This policy is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR, the ePrivacy Directive as implemented in EU member states, the California Consumer Privacy Act as amended by the CPRA, and comparable US state privacy laws. Where those laws give you a right, we describe it in plain terms below and tell you how to use it.
1. Who we are and how to contact us
The data controller is Sumudu Trading (Dongguan) Co., Ltd. (Chinese legal name: 东莞市速贸得贸易有限公司; Unified Social Credit Code 91441900MAKBTADYX3), a company registered in the People's Republic of China with its registered office at Rm 604, Building 4, Zhonghui Shanpan Mingcheng, North Changqing Rd, Chang'an Town, Dongguan, Guangdong 523843, China.
Privacy contact: sales@sumudu-cn.com — please put "Data protection" in the subject line. You can also write to the postal address above or call +86 156 2713 7968.
We are established in China and do not maintain an establishment in the EU, the UK or the US. We answer data protection requests within one month of receiving them; if a request is complex we will tell you within that month why we need up to two further months.
2. What this policy covers
It covers personal data processed through this website (including the enquiry form, the quotation calculator and the visitor statistics we keep) and in the course of sourcing, inspection, shipping and after-sales work for our customers and suppliers.
It does not cover what a third party does with your data on its own site — for example a factory portal, a carrier tracking page or a payment provider you use directly.
3. What we collect
Data you give us
- Name, company name, country or region, email address, phone or WhatsApp number, and the details of your product requirement — including any drawings, specifications or photographs you choose to attach.
- The content of our correspondence, including notes our staff take about your enquiry so a colleague can pick it up.
- If you place an order: invoice and shipping details, and the documents required for export and customs clearance.
Data collected automatically when you browse
- IP address, browser type and version, operating system, referring URL, the pages you open and how long each stays open.
- Device time zone, which we store in a first-party cookie; with the IP address it lets us show your country and reply in a sensible time window.
- Approximate location derived from IP address or time zone. We do not use GPS and do not ask for your precise location.
- Aggregated analytics about how the site is used, only after you accept analytics cookies (see the Cookie Policy).
We do not ask for, and ask you not to send, special category data (health, religion, political opinions, biometric data) or government identity numbers. If such data reaches us in a document you attach, we delete it once the commercial purpose is served.
4. Why we are allowed to process it
Under Article 6 GDPR we rely on the following bases. We have mapped each purpose to exactly one primary basis so there is no ambiguity.
| Formål | Legal basis |
|---|---|
| Answering your enquiry and preparing a quotation | Steps taken at your request before entering a contract — Art. 6(1)(b) |
| Performing an order: sourcing, inspection, shipping, documentation, after-sales | Performance of a contract — Art. 6(1)(b) |
| Keeping accounting, tax and export records | Compliance with a legal obligation — Art. 6(1)(c) |
| Site security, fraud and abuse prevention, keeping the service available | Legitimate interests — Art. 6(1)(f): protecting our systems and our users |
| Sending you a quote follow-up, price updates or industry notes where you are an existing business contact | Legitimate interests — Art. 6(1)(f): relevant B2B communication, with an opt-out in every message |
| Analytics cookies that measure how the site is used | Consent — Art. 6(1)(a), collected through the cookie banner |
Where we rely on legitimate interests we have weighed our interest against your rights and expectations: the processing is limited to business contact data, you can object at any time, and we stop unless we have compelling grounds that override your objection.
5. Cookies and similar technologies
We use a small number of first-party cookies needed for the site to work (session, language, time zone, visitor identifier) and, only with your consent, Google Analytics 4. We do not run advertising or cross-site tracking cookies, and we do not use pixels for retargeting.
You can accept or decline analytics in the banner, and change your mind later through the "Cookie settings" link in the footer. Declining does not restrict any part of the site. The full list of cookies, purposes and lifetimes is in our Cookie Policy.
6. Who we share it with
We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share it only with the following categories of recipients, and only as much as each needs:
| Recipient | What they receive and why |
|---|---|
| Cloudflare, Inc. | IP address, request headers — content delivery, DDoS protection and bot management for this website. |
| Vultr Holdings Corporation (Frankfurt, Germany) | The website and its database, including enquiry records — hosting. Data is stored in the European Union. |
| Our email service provider | Name and email address — delivering our reply and the new-enquiry notification to our sales inbox. |
| Google LLC (Google Analytics 4) | Pseudonymous identifiers, pages viewed, approximate location — site usage statistics, only after consent. |
| Factories, inspection agencies and freight forwarders | Only what is needed to quote, produce, inspect and ship your order — for example the delivery address, the specification, and a contact name. |
| Professional advisers, auditors, and public authorities | Where required by law, or to establish or defend a legal claim (customs, tax, export control). |
Each processor is bound by a data processing agreement that limits it to our instructions and requires appropriate security. A list of current processors is available on request.
