Privacy Policy

Effective Date: November 4, 2026
Last Updated: November 4, 2026

This Global Privacy Policy applies to all visitors, enquirers, clients and business contacts accessing https://chinapurchasingagent.com (“the Website”) worldwide.
We are a Hong Kong purchasing agency. This notice complies with the Personal Data (Privacy) Ordinance (PDPO) of Hong Kong and the EU General Data Protection Regulation (GDPR) and UK GDPR where applicable.

Data Controller: BR Business Limited
Registered Address: Unit 1022a, Beverley Comm,Centre, 87-105 Chatham Rd,South, Tsim Sha Tsui,Hong Kong
Privacy Contact Email: [email protected]

We are incorporated in Hong Kong Special Administrative Region. Our website is hosted by Hostinger with servers located in the United States. When you submit enquiries, send contact details, communicate with our team or place orders through our website, you confirm you have read and understood this Privacy Policy and consent to the processing and cross‑border transfers described herein, save where a different lawful basis applies.
This policy only governs personal data processing for this Website and our purchasing agency service. It does not apply to third‑party websites, supplier portals, freight forwarder systems or payment provider platforms linked from our site.

1. Definitions
1.1 Personal Data: Any information that relates to, identifies or is capable of identifying a living natural person (e.g. your name, business email, direct phone number). Company registration numbers, generic company addresses or public business information standing alone are not personal data.
1.2 Processing: Any operation or set of operations performed on personal data, including collection, recording, organisation, storage, use, sharing, transfer, erasure or destruction.
1.3 Data Controller: BR Business Limited, the Hong Kong company that decides why and how your personal data is processed.
1.4 Processor: A third‑party service provider that processes personal data only on our written instructions and for our purposes (Hostinger hosting provider, email provider, CRM, analytics, payment service provider etc).
1.5 SCCs: Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner’s Office (ICO), used as a safeguard for cross‑border data transfers out of the EEA / UK.
1.6 EEA: European Economic Area.
1.7 GDPR: EU General Data Protection Regulation (Regulation 2016/679).
1.8 UK GDPR: The UK General Data Protection Regulation, retained under UK law after Brexit.
1.9 PDPO: The Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong Special Administrative Region, regulated by the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).
1.10 Schrems II: The CJEU judgment restricting data transfers to the United States in absence of an adequacy decision.

2. Categories of Personal Data We Collect
2.1 Data you voluntarily provide
We collect this when you fill our contact / enquiry form, email us, chat with our team, send quotation requests, place orders, provide shipping or invoicing details:

– Identity data: your full given name, job title
– Contact data: business email address, direct telephone / WhatsApp / Skype number, business postal address, billing address, delivery address, country of operation
– Commercial enquiry data: your sourcing requirements, target product specs, drawings, logo files, quantity, target price, sample requirements, packaging requirements, customisation instructions
– Correspondence records: emails, chat logs, call notes, quotation history, order records, QC reports, invoice and payment‑related correspondence
– Account / preference data: if we maintain a CRM record for you, notes about your preferred suppliers, inspection standards and Incoterms

We do not intentionally collect special category personal data (race, religion, political opinion, health, biometrics etc). Please do not send us such data in your messages. If you voluntarily send special category data, you expressly consent to its limited processing to respond to your message.

2.2 Automatically collected technical data
When you visit the Website, Hostinger (our US hosting provider) and analytics tools may automatically collect:

– IP address
– Device type, operating system, browser name and version
– Timestamp of visit, pages viewed, time spent on each page, exit page
– Referral source (where you came from, e.g. search engine or external link)
– Cookie identifiers and similar tracking signals (detailed in our separate Cookie Policy)

We do not use automatic browsing data to attempt to identify you unless you separately submit your contact details.

