Privacy Policy

This Privacy Policy describes how Wuxi Hannah Technology Co., Ltd ("we", "us", or "our") collects, uses, and protects your personal information when you visit hannahiron.com (the "Site") or engage with our business-to-business (B2B) manufacturing and export services.

1. Introduction

We are committed to protecting your privacy. This Privacy Policy explains what data we collect, why we collect it, how we use it, and what rights you have over your data. By using our Site, you agree to the practices described in this policy.

Primary compliance basis: This policy is designed to comply with the EU General Data Protection Regulation (GDPR) and the UK GDPR, as our Site serves business customers primarily located in the European Economic Area, the United Kingdom, and other overseas B2B markets. We also observe the basic requirements of the Personal Information Protection Law of the People's Republic of China (PIPL) as a principle of good practice.

Note: Our Site does not require account registration. All visitors are anonymous by default, unless they voluntarily submit an inquiry or order form.

2. Information We Collect

We collect the following categories of personal information:

2.1 Information You Provide Directly

• Inquiry form data: name, email address, phone number, company name, country, and the content of your message when you submit a quote request or product inquiry.
• Business correspondence: any information you share via email, WeChat, or other communication channels during sales, production, or after-sales discussions.

2.2 Information Collected Automatically

• Technical data: IP address, browser type and version, operating system, device type, screen resolution, referring URL, and pages visited.
• Usage data: time spent on each page, click patterns, and navigation flow.
• Cookie data: see Section 5 for details on cookies and similar tracking technologies.

2.3 Information from Third Parties

• Shipping and logistics partners: tracking updates and delivery status for orders you have placed with us.
• Manual business verification: We may, on occasion, manually cross-check publicly available business registration information (such as the company name, registration number, or registered address shown in a public commercial registry) solely to verify the legitimacy of a corporate inquiry. This is performed on a case-by-case basis — we do not automatically scrape or store entire registration databases.

3. How We Use Your Information

We use your personal data for the following purposes:

1. Responding to your initial contact: To reply to your quote requests, product inquiries, sample requests, technical questions, and order-related communications.
2. Order fulfillment: To process purchase orders, arrange production, coordinate shipping, and provide after-sales support.
3. Improving our Site: To analyze how visitors use our Site so we can enhance content, layout, and user experience.
4. Marketing communications: To send you product updates, trade-show invitations, and industry insights — but only if you have explicitly opted in. You may unsubscribe at any time.
5. Legal compliance: To comply with applicable export control, customs, tax, and anti-fraud regulations.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

4. Legal Basis for Processing (GDPR)

If you are located in the EEA or UK, we process your personal data under the following legal bases as defined by Article 6 of the GDPR:

• Consent (Art. 6(1)(a)): For marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Contract (Art. 6(1)(b)): To take steps at your request prior to entering into a contract, and to perform our obligations under purchase agreements.
• Legitimate interests (Art. 6(1)(f)): To respond to your initial contact, prevent fraud, secure our Site, and improve our services — provided that your interests and fundamental rights do not override those interests.
• Legal obligation (Art. 6(1)(c)): To comply with export control, customs, tax, and accounting laws applicable to our business.

5. Cookies and Tracking Technologies

Our Site uses cookies and similar technologies (web beacons, local storage) to enable core functions, remember preferences, and analyze traffic.

For full details on which specific cookies and tracking technologies we use (including Google Tag Manager, Google Analytics 4, and functional cookies), how they work, and how to manage them, please see the "Cookies & Tracking Technologies" section below on this page.

You can manage or disable cookies at any time through your browser's settings. Please note that disabling certain cookies may affect the functionality of the Site.

6. Data Sharing and Third Parties

We share your personal data only with the following categories of recipients, and only the minimum information necessary for the stated purpose:

• Shipping and freight forwarders (e.g., DHL, FedEx, COSCO, Maersk) — to deliver your orders.
• Payment processors — to process invoices and remittances (typically bank wire transfer for B2B; we do not store credit card numbers on our servers).
• Email and CRM service providers (e.g., Resend, Airtable) — to send inquiry responses and maintain our customer relationship database.
• Analytics providers (Google Analytics 4) — to understand Site usage in aggregate.
• Legal and tax advisors — when required for compliance or dispute resolution.

All third-party processors are contractually obligated to protect your data in accordance with applicable data protection laws.

7. International Data Transfers

As a China-based manufacturer serving global B2B clients, your personal data may be transferred to and processed outside of your home country.

