Privacy Policy
GDPR and UK GDPR · Applies to zhixiaoyi.com and enquiries that arrive through it
ZXY Sourcing holds two kinds of data: what you type into an enquiry form, and what the server records when a page is requested. We do not sell it, we do not build advertising profiles from it, and nothing that identifies you is stored in your browser until you agree to it. Below is each item, why it exists, who processes it, where it goes, how long it stays and how to have it removed.
Who is responsible for your data
This is a business-to-business supplier site. It is not directed at consumers and we do not knowingly collect data from anyone under 16. If you believe a minor has sent us an enquiry, write to the address above and we will delete it.
The controller is ZXY Sourcing, a pet product supply chain business operating from Shenzhen, Guangdong, China. One contact handles everything in this policy, including data requests and objections: [email protected]. WhatsApp and telephone on +86 132 6709 1606 reach the same team.
We answer data requests within 30 days. If a request is unusually broad we will say so within that period, tell you what we need, and give you a date for the rest. Making a request is free.
What this policy covers
It covers zhixiaoyi.com, the enquiry forms on this site, and correspondence that starts here and continues over email or WhatsApp. It does not cover third-party sites we link to, and it does not replace a supply contract: once an order is placed, the data in invoices, packing lists and shipping documents is governed by that contract and by the record-keeping law that applies to it.
What we collect, and how it reaches us
We collect the minimum needed to answer a sourcing question. There is no checkout on this site, so no payment card data is ever entered here, and there are no user accounts.
| Data | What it includes | How it arrives |
|---|---|---|
| Enquiry details | Name, company, email, telephone or WhatsApp number, destination market | The enquiry form on this site |
| Requirement | The products, quantities, target price and certifications you describe | Same form, or a specification attached to a follow-up email |
| Page context | The URL you were reading when you submitted, so we know which category the enquiry refers to | Sent with the form automatically |
| Consent record | Your cookie choice, the policy version it was made against, and the time it was made | Set by your browser after you choose |
| Technical log | IP address, browser user agent, requested URL, time, response code | Written by the web server on every request |
| Analytics | Pages viewed, approximate location from a shortened IP, device type, referring site | Google Analytics 4, and only after you accept analytics |
Why we process it, and on what legal basis
Every purpose below maps to a lawful basis under Article 6 of the GDPR. Where the basis is legitimate interests, we have weighed the interest against your rights: the processing is limited to business contact data you sent us, it is not used to build a profile, and an objection ends it immediately.
| Purpose | Data used | Legal basis |
|---|---|---|
| Answering a quotation or sourcing request | Enquiry details, requirement, page context | Art. 6(1)(b) — steps taken at your request before a contract |
| Replying to a general question that is not yet a quotation | Enquiry details and message | Art. 6(1)(f) — legitimate interest in answering business enquiries |
| Keeping sales, invoice and export records | Enquiry and order records | Art. 6(1)(c) — legal obligation under tax and customs law |
| Keeping the site available and free of spam | Technical log | Art. 6(1)(f) — legitimate interest in security and availability |
| Measuring which pages are useful | Analytics data | Art. 6(1)(a) — consent, given through the cookie dialog |
| Following up with a business contact who has already enquired | Email address, enquiry history | Art. 6(1)(f) — legitimate interest, with an opt-out in every message |
Cookies and similar technologies
The site sets a cookie only after you have answered the consent dialog, with one exception: strictly necessary cookies, which keep the site working and remember your answer. Analytics is off until you accept it. There is no advertising pixel, no social login and no cross-site tracking.
The dialog appears once per browser and remembers your answer for twelve months against the policy version shown at the top of this page. When the version changes, everyone is asked again.
- ›Change or withdraw your choice at any time from Cookie settings in the footer of any page. Withdrawing does not restrict what you can read or ask for.
- ›If your browser sends Global Privacy Control, non-essential cookies stay off until you switch them on explicitly, even if an older choice says otherwise.
- ›Clearing site data in your browser also clears the record, and the dialog will appear again on your next visit.