3. Purposes for which we process your personal data
3.1 To respond to your sourcing enquiry and prepare quotations
We use your contact details and product requirements to reply, negotiate pricing with suppliers and send you formal written quotations.
3.2 To perform our purchasing agency service under an agreed order
If you place an order, we share necessary contact and specification information with mainland China suppliers, QC inspectors, warehouses and freight coordinators to arrange samples, production follow‑up, inspection, consolidation and shipment.
3.3 Invoicing, accounting, tax and record‑keeping
We retain business records to issue invoices, reconcile payments and satisfy Hong Kong tax and business record retention obligations.
3.4 Order aftercare, dispute coordination and support
We use your contact information to follow up production status, forward QC reports, coordinate supplier communications and assist resolution if quality or delivery issues arise.
3.5 Website security, fraud screening and risk prevention
We process IP and contact data to block malicious traffic, detect fake enquiries and prevent fraudulent orders or sanctions‑related risks.
3.6 Service improvement and website analytics
Aggregated, anonymised or pseudonymised browsing statistics help us improve page layout, enquiry forms and sourcing workflows.
3.7 Marketing communications (only with consent)
We may send occasional newsletters, product updates or sourcing tips only if you have explicitly opted in. Marketing emails include a permanent unsubscribe link.
3.8 Legal compliance
We may process and disclose data when required by valid legal notice, court order, government authority or applicable trade sanctions rules.

4. Recipients of your personal data – who we share data with
We do not sell, rent or trade your personal data to third parties for independent commercial marketing. Sharing only occurs where necessary to deliver our service, and we limit disclosure to the minimum information required.
4.1 Hostinger (our website hosting provider, US‑based), acting as our data processor under Hostinger’s official Data Processing Agreement (DPA) incorporating EU and UK SCCs.
4.2 Mainland China Suppliers / Factories / Traders
When you request a quotation or place an order, we share your name, company, contact method and your product specifications so the supplier can quote, produce and communicate with us on your behalf.
4.3 QC inspection providers, warehouses and consolidation partners located in mainland China
Only the minimum contact and order information required to arrange inspection, receive goods, pack and consolidate shipments.
4.4 Freight forwarders, shipping agents and customs brokers
Where you instruct us to coordinate shipping, we share delivery details as required for booking and documentation.
4.5 Approved service processors
Payment service providers, email and CRM platforms, subject to written Data Processing Agreements (DPA) / SCCs where required.
4.6 Professional advisers
Accountants, lawyers or arbitrators, only in the event of a dispute, invoice audit or legal requirement.
4.7 Governmental or regulatory bodies
If we receive a lawful, enforceable request, or where disclosure is required to comply with sanctions, export control or court process.

All recipients receiving personal data from us are bound by contractual obligations to process data only on our instructions, keep it confidential and not reuse it for their own purposes.

5. International data transfers
5.1 Your personal data submitted via this website is first collected and stored on Hostinger servers located in the United States.
5.2 Data will then be transferred to our Hong Kong company (the Data Controller).
5.3 For fulfilment of purchasing agency orders, relevant personal data may be further transferred to suppliers, QC and logistics partners located in mainland China.
5.4 The United States, Hong Kong and mainland China are all third countries under GDPR with no adequacy decision from the European Commission or UK ICO.
5.5 All cross‑border transfers described above are protected by Standard Contractual Clauses (SCCs).
5.6 For EEA and UK residents, please go to Section 8 for detailed GDPR safeguards.
5.7 For clients in other regions, your cross‑border data transfers are governed by this policy and applicable local law in your country. Where your local law imposes extra requirements, it remains your responsibility to ensure you are entitled to send such data to us.

6. Data retention periods
6.1 Unconverted enquiries (you asked for a quote but never placed an order): 24 months from our last meaningful communication with you, unless you request earlier deletion.
6.2 Confirmed, completed orders: 7 years after final shipment and invoice settlement, to meet Hong Kong tax and business record‑keeping requirements. This retention period overrides deletion requests where mandatory legal record‑keeping applies.
6.3 Marketing consent records: retained until you withdraw consent / unsubscribe. After unsubscription we mark your record to stop marketing; we keep a suppression record permanently to honour your opt‑out.
6.4 Raw analytics and server access logs hosted with Hostinger in the US: 12 months, after which logs are anonymised or deleted.
6.5 Correspondence that forms part of an ongoing dispute: retained until the dispute is fully resolved and the applicable limitation period expires.
6.6 Anonymised statistical data (no longer linked back to you) may be retained indefinitely for internal business analysis.