Where your data is stored and processed: Inquiry form submissions, business correspondence, and related records are stored on our servers and on servers operated by our designated service providers, which may be located in the People's Republic of China, the United States, the European Union, or other regions where those providers operate.

How we protect your data in transit: We take appropriate technical and organizational measures to protect your data during international transfer and storage, including encryption in transit (HTTPS / TLS 1.2+) and access controls limiting who at our company and at our service providers can view your data. For details on the specific safeguards we apply or to request a written summary, please contact us in writing using the details in Section 15.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. Specifically:

• Server access logs: Retained for 30 days for security monitoring, intrusion detection, and troubleshooting.
• Inquiry and quote data: Retained for 3 years from the last interaction, to support re-ordering, warranty claims, and product traceability.
• Order and production records: Retained for 7 years after order completion, as required by Chinese commercial and tax law.
• Marketing subscription data: Retained until you unsubscribe, plus a short grace period (30 days) for system processing.
• Analytics data: Google Analytics 4 data is retained for 2 months, after which it is automatically aggregated and deleted per our GA4 configuration.

When data is no longer needed, we securely delete or anonymize it.

9. Your Rights Under GDPR

If you are located in the EEA, UK, or other jurisdictions with similar rights, you have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your data, subject to legal retention obligations.
• Right to restrict processing (Art. 18): Ask us to limit how we use your data.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent.
• Right to lodge a complaint (Art. 77): With your local data protection authority.

How to exercise your rights:

Because our Site does not require account registration, we do not perform user identity verification. To exercise any of the rights above, simply contact us using the details in Section 15 and provide the email address you used when submitting your inquiry — we will use this as the "submission credential" to locate your data in our system. No separate identity verification (such as uploading a government-issued ID) is required for the exercise of basic rights over your own submitted data.

(For reference: our internal inquiry records are stored in Airtable with a unique inquiry ID per submission. This ID is used for our internal duplicate-detection and record-uniqueness purpose; it is not a user identity credential.)

Fees: Most rights requests are processed free of charge. We may charge a reasonable fee, or refuse to act on requests that are manifestly unfounded, excessive, or repetitive, in accordance with GDPR Article 12(5).

Limits due to legal retention obligations: Some of your rights — particularly the right to erasure (Art. 17) and the right to restrict processing (Art. 18) — may be limited where we have a legal obligation to retain certain data (for example, order and production records retained for 7 years under Chinese tax law, as described in Section 8).

Right to lodge a complaint with a supervisory authority: In addition to contacting us, you have the right to lodge a complaint with your local data protection authority. For EU residents, a list of national supervisory authorities is available from the European Data Protection Board (edpb.europa.eu). UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.

We will acknowledge your request within 5 business days and respond substantively within 30 days as required by GDPR Article 12(3).

10. Automated Decision-Making and Profiling

We do not use your personal data for any automated decision-making, including profiling, that produces legal effects or similarly significantly affects you. All decisions regarding your inquiries, quotes, orders, and business relationship are made by our staff.

11. Children's Privacy

Our Site and services are intended for business professionals and are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately so we can delete the information.

12. Security Measures

We implement basic web security measures to protect personal data submitted through our Site. These measures apply to the categories of data described in this policy (inquiry form submissions, business correspondence, and Site usage data) and include:

• Encryption in transit: All Site traffic is served over HTTPS (TLS 1.2+).
• Anti-bot protection: Our contact form includes honeypot fields, submission timing checks, IP rate limiting, and content-based spam detection.
• Access control: Personal data is accessible only to authorized employees on a need-to-know basis.

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of data during transmission or storage.

13. Third-Party Links

Our Site may contain links to third-party websites (e.g., shipping tracking pages, industry publications, social media). We are not responsible for the privacy practices of those sites. We encourage you to read the privacy policies of every site that collects your personal data.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. The "Last Updated" date at the top of this policy indicates when the latest revisions took effect.

For active customers who have provided their email address, we will notify material changes by email before the revised policy takes effect. For other visitors, the updated policy will simply be posted on this page; please review it periodically.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or need to contact our data protection point of contact, please reach out to us:

Wuxi Hannah Technology Co., Ltd
Address: No.4 Building, No. 117 Meiyu Road, Xinwu District, Wuxi City, China
Email: vicky@hannahtec.com
Phone: (+86) 137 7100 1475

We will acknowledge your request within 5 business days and respond substantively within 30 days as required by GDPR.

End of Privacy Policy