7. Where your data goes
The website and its database are hosted on a server in Frankfurt, Germany, so data submitted through this site is stored in the European Union. Our staff in China access it to answer you, which is a transfer to a third country.
For transfers from the EEA we rely on the European Commission's Standard Contractual Clauses (2021/914) together with supplementary technical measures: encryption in transit, access limited to named staff, and no transfer of special category data. For the UK we rely on the UK Addendum to those clauses; for Switzerland, the corresponding Swiss recognition.
Where data reaches the United States (Cloudflare, Google), those providers participate in the EU-US Data Privacy Framework and, in any event, offer Standard Contractual Clauses as a fallback.
8. How long we keep it
| Record | Retention |
|---|---|
| Enquiries that do not become orders | 24 months from the last contact, then deleted or anonymised |
| Orders, invoices and export documents | 7 years — required by Chinese accounting, tax and foreign-trade rules |
| Visitor statistics (pages, dwell time, country) | 14 months, then aggregated |
| Server and security logs | 90 days, except records of an attack kept for investigation |
| Analytics (Google Analytics 4) | 14 months in the reporting interface |
9. How we protect it
Encryption in transit (HTTPS with HSTS off-site redirect), access to the enquiry database restricted to named accounts with individual passwords, a web application firewall and rate limiting in front of the site, daily automated security updates on the server, and nightly database backups kept off the web root.
If a breach is likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours of becoming aware, and affected individuals without undue delay where the risk is high.
10. Your rights in the EEA, UK and Switzerland
- Access — a copy of the personal data we hold about you, with the purposes and recipients.
- Rectification — correction of inaccurate or incomplete data.
- Erasure — deletion where we no longer need it, or where you withdraw consent and there is no other basis.
- Restriction — we keep it but stop using it while a dispute is resolved.
- Portability — a machine-readable copy of data you provided under contract or consent.
- Objection — object to processing based on legitimate interests, including direct marketing, at any time and free of charge.
- Withdraw consent — at any time, without affecting processing already carried out.
Write to sales@sumudu-cn.com with "Data protection" in the subject. We answer within one month, free of charge. If we cannot verify your identity we may ask for one document confirming it, and we keep that document only for as long as the request takes.
You also have the right to lodge a complaint with a supervisory authority in the country where you live or work — for example your national data protection authority in the EU, the Information Commissioner's Office in the UK, or the Federal Data Protection and Information Commissioner in Switzerland. We would rather hear from you first.
11. Your rights in California and other US states
In the 12 months before this policy took effect we collected the following categories: identifiers (name, email, phone, IP address), commercial information (products enquired about, orders), internet activity (pages viewed, dwell time), and geolocation at country or city level. We collected them from you and from your browser. We disclosed them only to the service providers listed above, for the business purposes described above.
- Right to know what we collect, where it came from, why, and who receives it.
- Right to delete personal data we collected from you, subject to legal retention duties (for example export records).
- Right to correct inaccurate personal data.
- Right to opt out of sale or sharing — we do neither, so there is nothing to opt out of; we honour Global Privacy Control (GPC) signals as an opt-out of sale and sharing by default.
- Right to limit use of sensitive personal data — we do not collect it.
- Right not to be discriminated against for exercising a right. We do not change price, service or quality because you exercised one.
- Right to use an authorised agent, with written permission from you.
Requests: sales@sumudu-cn.com, subject "Privacy request". We confirm receipt within 10 business days and answer within 45 days, extendable once by a further 45 days with notice. We may ask for information to verify that the request comes from you or your agent.
12. China: how PIPL applies
As a company established in China we also handle personal data under the Personal Information Protection Law (PIPL). The rights of access, correction, deletion, withdrawal of consent and complaint to the Cyberspace Administration of China apply as provided by that law. Where PIPL and this policy differ, the stricter protection applies.
13. Automated decisions and profiling
We do not make decisions with legal or similarly significant effects about you by automated means, and we do not build behavioural profiles for advertising. The visitor statistics described above rank pages and countries; they do not evaluate individuals.
14. Children
This is a business-to-business site. It is not directed to children and we do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, write to us and we will delete it.
15. Changes to this policy
When we change this policy we update the version number and the effective date at the top of the page. If a change materially affects how we use data we already hold, we will tell affected contacts by email before it takes effect. Earlier versions are available on request.
Related documents: Terms of Service · Cookiepolitik