Privacy Policy

This Privacy Policy explains how Fujian New Yifa Group Co., Ltd. ("NewYiFa Group", "we", "us", or "our") collects, uses, discloses, and protects your personal data when you visit https://fjnewyifa.com (the "Site") or interact with our sales, OEM/ODM, and customer-support services. It is written to meet the standards of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA").

1. Introduction

We respect your privacy and are committed to protecting your personal data. This policy tells you what to expect when we collect personal data about you, the legal bases we rely on, and the rights you have. If you have any questions, please contact our Data Protection team using the details in Section 13.

This policy applies to information we collect: (a) on the Site; (b) in email, text, and other electronic messages between you and us; (c) through quote-request, contact, and newsletter forms; and (d) when you engage our sales or OEM/ODM services. It does not apply to data collected by any third party whose sites or services may link to or be accessible from the Site.

2. Who we are (Data Controller)

For the purposes of the GDPR and UK GDPR, the data controller is:

EU/UK Representative. Under Article 27 GDPR, we have appointed an EU/UK representative to act as a point of contact for data-protection authorities and data subjects in the European Economic Area and the United Kingdom. You may contact our representative, and our Data Protection Officer, at the addresses in Section 13.

3. Information we collect

We collect several categories of personal data. "Personal data" means any information relating to an identified or identifiable natural person.

3.1 Information you provide to us

• Identity & contact data: first and last name, job title, company name, business email address, phone number, country, and postal address.
• Inquiry & order data: the content of messages you send through contact forms, quote requests, RFQ submissions, and product inquiries, including specifications, quantities, and target markets.
• Account & transaction data: login credentials, order history, contracts, and (where applicable) billing details processed by our payment providers.
• Marketing preferences: whether you have subscribed to our newsletter and your communication preferences.
• Recruitment data: CVs, cover letters, and related information you submit for employment or partnership opportunities.

3.2 Information we collect automatically

• Technical & device data: IP address, browser type and version, operating system, device identifiers, screen resolution, and language settings.
• Usage data: pages viewed, time spent on pages, referral source, clickstream, and approximate location derived from IP address.
• Cookies & similar technologies: see Section 5.

3.3 Information from third parties

• Business-contact and company data from publicly available sources or trade-show registrations.
• Communications and lead data from platforms such as WhatsApp, Skype, LinkedIn, Alibaba, or Made-in-China where you initiate contact.
• Verification and fraud-prevention data from analytics and security providers.

We do not collect special categories of personal data (such as health, biometric, or religious data) through the Site, except where you voluntarily include such information in a free-text message.

4. How we use your information

We use your personal data only where we have a lawful basis to do so. The table below sets out our purposes and the corresponding legal bases under the GDPR.

Purpose	Examples	Lawful basis (GDPR Art. 6)
Respond to inquiries & provide quotes	Reply to contact/RFQ forms; prepare OEM/ODM quotations	Contract (Art. 6(1)(b)) & legitimate interests (Art. 6(1)(f))
Perform contracts & orders	Production, shipping, invoicing, after-sales support	Contract (Art. 6(1)(b)) & legal obligation (Art. 6(1)(c))
Improve the Site & services	Analytics, performance, UX research	Legitimate interests (Art. 6(1)(f))
Marketing communications	Newsletters, product updates, trade-show invites	Consent (Art. 6(1)(a))
Security, fraud & legal compliance	Login security, abuse prevention, record-keeping	Legal obligation (Art. 6(1)(c)) & legitimate interests (Art. 6(1)(f))

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms and concluded that processing is proportionate. You may object at any time (see Section 9).

Where we rely on consent (e.g. newsletters, non-essential cookies), you may withdraw it at any time without affecting prior lawful processing. We will never make consent a condition of purchasing our products where it is not strictly necessary.

5. Cookies and similar tracking technologies

We use cookies, web beacons, and similar technologies to operate the Site, remember preferences, measure performance, and support live chat. Cookies are small text files placed on your device. We classify them as follows:

Category	Purpose	Can be disabled?
Strictly necessary Always on	Site security, load balancing, session management, cookie-consent record	No — required for the Site to function
Functional Optional	Language, region, and UI preferences; live chat (Tawk.to)	Yes
Analytics Optional	Google Analytics 4 (GA4) — aggregated usage statistics	Yes
Advertising / remarketing Optional	Google Ads, Meta Pixel — measure ad effectiveness	Yes

When you first visit the Site, our cookie banner asks for your consent to non-essential cookies. You can change or withdraw your choice at any time via the "Cookie Settings" link in the footer, or by adjusting your browser settings. Because we do not currently respond to "Do Not Track" (DNT) browser signals uniformly, please use the consent controls provided.