7. Data security measures
We apply reasonable technical, administrative and organisational safeguards to protect your personal data against unauthorised access, loss, alteration or disclosure, including:
7.1 TLS/SSL encryption for website traffic and form submissions
7.2 Password controls, role‑based internal access rights to CRM and order files
7.3 Confidentiality obligations for our internal team
7.4 Regular backup procedures
7.5 Restricted sharing of sensitive order information
7.6 Contractual security requirements and SCC obligations imposed on Hostinger and downstream data recipients

No internet transmission or cloud storage system can be guaranteed 100% secure. We cannot eliminate all risk of hacking, accidental leak or unauthorised access. If we discover a personal data breach that is likely to create a high risk to your rights and freedoms, we will notify affected EEA/UK data subjects and supervisory authorities in line with GDPR obligations where applicable. We will also comply with PDPO breach notification requirements as required by Hong Kong PCPD.

8. Additional provisions for EEA and United Kingdom Residents (EU GDPR / UK GDPR)
This section applies only if you are physically located within the EEA or the United Kingdom.
8.1 Lawful bases for processing (GDPR Article 6)
8.1.1 Performance of a contract (Art 6(1)(b)): Processing required to provide our purchasing agency service, prepare quotes, arrange samples, production, inspection and shipment when you enter an order with us.
8.1.2 Legitimate interests (Art 6(1)(f)): Replying to unsolicited sourcing enquiries, order follow‑up, fraud prevention, website security, service improvement and internal business administration. We have carried out a balancing test and consider these interests do not override your privacy rights. You have the right to object to processing based on legitimate interests, as set out below.
8.1.3 Legal obligation (Art 6(1)(c)): Retention of accounting and tax records where required by Hong Kong law.
8.1.4 Consent (Art 6(1)(a)): Optional marketing emails and non‑essential analytics/marketing cookies. Consent can be withdrawn at any time without penalty.

We do not rely on consent for core order processing.

8.2 Your Data Subject Rights under GDPR / UK GDPR
Requests should be emailed to [email protected]. We will verify your identity before responding, to prevent disclosure to unauthorised persons.
8.2.1 Right of access: You may request a copy of all personal data we hold about you, plus information about how and why it is processed, recipients, retention and transfer safeguards.
8.2.2 Right to rectification: If your contact details, job title or other stored information is inaccurate or incomplete, you may ask us to correct it.
8.2.3 Right to erasure (“right to be forgotten”): You may request deletion of your personal data. This right is not absolute: we may refuse deletion if we still need the data to perform a contract, comply with legal retention rules or defend legal claims.
8.2.4 Right to restriction of processing: You may ask us to suspend processing, for example while you contest accuracy of data or assess whether our legitimate interests apply.
8.2.5 Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request your personal data in a structured, commonly used, machine‑readable format for transfer to another controller.
8.2.6 Right to object: You may object to processing based on our legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds which override your rights, or we need it for legal claims. You may object to direct marketing at any time with immediate effect.
8.2.7 Right to withdraw consent: Where you previously gave consent (e.g. newsletter subscription), you may withdraw it any time. Withdrawal does not affect lawfulness of processing carried out before withdrawal.
8.2.8 Right to lodge a complaint: If you believe we have breached GDPR or UK GDPR, you may submit a complaint to the data protection authority in your country of habitual residence (EEA) or the ICO (UK). You may also seek judicial remedy.

We aim to respond to valid requests within one calendar month. Complex requests may be extended by a further two months; we will notify you before the original deadline if an extension is needed. We do not charge fees for reasonable, proportionate requests. We may charge a reasonable administrative fee for excessive, repetitive or copy‑heavy requests.