- ›We do not honour the older Do Not Track header, because it has no agreed meaning and is sent by browsers that would otherwise be tracked. Global Privacy Control is the signal we act on.
| Category | Cookies | What it does | When it is set |
|---|---|---|---|
| Strictly necessary | zxy_consent, wordpress_test_cookie, wp-settings-* | Remembers your cookie choice, verifies that your browser accepts cookies, keeps an admin session if you log in | Always. These cannot be switched off |
| Analytics | _ga, _ga_FLE5HW184W | Tells us which pages and countries the site is used from, in aggregate, so we can fix what people cannot find | Only after you accept analytics |
| Preferences and embedded content | None set today | Controls third-party frames such as the map on the contact page, and remembers layout choices if we add them | Only after you accept preferences |
| Marketing | None | Advertising and retargeting. We do not run advertising at the moment, so this category is empty | Never, until a campaign exists and you accept it |
Embedded content and links to other services
The contact page shows a map from OpenStreetMap. The frame is not loaded until you accept the preferences category, because loading it would tell a third party your IP address and the page you are on. If you decline, the page shows a static link that opens the map in a new tab instead.
WhatsApp, WeChat, email and telephone links take you to services we do not control. Once you are there, the privacy policy of that service applies, and the provider may see more about you than we do. Enquiries that start on WhatsApp reach us as ordinary WhatsApp messages.
Who else sees your data
We do not sell personal data. We do not share it with advertising networks or data brokers, and we do not add your address to a mailing list you did not ask for.
We share data with the processors below because the service cannot run without them, and with nobody else unless the law requires it. Each processor is bound to use the data only for the purpose we gave it.
| Recipient | Role | What they can see |
|---|---|---|
| Google (Google Ireland Ltd, Google LLC) | Analytics processor | Page views, device and browser type, shortened IP, referring site. Only after you accept analytics |
| Our email provider | Email processor | The content of enquiry notification emails, including your name and address |
| Our hosting provider | Hosting processor | Everything stored on the site, including enquiry records, and the server logs |
| Freight forwarder and customs broker | Separate controller, when an order proceeds | Name, address and commercial invoice data, for export clearance |
| Professional advisers and auditors | Separate controller, when required | Only the records relevant to a dispute, audit or legal obligation |
Where your data is stored
The site and its database run on a server we control, and enquiry notifications are relayed through a mailbox. Analytics data, if you accept it, is processed by Google in the United States and the European Union.
Where data moves from the European Economic Area or the United Kingdom to China, we rely on the Standard Contractual Clauses (2021/914) with the processor, or — for an enquiry you have sent us — on Article 49(1)(b), because the transfer is necessary to take the steps you asked for before a contract. You can ask for a copy of the safeguards that apply to your data.
How long we keep it
Nothing is kept because it might be useful one day. Each record has a period, and it is deleted or anonymised when the period ends.
| Record | Kept for | Why |
|---|---|---|
| Enquiry that did not become an order | 24 months from last contact | So a returning buyer does not have to describe the same requirement again |
| Enquiry and order correspondence in the sales mailbox | Up to 3 years | Disputes about specifications, certification and delivery |
| Invoices, packing lists, export and customs documents | Up to 10 years | Tax and customs record-keeping obligations |
| Server logs | 30 days | Security investigation and traffic diagnosis |
| Analytics data | 14 months | The retention setting on the analytics property |
| Cookie consent record | 12 months, then asked again | So a stale choice cannot stand in for a current one |
Backups are rotated on a 30-day cycle, so a deleted record can persist in a backup for up to 30 days after deletion and no longer.
Your rights
If you are in the European Economic Area, the United Kingdom, Switzerland or a jurisdiction with comparable law, you have the rights below. We apply them to everyone who asks, wherever they are, because the cost of doing so is small.
- ›Access: a copy of the data we hold about you, and an explanation of what we do with it.
- ›Rectification: correction of anything wrong, including a misspelled company name or a wrong product reference.
- ›Erasure: deletion of an enquiry and its correspondence, except what we must keep for invoices or a live dispute.
- ›Restriction: we keep the data but stop using it, for example while a correction is checked.
