Privacy Policy
1. Who we are
The controller of your personal data is [[待填: full legal entity name]] ([[待填: registered address]]), operating the TORQUORA brand (Chinese name: 紧固云). Contact for privacy matters: [[待填: privacy@…]].
For individuals in the EEA or the UK: our representative under Article 27 GDPR / UK GDPR is [[待填: EU/UK representative, if required]]. Data protection officer (if appointed): [[待填]].
2. Scope and eligibility
This policy applies to the Service — the website, the enquiry and quotation flow, the Ora assistant, and documents we create for you such as quotations, order confirmations and contracts. The Service is intended for businesses and is not directed to anyone under 18.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, full name, password (stored only as a salted hash), account role (buyer or supplier), email verification codes | You, when you sign up or sign in |
| Business contact data | Company name, contact person, phone number, business address, tax or registration details you provide | You, in your profile or during an enquiry |
| Enquiry and quotation data | Specifications, drawings, spec sheets, BOMs, sample photos, quantities, delivery requirements, messages you send to Ora | You, through the platform |
| Transaction and document data | Quotations, order and contract records, signature records (signer name, time, method), and bank account details where a contract requires them | Generated in the Service or provided by you |
| Technical data | IP address, device and browser information, timestamps, authentication tokens, security and error logs | Automatically when you use the Service |
| Data stored on your device | Session token, language preference, RFQ list, interface preferences (browser local storage) | Your browser, when you use the Service |
4. Why we process your data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing the Service: accounts, enquiries, quotations, orders, contracts, delivery coordination | Performance of a contract (Art. 6(1)(b) GDPR) |
| Answering your questions and operating the Ora assistant | Contract, or our legitimate interests in responding to business enquiries (Art. 6(1)(f)) |
| Security, fraud prevention, abuse detection, access and audit logs | Legitimate interests (Art. 6(1)(f)) |
| Accounting, invoicing, tax and legally required record keeping | Legal obligation (Art. 6(1)(c)) |
| Improving the Service using aggregated, non-identifying usage statistics | Legitimate interests (Art. 6(1)(f)) |
| Sending you product or service updates by email | Consent, where required (Art. 6(1)(a)) — you can withdraw it at any time |
We do not use your personal data to make automated decisions that produce legal effects concerning you.
5. AI-assisted features (“Ora”)
When you talk to Ora or upload drawings and spec sheets, the content you provide — together with relevant context such as the product category and your previous messages in the same conversation — is processed by third-party AI model providers to parse your requirement, extract specifications and draft a response.
- We use your content to answer your request; we do not use it to train publicly available models.
- Quotations, prices and contract terms are reviewed by our people. Ora drafts and extracts; it does not conclude a contract or set a binding price on its own.
- Please avoid uploading documents that contain personal data unrelated to your enquiry.
6. Who we share data with
We share personal data only as far as necessary, with:
- hosting and infrastructure providers that run the platform;
- object storage and content delivery providers that store the files you upload;
- email delivery providers that send verification codes, quotations and notices;
- AI model providers that process the content described in section 5;
- professional advisers (auditors, lawyers, insurers) when necessary;
- authorities, courts or regulators where the law requires it.
We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
7. Where your data is processed
Our platform and the providers we use are primarily located in [[待填: confirm hosting regions]]. This may involve transferring personal data outside the EEA or the UK (including to China). Where we do so, we rely on appropriate safeguards — standard contractual clauses approved by the European Commission and, where required, the UK Addendum — together with a transfer risk assessment. You can request a copy of the safeguards by contacting us.
8. How long we keep data
- Account data: while your account is active, then [[待填: period]] months.
- Enquiries, quotations, orders and contracts: [[待填: period]] years, to meet contractual and tax obligations.
- Uploaded files: [[待填: period]], unless they are part of a contract record.
- Security and access logs: [[待填: period]].
We delete or anonymise data when it is no longer needed, unless retention is required by law.
9. Your rights (EEA and UK)
You have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have data erased where the law allows it;
- restrict or object to processing;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting processing already carried out;
- lodge a complaint with your supervisory authority (in the UK, the Information Commissioner’s Office).
To exercise these rights, email [[待填: privacy@…]]. We respond within one month.
10. US state privacy rights
If you are a resident of a US state with a comprehensive privacy law (for example California, Colorado, Connecticut, Utah or Virginia), you may have the right to know what personal information we collect, to access and obtain a copy, to delete it, to correct inaccuracies, to opt out of the sale or sharing of personal information (we do not sell or share it for cross-context behavioural advertising), to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. You may also use an authorised agent. To exercise a right, contact [[待填: privacy@…]].
11. Cookies and local storage
We use only what is necessary to run the Service. We do not use advertising or cross-site tracking cookies. Specifically, your browser stores: an authentication token (to keep you signed in), your language preference, your RFQ list, and interface preferences. Clearing your browser storage signs you out and resets these preferences. If we introduce analytics or other non-essential cookies, we will obtain consent where required.
12. Security
We protect personal data with encryption in transit, salted password hashing, access control on a least-privilege basis, audit logging and backups. No system is completely secure; if a breach affects your rights, we will notify you and the competent authority as required by law.
13. Children
The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.
14. Changes to this policy
We may update this policy as the Service evolves. We will post the new version here and, for material changes, notify you by email or in the Service.
15. Contact
Questions, requests or complaints: [[待填: privacy@…]], [[待填: postal address]]. EEA/UK representative: [[待填]].