Privacy policy

What you submit: the name and company, contact email and message you enter in the message form. We use this only to reply to your message.

What you choose to share: if you attach a business licence or authorisation documents to an email or the form, we use them for that business discussion only.

What is recorded automatically: server access logs record the time of the request, source IP, browser identifier and the path requested, so we can locate faults and spot abnormal traffic.

What we do not collect: payment details (there is no payment step on this site), identity document images, address books and device contacts, and marketing preferences unrelated to your message.

Primary purpose: replying to your message and corresponding with you about our business and categories. This is the main reason the form collects anything.

Legitimate interests: detecting and blocking automated abuse, such as scripted bulk submissions, so the form and server stay available.

Consent: for anything beyond your message, such as subscribing to industry updates, we ask first and you may withdraw it at any time.

We do not build automated profiles from what you submit, and we do not use message information for advertising.

Message records are held on the local disk of our own server, in files readable and writable only by the server administrator. They are not passed through a third-party database or cloud spreadsheet service.

A copy of your message: once accepted, the content is turned into an email and sent to our business mailbox, so a person can reply.

Access logs are written directly to a local log file by the web server (nginx) and rotated on the server's operational schedule.

All of the above are located within mainland China.

Encryption in transit: the whole site runs over HTTPS, and the path from the browser to the server and from the server to the message service is encrypted. The server does not accept unencrypted form submissions.

Access control: message record files are readable and writable by the administrator only, and the message service listens on a loopback address, so it cannot be reached from outside the server except through the website.

Storage at rest: we do not apply additional application-layer encryption to message content. Its protection rests on server disk and file-system permissions. We state this plainly rather than claim more than is true.

Log retention: access logs rotate daily and are kept for 14 days.

The company principal (legal representative) is the final accessor, responsible for replying to messages and commercial discussions.

Contracted operations staff access the server only to handle faults, security events or legal compliance requirements, and do not read the message content itself.

Apart from infrastructure providers, no third party can reach the user data we hold.

The hosting provider, for computing and storage resources, handling infrastructure data under its own terms of service without access to message content.

The email provider, for delivering the message email, handling mail content under its own terms of service.

Apart from that infrastructure, we do not sell your information, do not provide it to advertising or analytics firms, and do not pass messages to third parties to make contact for us.

Where a legal obligation requires disclosure, we first verify the legal basis and, where the law allows, tell you.

Message records: kept for up to 12 months, then cleaned up automatically by the server.

Access logs: kept for 14 days, then removed automatically by log rotation.

You can ask us to delete your message record earlier at any time, and we will do so once verified and reply to you.

You can ask us to tell you what information we hold about you, correct anything inaccurate, delete your message record, limit or object to a particular use, or provide a portable copy.

How to exercise them: raise your request through the message form on the Contact page and describe what you need. We reply within 5 business days.

If you believe our handling infringes your rights, you may also seek a remedy from a people's court with jurisdiction over the place where the operator is registered.

All information we collect is stored and processed within mainland China. We do not make it available abroad and do not use overseas data processing services.

If our business scope ever changes such that a cross-border transfer becomes necessary, we will update this policy first and seek your consent again.

This site sets no cookies and uses no analytics scripts, tracking pixels or third-party embeds.

The site loads no scripts or styles from external domains; all assets are served from our own server.

Your browser therefore receives no identifier from this site that could be used to track you.

Detection: as soon as a security event affecting user data is discovered or reported, we start an internal investigation.

Containment: we block any possible access route first, rotate the relevant credentials, assess the affected data and clean it up.

Notification: once the scope is confirmed, we notify affected users within 72 hours, describing what happened, what was affected and what we have done.

Review: after the incident is closed we review the cause and correct the corresponding process and configuration.

For any question, objection or complaint about this policy or your personal information, please raise it through the message form on the Contact page.

Operator: Nanyang Tongbai Yuhan Trading Co., Ltd. The registered address and unified social credit code are listed on the Registration page and can be independently verified.