Third-party providers (Google, Meta, Tawk.to) may process data as independent controllers; their processing is governed by their own privacy policies.

6. How we share your information

We do not sell your personal data for money. We share personal data only with the categories of recipients below, under appropriate contracts:

• Service providers: IT hosting, email delivery, CRM, live-chat (Tawk.to), analytics (Google), and customer-support tools.
• Logistics & payment partners: freight forwarders, customs brokers, and payment processors needed to fulfill orders.
• Professional advisers: lawyers, auditors, and insurers where reasonably necessary.
• Authorities: courts, regulators, or law-enforcement agencies where required by law or to protect our rights.
• Corporate transactions: in connection with a merger, acquisition, or asset sale, subject to this policy.

Where a recipient is located outside your jurisdiction, transfers are protected as described in Section 7.

7. International data transfers

NewYiFa Group is based in China. Your personal data may be transferred to, and processed in, China and other countries whose data-protection laws may differ from those in your home country. For transfers of personal data from the EEA or the UK to China (or other third countries), we rely on:

• the European Commission's Standard Contractual Clauses (SCCs) (and the UK International Data Transfer Agreement / Addendum); and
• additional supplemental safeguards such as encryption in transit and at rest, access controls, and pseudonymisation where appropriate.

You may request a copy of the relevant safeguards by contacting us (see Section 13). For transfers to US-based providers (e.g. Google, Meta), we rely on their certified participation in the EU–US Data Privacy Framework where applicable, or on SCCs.

8. Data retention

We keep personal data only for as long as necessary for the purposes set out in this policy, or as required by law:

• Inquiry & quote data: up to 24 months from last contact, unless a contract follows.
• Customer & contract data: for the duration of the relationship plus the statutory limitation period (generally 3–10 years depending on jurisdiction and document type).
• Marketing data: until you withdraw consent or after 24 months of inactivity.
• Analytics & log data: up to 14 months (GA4 default) / 12 months for server logs.

9. Your rights under the GDPR & UK GDPR

If you are in the EEA or the UK, you have the following rights. We will respond within one month (extendable by two further months for complex requests).

• Right to be informed — about how we use your data (this policy).
• Right of access — obtain a copy of your personal data.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten").
• Right to restrict processing — in certain circumstances.
• Right to data portability — receive your data in a structured format.
• Right to object — to processing based on legitimate interests or to direct marketing.
• Rights re automated decisions — not to be subject to solely automated decisions with legal effects.
• Right to withdraw consent — at any time, where processing is based on consent.
• Right to lodge a complaint — with your supervisory authority (e.g. your national DPA, or the UK ICO).

10. Your rights under the CCPA/CPRA (California)

If you are a California resident, you have the following rights regarding your personal information, subject to verification:

Right	What it means
Right to know / access	Request the categories and specific pieces of personal information we collect, use, and disclose.
Right to delete	Request deletion of personal information we collected from you, with certain exceptions.
Right to correct	Request correction of inaccurate personal information.
Right to opt out of sale/share	Direct us not to "sell" or "share" (including cross-context behavioral advertising) your personal information.
Right to limit use of sensitive PI	Limit our use and disclosure of sensitive personal information to permitted purposes.
Right to non-discrimination	We will not discriminate against you for exercising your CCPA rights.

Categories of personal information collected (past 12 months): identifiers (name, email, phone, IP); commercial information (inquiry/order records); internet activity (usage, cookies); professional/employment information; and inferences for marketing. We disclose these to service providers and, for analytics/advertising, to advertising partners (a "share" under CPRA).

We do not "sell" personal information for monetary consideration. However, the use of advertising cookies may constitute a "share" of personal information for cross-context behavioral advertising. You can exercise your opt-out right below.

You may submit a request through an authorized agent with proof of authorization. We will not discriminate against you for exercising these rights.

11. Children's privacy

The Site is a business-to-business site intended for professional buyers and is not directed to children under the age of 16 (or under 13 in the United States). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

12. Data security

We implement appropriate technical and organisational measures to protect your personal data, including: HTTPS/TLS encryption in transit; encryption at rest for stored credentials; role-based access controls; network firewalls; regular security assessments; and staff confidentiality obligations. No method of transmission over the internet is 100% secure, but we work to protect your data and will notify affected users and authorities where the law requires us to report a personal-data breach.

13. Changes to this Privacy Policy

We may update this policy from time to time. Material changes will be posted on this page with a revised "Last updated" date, and, where required, we will notify you by email or through the Site. We encourage you to review this policy periodically.

14. Contact us