Consent preference | Remembers that you have made a choice about analytics |
| Analytics | Google Analytics | Page views and site usage. Blocked until you accept |
You can change your choice at any time using the cookie settings link in the footer, and you can also block or delete cookies through your browser settings. Blocking necessary cookies may stop the consent preference from being remembered, which is the only effect.
This section is only accurate once you have actually implemented: a consent banner that blocks analytics scripts until consent is given, and a working mechanism to change the choice later. [CONFIRM implementation before publishing.] A cookie policy describing consent you do not actually request is itself a compliance failure.
11 · Changes to this policy
We update this policy when our processing changes or when the law requires it. The date at the top of this page shows when it was last revised. Where a change materially affects how we use your data, we will tell you before it takes effect.
12 · Contact
Privacy questions and requests: sales@hongchengelec.com, marked for the attention of the data protection contact.
This policy reflects how we actually handle data. Where it says [CONFIRM], that is an instruction to the site owner, not a public-facing placeholder — those items must be resolved before this document is published.