Items requiring operator or legal confirmation
This statement reflects the current software and data flow. The website operator remains responsible for confirming legal bases, suppliers, data locations and retention periods before production publication.
- Controller's full legal name, registration number, registered address, privacy email and responsible contact.
- Production hosting, CDN, database, backup, SMTP and Google contracting entities and processing locations.
- Final legal basis and retention period for each processing purpose.
- Applicable international-transfer safeguard, EU representative and supervisory-authority details.
- Effective date, approved policy version and language-precedence rule.
1. Controller and contact
This website operates under the ZHENFEI brand. The controller that decides why and how website personal data is processed is [FULL LEGAL NAME TO BE COMPLETED BEFORE PRODUCTION], registered at [REGISTERED ADDRESS], company/registration number [NUMBER].
Privacy requests may be sent to [PRIVACY EMAIL]. If an EU representative is required, its name, address and contact details will be stated here: [EU REPRESENTATIVE OR CONFIRMED NOT APPLICABLE].
2. Scope
This statement applies to the public ZHENFEI website, member functions, contact forms, inquiry and quotation functions, customer-support chat, chat attachments, authorised downloads and optional Google Analytics. It does not govern a third-party website reached through an external link.
3. Personal data we collect
- Account and profile data: first name, last name, company, email, phone, country/region, city, preferred contact method, products of interest, registration status and account timestamps. Passwords are stored only as secure hashes, not as readable passwords.
- Contact requests: contact details, selected products of interest, project details or questions, preferred contact method, submission status and staff notes.
- Inquiries and quotations: product codes and snapshots, quantity, member notes, request status, currency, quoted line-item prices, assigned staff identity, status history and notification records.
- Favourites: product code and limited display snapshots synchronised to a signed-in member account.
- Support chat: anonymous or member conversation identifiers, text messages, image or PDF attachments, language, source page, timestamps, delivery/read state and support handling information.
- Downloads: resource identifier, public or member access decision, member identifier where login is required, request time, result and basic audit information.
- Security and technical data: IP address, user agent, request time, server logs, session and CSRF identifiers, rate-limit and authentication events needed to secure the service.
- Analytics data: after consent only, GA4 may collect page interaction, device/browser information, identifiers and approximate region according to the final GA4 configuration.
4. Purposes and legal bases
| Purpose | Current processing | Legal basis to be confirmed |
|---|---|---|
| Accounts and authentication | Register, activate or approve accounts; authenticate members; reset passwords; maintain profiles and protect sessions. | Performance of requested account services and legitimate interests in security; [FINAL BASIS TO BE CONFIRMED]. |
| Contact, inquiry and quotation | Respond to product interest, prepare and manage preliminary quotations, assign staff and continue requested business communication. | Steps requested before a possible contract and/or legitimate interests in responding to business requests; [FINAL BASIS TO BE CONFIRMED]. |
| Customer support | Provide automated and live support, retain conversation continuity and handle image/PDF attachments. | Requested service and legitimate interests in customer support; [FINAL BASIS TO BE CONFIRMED]. |
| Downloads | Deliver public or login-protected resources and keep access/security records. | Requested service and legitimate interests in access control and security; [FINAL BASIS TO BE CONFIRMED]. |
| Security and legal compliance | Prevent abuse, investigate incidents, preserve necessary logs and respond to lawful requests. | Legitimate interests and applicable legal obligations; [FINAL BASIS TO BE CONFIRMED]. |
| GA4 analytics | Measure basic website use and approximate audience distribution. | Consent. GA4 remains disabled before consent and rejection does not affect core functions. |
5. Whether data is required
Fields marked as required are needed to create an account, submit a contact request, send an inquiry, access a protected download or operate the requested support function. Without those fields, the relevant request may not be processed. Optional profile, interest and preferred-contact fields may be omitted unless the interface states otherwise.
GA4 consent is optional. The website remains accessible when analytics is rejected.
6. Recipients and service providers
- Authorised ZHENFEI sales, customer-support, administration and technical personnel who require access for their role.
- The selected hosting, CDN, database, backup and network providers.
- The configured SMTP/email provider for activation, password reset, account review and quotation notifications.
- Google for GA4 only after consent.
- Professional advisers, authorities or other recipients where disclosure is required by law or needed to establish, exercise or defend legal claims.
- [TO BE COMPLETED BEFORE PRODUCTION: provider legal names, countries, sub-processors and links to applicable privacy/DPA terms.]
7. International data transfers
The website serves a global market and may be operated by authorised staff in China. Depending on the selected source server, CDN, SMTP, analytics and support arrangements, personal data may be stored in or accessed from countries outside the visitor's country and outside the European Economic Area.
[TO BE COMPLETED BEFORE PRODUCTION: identify the source-server and database country, Chinese administrative access, each relevant transfer recipient, adequacy decision or contractual safeguard such as applicable Standard Contractual Clauses, and how a copy or further information can be requested.]
8. Retention
| Data | Current technical setting or required decision |
|---|---|
| Normal member session | 30 minutes of inactivity by default. |
| Remember Me session | Up to 30 days by default when selected. |
| Anonymous chat attachments | 180 days by default, configurable at deployment. |
| Member chat attachments | 365 days by default, configurable at deployment. |
| Account and profile | [RETENTION AFTER ACCOUNT CLOSURE TO BE COMPLETED BEFORE PRODUCTION]. |
| Contact inquiries | [RETENTION TO BE COMPLETED BEFORE PRODUCTION]. |
| Inquiry and quotation records | [RETENTION TO BE COMPLETED BEFORE PRODUCTION, considering business and legal record needs]. |
| Chat messages and conversation metadata | [RETENTION TO BE COMPLETED BEFORE PRODUCTION]. |
| Download and security logs | [RETENTION TO BE COMPLETED BEFORE PRODUCTION]. |
| GA4 | [RETENTION TO BE COMPLETED AFTER THE PRODUCTION GA4 PROPERTY IS CONFIGURED]. |
9. Your rights
Subject to applicable law, a person may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting processing already carried out before withdrawal. Some rights depend on the legal basis and may be limited where data must be retained for legal claims, security or another lawful obligation.
Requests may be sent to [PRIVACY EMAIL]. The operator may request information needed to verify identity. A person may also lodge a complaint with the competent data-protection authority. [TO BE COMPLETED BEFORE PRODUCTION: lead or representative authority details where applicable.]
10. Security
Current safeguards include BCrypt password hashing, server-side sessions, HttpOnly and SameSite cookies, CSRF protection, production Secure cookies over HTTPS, service-token protection for administrative APIs, role-based internal administration, signed short-lived attachment URLs, access checks for protected downloads, request logging and configurable rate limits.
No system can guarantee absolute security. The operator maintains reasonable organisational measures, access control, backup and incident procedures appropriate to the production deployment. [TO BE COMPLETED BEFORE PRODUCTION: backup location, access-review owner and incident contact.]
11. Automated replies and decisions
The support function may match configured keywords to send an automated informational reply. It does not make a legal or similarly significant decision about the visitor. Account review, product quotation and final business decisions are handled by authorised staff under the current system.
12. Children
The website is intended for business and product inquiries and is not directed to children. Product references to child safety describe product categories and do not mean the service is intended to collect children's personal data. Please do not submit a child's personal data through an account, form or chat.
13. Changes to this statement
The operator may update this statement when website functions, providers, processing purposes or legal requirements change. The current version and effective date will be published here. Where required, a material change will be communicated or a new analytics choice will be requested.