8.3 Cross‑border transfer safeguards for EEA / UK data
8.3.1 Your personal data will be transferred first from the EEA/UK to the United States (Hostinger hosting), then to our Hong Kong company, and may further transfer to mainland China suppliers.
8.3.2 The United States, Hong Kong and mainland China have no adequacy decision from the European Commission or UK ICO.
8.3.3 In compliance with Schrems II principles, all transfers rely on valid Standard Contractual Clauses (SCCs).
8.3.4 We complete a Transfer Risk Assessment (TRA) covering the full transfer chain before any transfer takes place and only transfer the minimum personal data necessary.
8.3.5 You may email [email protected] to request a copy of the SCCs we use.
8.3.6 We ensure downstream transfers to suppliers, QC providers and logistics partners in mainland China are also protected under SCCs or another permitted safeguard.

8.4 Article 27 Representative
8.4.1 At this stage, we have not appointed an Article 27 representative in the EEA or UK.
8.4.2 We rely on the exemption for occasional, low‑risk processing, no large‑scale systematic monitoring and no special category data.
8.4.3 If our processing activity changes and the exemption no longer applies, we will appoint an Article 27 representative and update this policy.
8.4.4 All GDPR communications and data subject requests are handled directly via our privacy email address.

8.5 Automated decision‑making and profiling
8.5.1 We do not carry out purely automated decision‑making that produces legal or similarly significant effects on you.
8.5.2 Basic analytics tracking does not count as high‑risk automated profiling.

9. Rights under Hong Kong PDPO
9.1 If you are a data subject under Hong Kong PDPO, you have the right to:
9.1.1 Request access to a copy of your personal data held by us;
9.1.2 Request correction of inaccurate personal data;
9.1.3 Request deletion of your personal data where applicable, subject to our legal record‑keeping obligations.
9.2 You may submit PDPO access / correction / deletion requests to [email protected]. We will respond in accordance with PDPO requirements.
9.3 If you are dissatisfied with our handling under PDPO, you may lodge a complaint with the Privacy Commissioner for Personal Data, Hong Kong (PCPD).

10. California Residents – CCPA / CPRA Supplementary Notice
10.1 If you are a natural person resident in California, USA, you have rights under the California Consumer Privacy Act, as amended (CPRA).
10.2 Our website is hosted with Hostinger on servers located in the United States. We do not sell your personal information for valuable consideration, as “sell” is defined under CCPA.
10.3 You have the right to request disclosure of categories of personal data we collect, use and share, and to request deletion of your personal data subject to exceptions.
10.4 To exercise these rights, contact us at [email protected]. We will verify your identity. We will not discriminate against you for exercising CCPA rights.

11. Children
11.1 Our Website and purchasing agency service are intended exclusively for B2B business users.
11.2 We do not knowingly collect personal data from children under the age of 16.
11.3 If you believe we hold personal data belonging to a child, please contact our privacy email immediately and we will delete it.

12. Third‑party links
12.1 Our Website may contain hyperlinks to supplier websites, freight forwarders, payment gateways, social platforms or analytics providers.
12.2 This Privacy Policy applies only to https://chinapurchasingagent.com.
12.3 Once you click away to an external site, that site’s own privacy notice governs your data. We have no responsibility or control over third‑party privacy practices.

13. Marketing communications
13.1 Marketing emails are only sent upon your affirmative, opt‑in consent.
13.2 Each marketing email contains a simple unsubscribe mechanism.
13.3 Unsubscribing from marketing does not stop transactional emails such as quotation notices, order updates, QC reports, invoices and essential service messages.

14. Changes to this Global Privacy Policy
14.1 We may revise this policy from time to time to reflect changes in our service, hosting provider, processor arrangements or legal requirements.
14.2 Revisions will be published on this page with an updated “Last Updated” date.
14.3 Material changes (for example change of hosting provider/region, new purpose of processing or change to cross‑border safeguards) will be highlighted at the top of the page.
14.4 Your continued use of the Website after publication of the revised policy constitutes acceptance of the updated terms.
14.5 For existing active orders, processing will continue consistent with the version of the policy in force when your data was collected unless new law requires otherwise.

15. Contact for privacy matters
15.1 For GDPR, PDPO, CCPA requests, access, rectification, erasure, objection, SCC copies, privacy questions or complaints:
Email: [email protected]
Website: https://chinapurchasingagent.com