- ›Portability: the data you gave us, in a structured machine-readable file, sent to you or to another controller.
- ›Objection: an end to processing based on legitimate interests, including direct follow-up about a previous enquiry.
- ›Withdrawal of consent: at any time, for analytics and preferences, without affecting anything done before the withdrawal.
To exercise any of them, email [email protected] with the words Data request in the subject line and tell us which enquiry or email address the request concerns. We reply within 30 days. We may ask for one piece of evidence that the address belongs to you, but we will not ask for identity documents for a routine request.
Withdrawing consent and objecting
Withdrawing analytics consent stops the measurement immediately: the consent signal is updated, the analytics cookies are deleted, and no further page views are recorded for that browser. The site keeps working, with no reduction in what you can read or ask for.
If you object to follow-up about an earlier enquiry, we stop it and keep only the record needed for accounting. We will not treat an objection as a reason to refuse a quotation.
How we protect the data
The site is served over HTTPS with HSTS, so the connection cannot be downgraded. Administrative access to the server is restricted to named accounts with key-based authentication, kept separate from the public site. The database is not exposed to the internet. Enquiry records are readable only by the sales team, on a need-to-know basis.
No payment data is stored, because there is no checkout. If you send a bank letter or a tax number by email, it is handled as commercial correspondence and kept with the order file, not in the website database.
Automated decisions, profiling and children
We do not make automated decisions that produce legal effects, and we do not profile visitors. Analytics is aggregate reporting: it does not identify you and is not used to score or segment individuals.
This site is not intended for children and we do not knowingly process their data. If a minor has sent an enquiry, tell us and it will be deleted without further questions.
Changes to this policy
The version and the date sit at the top of this page. When the categories, the processors or the retention periods change, the version is raised, and the cookie dialog asks everyone again on their next visit. We do not widen what we do with existing data without telling you first.
How to contact us, and how to complain
Write to [email protected], message +86 132 6709 1606 on WhatsApp, or use the form on the contact page.
If you believe we have handled your data badly, you can complain to the supervisory authority where you live, where you work, or where the alleged infringement happened — the ICO in the United Kingdom, your national authority in the European Union. We would rather you came to us first: most problems are a misrouted email and are fixed the same day.
Frequently asked questions
Does ZXY Sourcing sell or share my data with advertisers? +
No. We do not sell personal data, we do not share it with advertising networks or data brokers, and there is no advertising pixel on this site. The only third parties that see data are the analytics provider (only if you accept it), the email provider and the hosting provider.
Do you set cookies before I agree? +
No. The analytics tag is not loaded and the Google script is not requested until you accept analytics. Before you choose, the site sets only the cookie that stores your choice, plus the standard WordPress test cookie when you submit a form. You can confirm this in your browser developer tools under the Network tab.
How do I have an enquiry deleted? +
Email [email protected] with Data request in the subject and the address you used. We delete the enquiry and its correspondence within 30 days, except what must be kept for invoices, customs or a live dispute, and we tell you which parts those are.
Can I use the site without accepting cookies? +
Yes. Rejecting non-essential cookies removes nothing: every product page, guide and form stays available. The only difference is that the map on the contact page is shown as a link instead of an embedded frame.
Where is my data stored? +
The website database and the sales mailbox are on infrastructure we control. Analytics data, if you accept it, is processed by Google in the United States and the European Union. Transfers out of the EEA rely on the Standard Contractual Clauses or on Article 49(1)(b) for an enquiry you sent us.
Are WhatsApp messages covered by this policy? +
Only in part. A message you send us on WhatsApp is delivered by Meta under its own privacy policy, and we receive the message content and your phone number. What we then do with that content is covered here.
How long do you keep a quotation request? +
An enquiry that does not become an order is kept for 24 months from the last contact, so a returning buyer does not have to resend the same requirement. If an order follows, the invoice and export documents are kept for up to 10 years because tax and customs law requires it.
A question about this page
Data requests, corrections, trademark enquiries and copyright complaints all go to the same place, and are answered within 30 days — usually within two working days.