01Scope and data controller
This policy applies to ayou.global , its subdomains and company profiles (/enterprise/) and related mobile pages (together, "this site"). This site is operated by Anhui Panwang Information Technology Co., Ltd.(registered in Anhui, China; referred to as "AYOU", "we") operates.
Under EU/EEA and UK law we generally act as the data controller; under China’s PIPL we act as the personal information processor. For listed factories’ independent profiles, the factory may be a joint or independent controller — see the notice on that profile.
Contact Information
- Personal Information Protection Officer:[To be completed]
- Privacy email:privacy@ayou.global(sample address — replace before launch)
- Mailing address: Anhui, China [Full address to be completed]
- EU representative (if applicable, GDPR Art. 27):[To be completed]
- UK representative (if applicable, UK GDPR Art. 27):[To be completed]
We never sell your personal information to any third party.
02What We Collect
2.1 Information You Provide
- RFQ & Contact Details: name, company, country/region, email, phone/WhatsApp, sourcing categories, quantity, target price and message.
- Account & Verification: if you register a buyer account, we may collect login credentials, business qualification documents and verification records.
- Transaction & Fulfillment Data: sample delivery addresses, contract and order information, and necessary contact details in customs and logistics documents.
- Communication Records: emails, on-site messages, live-chat sessions and trade-fair registrations between you and us.
2.2 Information Collected Automatically
- Device & Log Data: IP address (for coarse region detection), browser type and language, OS, screen size, visit time, referring page and error logs.
- Usage Data: pages viewed, time on page, clicks and search keywords, filter selections.Only after you consent to analytics cookiesis reached before data is linked to individuals.
- Cookies & Similar Technologies: see Notis Kuki。
2.3 Information We Do Not Collect
We do not knowingly collect special-category personal information such as race or ethnicity, political opinions, religion, biometrics, health or sexual orientation, and our services are not directed to children under 16. If such information is sent to us by mistake, please notify us for prompt deletion.
03Purposes & Legal Bases
| Purpose | GDPR / UK GDPR Legal Bases | China PIPL Rules |
|---|---|---|
| Answering RFQs, quoting, arranging samples and fulfillment | Contract performance or pre-contract steps (Art. 6(1)(b)) | Necessary to conclude or perform a contract (Art. 13(1)(2)) |
| Account security, anti-fraud, risk control and audit logs | Legitimate interests (Art. 6(1)(f)) | Necessary to comply with law and keep the service secure |
| Sending product and fair updates, industry reports | Consent (Art. 6(1)(a)) or soft-marketing exception for existing customers | Your consent |
| Analytics and site improvement | Consent (non-essential cookies) | Your consent |
| Tax, customs, export control and dispute resolution | Legal obligation (Art. 6(1)(c)) | Necessary to comply with legal duties or obligations |
Where we rely on legitimate interests, we have assessed necessity and ensured your rights and freedoms are not overridden. You may object to direct marketing based on legitimate interests at any time.
06Cross-border Transfers
This site serves global buyers. Personal information may be processed in China and transferred cross-border in these cases:
6.1 From the EU/EEA, UK and Switzerland
Where no adequacy decision applies, we use the European Commission Standard Contractual Clauses (2021/914) and the UK IDTA, together with transfer impact assessments and supplementary measures (encryption, minimisation, access controls).
6.2 From Mainland China
Under PIPL Article 38 we use one of: security assessment, personal information protection certification or standard contracts. Under Article 39 we inform you of the overseas recipient’s name, contact details, purposes and methods of processing, data types and how to exercise your rights, and obtain yourSeparate consent. Where important data or statutory volume thresholds are involved, a security assessment will be filed as required.
6.3 Other Regions
For cross-border mechanisms required in Brazil (LGPD Art. 33), Japan (APPI Art. 28), South Korea (PIPA Art. 28-8) and similar jurisdictions, we follow the applicable rules and keep records.
07Retention Periods
- RFQ & communication records: from last contact — 24 months; transaction records kept per contract and tax requirements 10 years。
- Account data: for the life of the account; deleted or anonymised within 6 months of closure.
- Consent records:180 days, and we re-ask when it expires.
- Server logs:6 months, unless the law requires otherwise.
After expiry we delete or anonymise; where immediate deletion is technically impossible, processing stops except storage and security.
08Your Rights by Region
EU/EEA, UK & Switzerland
You may access, rectify, erase, restrict, object, port your data and withdraw consent at any time, and complain to your local regulator (the ICO in the UK). We respond within 1 month, extendable by two months for complex cases with reasons given.
California, USA (CCPA/CPRA)
You may know the categories and specifics collected and shared, request deletion or correction, opt out of sale or sharing, limit use of sensitive personal information, and be free from discrimination for exercising rights. We do not sell or share personal information for cross-context behavioral advertising. You can Tetapan Kuki submit requests via form or email; we respond within 45 days. Authorized agents may submit on your behalf as legally permitted.
Brazil (LGPD)
You may confirm processing, access, correct, anonymise, block or delete, port data, learn sharing recipients, withdraw consent and complain to ANPD.
Japan (APPI) & South Korea (PIPA)
You may request disclosure, correction, suspension of use or deletion, and records of third-party provision; South Korean users may also request suspension of processing and inspection.
China (PIPL)
You may be informed and decide, access and copy, correct and supplement, delete, withdraw consent, transfer (subject to CAC conditions) and ask us to explain our rules. Close relatives may exercise rights for a deceased person as provided by law.
Other regions
We equally respect rights granted in Vietnam (PDPD), Australia (Privacy Act 1988), Canada (PIPEDA), Singapore (PDPA) and other jurisdictions.
How to Exercise
Email us at privacy@ayou.globalor the footer "Cookie Settings". To protect your information we may verify your identity; we will not deny service or raise prices because you exercise your rights.
09Security & Incident Response
- TLS in transit, encryption at rest, and keys separated from access credentials.
- Role-based least privilege, two-factor authentication and audit logs.
- Vendor security assessments and DPAs; regular vulnerability scans and penetration tests.
- In a personal data breach we notify regulators and affected individuals within legal deadlines (72 hours under GDPR, immediately under PIPL), describing impact and remedies.
10Children’s Privacy
This site serves business procurement and industry professionals, not children under 16. If we learn we collected a child’s data unintentionally, we delete it promptly.
11Policy updates & languages
We may update this policy for legal or business changes; major changes are announced on-site or by email with version and date updated at the top. The Chinese version prevails; translations are for reference only and, in case of ambiguity, the Chinese version governs (except where applicable law requires otherwise).
12Contact & Complaints
For questions, rights requests or complaints about this policy, contact privacy@ayou.global. We give a preliminary reply within 15 working days. If unsatisfied, you may complain to your local data-protection authority; in mainland China, to the cyberspace or market-regulation authorities.