1. Scope and meaning
This Cookie Policy applies to the ZHENFEI website and its account, inquiry, download and customer-support functions. It should be read together with the Privacy Statement.
Cookies are small values stored by a browser. This policy also covers similar browser storage, such as localStorage, where the website keeps a user choice, an inquiry cart, favourites or an anonymous support-session credential.
2. Your choices
Strictly necessary technologies are used to provide a feature requested by the visitor or to secure website requests. They are not disabled through the analytics preference panel because account login, request protection and support features may otherwise stop working.
Google Analytics 4 is optional. The Google Analytics script is not requested and analytics storage is not enabled until the visitor actively accepts analytics. Rejecting analytics does not prevent access to the website. A visitor can change or withdraw the choice at any time through Cookie Settings in the footer.
3. Strictly necessary cookies and local storage
| Name | Type and provider | Purpose | Current duration |
|---|---|---|---|
| ZFSESSION | First-party, server session cookie | Keeps a signed-in member session. It is HttpOnly and configured as SameSite=Lax; production deployment requires Secure over HTTPS. | 30 minutes of inactivity by default; up to 30 days only when Remember Me is selected. Deployment values may be changed. |
| XSRF-TOKEN | First-party security cookie | Provides the CSRF token that protects state-changing account, inquiry, contact and chat requests. | Browser session or the lifetime set by the security framework. |
| wlab.analytics.consent | First-party localStorage | Remembers whether analytics was accepted or rejected and the consent-policy version. | Until the choice is changed, browser storage is cleared, or the consent version is increased. |
| zhenfei.support-chat and zhenfei.support-chat.history | First-party localStorage | Keeps the current anonymous support credential and up to 20 archived anonymous conversation credentials so chat history can be restored or claimed after login. | Until the conversation credential is removed, the member logs out, or browser storage is cleared. |
| zhenfei.quote-cart.v1 | First-party localStorage | Keeps products, quantities and notes added to an inquiry cart before submission. | Until the cart is submitted or cleared, or browser storage is cleared. |
| zhenfei.favorite-guest.v1 and related favourite keys | First-party localStorage | Keeps guest favourites and synchronisation state. Signed-in favourites are also stored in the website account service. | Until an item is removed, the account state is synchronised, or browser storage is cleared. |
4. Google Analytics 4
If the visitor accepts analytics and the production site has a valid GA4 Measurement ID, the website loads Google Analytics to produce basic statistics such as page views, device information and approximate region. Advertising storage, advertising user data and advertising personalisation remain disabled by this implementation.
Google may set first-party identifiers such as _ga and _ga_<measurement-id>. [TO BE COMPLETED BEFORE PRODUCTION: list the final cookie names, purposes and expiration periods shown by the production GA4 property, and identify the applicable Google legal entity and data-transfer information.]
5. Third parties and international transfers
Necessary website requests may pass through the selected hosting or CDN provider. Analytics data is sent to Google only after consent. [TO BE COMPLETED BEFORE PRODUCTION: identify the production hosting/CDN providers, Google contracting entity, processing locations and applicable data-transfer safeguards.]
6. Managing browser storage
- Use Cookie Settings in the footer to accept, reject or withdraw analytics consent.
- Use browser settings to inspect or delete cookies and local storage. Deleting necessary storage may sign the member out, clear the inquiry cart or favourites, or make anonymous support history unavailable on that browser.
- Blocking Google domains does not affect core website access, but analytics will not be recorded.
7. Updates and contact
This policy may be updated when the website, providers or retention settings change. A material change to analytics processing may cause the website to ask for a new choice.
Questions about cookies or privacy may be sent to [PRIVACY EMAIL TO BE COMPLETED BEFORE PRODUCTION].