Last updated: 26 July 2026
Who controls your data
Wuxi Hechuang Stainless Steel Co., Ltd., which operates the Hechuang Stainless Steel brand, is the data controller for the personal data described in this notice.
No. 123, Beihuan Road, Xishan District, Wuxi, Jiangsu, ChinaEmail: info@hechuangss.com
Hechuang has appointed no data protection officer and no EU representative. The email address above is the contact route for every privacy question or request.
What information we handle
Required for the web form
Your name, email address and phone number. Providing these details is not a statutory requirement. They are not required by an existing contract, and you are not legally obliged to provide them. They are required only if you choose to submit the web RFQ form, because we need them to identify you, answer the inquiry and take the pre-contractual steps you request. Without them, you cannot submit the web RFQ form. You can instead contact us directly by email or WhatsApp.
Optional information
Your company, country, product requirement and message. You may also add optional attachments, such as relevant drawings, specifications, spreadsheets and images. Attachments are optional RFQ technical and business data. These details help us understand the commercial and technical context, but the web form does not require them.
The form also sends its English locale, page URL and RFQ trigger so we can understand where the inquiry began. Website and delivery services may handle technical data such as your IP address, request time, Cloudflare Turnstile verification data and email-delivery logs. A successful submission also receives an RFQ reference.
Please send only information relevant to the inquiry. Do not include passwords, payment-card details or unrelated sensitive personal information.
Why we use it and our legal bases
Reviewing and answering your request
We assess the requirement, check possible supply routes, communicate with you and prepare a requested quotation.
Legal basis: steps at your request before entering into a contract.
Protecting the inquiry route and following up
We use limited technical and contact data for website security, anti-spam controls and reasonable business-to-business follow-up about the inquiry you made.
Legal basis: our legitimate interests in operating a secure inquiry channel, preventing abuse and responding effectively to genuine business requests. You may object to processing based on legitimate interests as explained below.
Managing a successful deal
If the inquiry becomes an order, separate customer, contract, transaction and project records may be used to perform the contract and meet applicable finance, tax and legal duties.
Legal bases: performance of the contract and compliance with applicable legal obligations.
Who receives the information
People supporting the inquiry
- The Hechuang Stainless Steel Sales Team, which receives and coordinates the inquiry.
- Only the necessary Kongfang Metal technical, quality and logistics personnel when their input is needed to assess material, inspection, processing or delivery requirements.
Service-provider categories
- Cloudflare, for website delivery, security, Turnstile anti-spam checks and private Cloudflare R2 storage of optional attachment files.
- Resend, for delivering verified RFQ messages to the sales inbox. RFQ email notifications carry protected download links, file names and sizes rather than the attachment bytes.
- Zoho Mail, for hosting the sales inbox and receiving and storing business correspondence sent to info@hechuangss.com.
This provides controlled access for the sales and technical personnel who need the files to review the requirement and prepare the quotation. Access is limited to what each recipient needs for its role. We do not use the inquiry form to sell personal data.
China and international processing
Hechuang is based in China. China is not covered by an adequacy decision of the European Commission or by UK adequacy regulations. RFQ details and related correspondence may therefore be accessed, handled and stored in China by the teams identified above, where privacy laws may differ from those in your location.
When you use this website, the RFQ information is collected directly from you by Hechuang as the China-based controller. Under the European Data Protection Board's transfer guidance, this direct disclosure by a person to a controller outside the EEA is not a Chapter V transfer, because no separate controller or processor acts as the data exporter. This distinction does not remove our other responsibilities under privacy law or the safeguards required for provider processing.
Cloudflare and Resend may process service data in other countries where they or their subprocessors operate. The Resend DPA becomes binding when its customer accepts the service terms and incorporates the EU Standard Contractual Clauses and the UK Addendum. For Cloudflare, before live collection begins, Hechuang will ensure that the Cloudflare Customer DPA and the applicable account terms are in effect. Under these provider terms, the EU Standard Contractual Clauses and UK Addendum are the contractual transfer mechanisms for restricted service-provider transfers that are not covered by adequacy.
Zoho Mail is the selected email-hosting provider. Before live RFQ collection begins, Hechuang will confirm the organization account's processing region, complete the applicable provider terms and data-processing arrangements, and put any required transfer safeguard in place. We will update this notice if the selected service region or provider changes the processing described here.
- Cloudflare Privacy Policy
- Cloudflare Customer DPA
- Resend Data Processing Addendum
- Zoho Privacy Policy
- EDPB Guidelines 05/2021 on international transfers
- European Commission adequacy decisions
You may email info@hechuangss.com to ask for a copy of, or more information about, the safeguards relevant to your inquiry.
How long we keep it
Incomplete uploads stored under the temporary upload route are cleared after 1 day. Completed attachment files and their protected download links expire after 30 days. A sales email may retain the file name and size after its link expires; the buyer can send the file again if a later review is required.
We keep an unsuccessful inquiry and its related correspondence for 24 months after the last meaningful contact. This supports continuity if you return with the same requirement and allows us to understand and defend the handling of the business inquiry.
If an inquiry becomes a successful deal, the records needed for that deal are managed separately and kept for the periods required by the contract and applicable finance, tax and legal duties. Short-lived anti-abuse information and provider service logs may follow shorter or provider-defined periods under the terms that apply to those services.
Your privacy rights
Depending on the law that applies to your personal data, you may have rights of access, rectification, erasure, restriction, objection and portability. These rights are not absolute, and lawful exceptions may apply.
To exercise a right, email info@hechuangss.com and describe the inquiry or record concerned. We may ask for information reasonably needed to verify your identity and your connection with the relevant records. We will respond within the timelines required by applicable law.
You may also complain to the applicable data protection regulator, including the regulator available to you under the law that applies in your location. For the disclosure framework used in this notice, you can review the official text of the EU General Data Protection Regulation.
Automated decisions and marketing
We use no automated decision-making that produces legal or similarly significant effects, and no profiling. Cloudflare Turnstile uses automated signals to check whether a form interaction appears legitimate and to deter spam. It does not make a material decision about quote eligibility, commercial terms, customer status or whether Hechuang will enter into a contract. If the check prevents form submission, you can contact the sales team by email or WhatsApp.
Submitting an RFQ does not subscribe you to automatic marketing. Any follow-up under this notice is connected to the business request you made.
How we protect the information
We use access controls, limited role-based sharing, form validation, Cloudflare Turnstile and service-provider security measures designed to protect inquiry information against unauthorized access, alteration, loss or disclosure. RFQ files are stored in a private R2 bucket without a public bucket address; access requires a signed, expiring link created for the completed inquiry. No internet transmission or storage system can be guaranteed completely secure, so please avoid sending information that is not needed for the inquiry.