Privacy Policy

1. Introduction

HONG KONG HUANNI INDUSTRIAL CO., LIMITED, operating as Huanni Industry (referred to as Huanni Industry, we, us, or our throughout this document), respects the privacy of every individual who visits our website at https://www.huanniindustry.autos, contacts us through our online channels, or engages our services. This Privacy Policy explains in clear and transparent terms what personal data we collect, why we collect it, how we use it, the legal bases on which we rely, with whom we share it, how we protect it, and the rights you have regarding your information.

We are committed to processing personal data in accordance with applicable data protection laws, including but not limited to the Personal Data (Privacy) Ordinance (Cap. 486) of the Hong Kong Special Administrative Region, the General Data Protection Regulation (GDPR) (EU) 2016/679 where applicable, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and other relevant regional privacy frameworks that may apply to our operations or to data subjects whose information we process.

By accessing our website, submitting an inquiry through our contact form, or otherwise providing us with your personal data, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please refrain from using our website or providing personal data to us.

2. Data Controller Information

The data controller responsible for your personal data is:

For any questions, concerns, or requests related to this Privacy Policy or our data processing practices, please contact us at the email address above with the subject line Attention: Data Protection Officer.

3. Information We Collect

3.1 Information You Provide Directly

When you interact with our website or communicate with us, we may collect the following categories of personal data that you voluntarily provide:

• Contact and identification information: your full name, email address, phone number, job title, company name, and physical address.
• Inquiry and communication data: the subject line and body of messages you submit through our contact form, email correspondence, or telephone conversations, including any project details, technical requirements, or other information you choose to share.
• Service engagement data: where you enter into a business relationship with us, information related to the scope of services, contractual terms, payment details, and project specifications.

3.2 Information Collected Automatically

When you visit our website, certain information is collected automatically through standard internet technologies:

• Usage data: pages visited, time spent on pages, referral sources, navigation paths, and interactions with page elements such as buttons and forms.
• Device data: browser type and version, operating system, screen resolution, device manufacturer and model, and language preferences.
• Network data: IP address, internet service provider, approximate geographic location derived from IP address, and connection type.
• Cookie data: session identifiers, preference tokens, and analytics identifiers as described in Section 7 of this policy.

3.3 Information We Do Not Collect

We do not knowingly collect sensitive personal data (as defined under applicable law) through our website, including but not limited to: government identification numbers, biometric data, health information, genetic data, information about racial or ethnic origin, political opinions, religious beliefs, trade union membership, or data concerning sexual orientation. We request that you do not provide such information through our contact form or other channels unless specifically required for a contractual engagement and agreed to in writing.

4. How We Use Your Information

We process your personal data for the following purposes and on the following legal bases:

• Responding to inquiries and providing services: We use your contact details and message content to respond to your inquiries, prepare proposals and quotations, deliver contracted services, and manage ongoing client relationships. Legal basis: performance of a contract or taking steps at your request prior to entering into a contract; legitimate interest in operating our business.
• Website operation and improvement: We analyze usage patterns to improve website performance, content relevance, and user experience. Legal basis: legitimate interest in maintaining and enhancing our online presence.
• Marketing communications: With your consent where required by law, we may send you information about our services, industry insights, case studies, and event invitations. You may opt out of marketing communications at any time using the unsubscribe link in each email or by contacting us directly. Legal basis: consent; legitimate interest in promoting our services to existing clients and relevant business contacts.
• Legal compliance and protection: We may process personal data to comply with applicable laws, regulations, court orders, or lawful requests from governmental authorities, and to protect our legal rights, property, and safety. Legal basis: compliance with a legal obligation; legitimate interest in protecting our rights.

5. Legal Basis for Processing (GDPR)

For individuals located in the European Economic Area (EEA), the United Kingdom, or other jurisdictions where the GDPR or equivalent legislation applies, we process your personal data on the following lawful bases:

• Consent (Article 6(1)(a)): Where you have given clear and specific consent for us to process your personal data for a particular purpose, such as receiving marketing communications.
• Contractual necessity (Article 6(1)(b)): Where processing is necessary for the performance of a contract with you, or to take steps at your request before entering into a contract.
• Legitimate interests (Article 6(1)(f)): Where processing is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include: operating and improving our website, responding to inquiries, maintaining client relationships, and protecting our legal rights.
• Legal obligation (Article 6(1)(c)): Where processing is necessary for compliance with a legal obligation to which we are subject.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data in the following limited circumstances:

• Service providers: We engage trusted third-party vendors who process data on our behalf to support our operations, including website hosting providers, email service providers, analytics services, and cloud infrastructure providers. These vendors are bound by contractual obligations to process data only on our documented instructions, implement appropriate security measures, and comply with applicable data protection laws.
• Professional advisors: We may share data with our legal counsel, auditors, accountants, and insurers where necessary for the provision of their professional services to us.
• Legal and regulatory authorities: We may disclose personal data when required by law, regulation, court order, subpoena, or lawful request from a governmental or regulatory body.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or a portion of our assets, personal data held by us may be among the assets transferred. You will be notified via email or prominent notice on our website of any change in ownership or use of your personal data.

7. Cookies and Tracking Technologies

7.1 What Cookies Are

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites function efficiently and to provide information to the site operators. Cookies may be session cookies (deleted when you close your browser) or persistent cookies (retained on your device for a set period or until you delete them).

7.2 Types of Cookies We Use

• Essential cookies: These are strictly necessary for the operation of our website. They enable core functionality such as navigation and access to secure areas. The website cannot function properly without these cookies, and they do not require your consent under most privacy laws.
• Analytics cookies: We use analytics services that place cookies to help us understand how visitors engage with our website. These cookies collect information such as the number of visitors, pages viewed, time spent on pages, and traffic sources. We use this information in aggregated form to improve our website.
• Functional cookies: These cookies enable enhanced functionality and personalization, such as remembering your preferences and recognizing you when you return to our website.

7.3 Managing Cookies

Most web browsers allow you to control cookies through their settings preferences. You can set your browser to block or alert you about cookies, or to delete cookies that have already been set. Please note that blocking or deleting cookies may impact your experience of our website, and certain features may not function as intended. For detailed guidance on managing cookies in popular browsers, consult the help documentation for your browser or visit https://www.allaboutcookies.org.

8. Data Security

We implement and maintain appropriate technical and organizational measures designed to protect personal data against accidental, unauthorized, or unlawful destruction, loss, alteration, disclosure, or access. These measures include but are not limited to:

• Encryption of data in transit using Transport Layer Security (TLS) protocols;
• Encryption of data at rest where technically feasible and operationally appropriate;
• Access controls that restrict personal data to authorized personnel on a need-to-know basis;
• Regular security assessments, vulnerability scanning, and penetration testing of our systems;
• Physical security measures at our office premises, including access control systems;
• Employee training on data protection obligations and security best practices;
• Incident response procedures to detect, contain, and remediate security breaches.

While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is absolutely secure. We cannot guarantee the absolute security of your data. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with applicable legal requirements.

9. Data Retention

We retain personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. Our retention periods are determined by the following criteria:

• Inquiry data: Retained for up to 24 months from the date of last communication unless a client relationship is established, in which case retention is governed by contractual terms.
• Client and contract data: Retained for the duration of the business relationship plus a period of 7 years following contract termination, to comply with tax, accounting, and legal obligations.
• Marketing data: Retained until you withdraw consent or opt out of receiving marketing communications, after which your data is suppressed from marketing lists within 30 days.
• Website usage and analytics data: Retained in aggregated or anonymized form indefinitely; raw data containing identifiers is retained for a maximum of 26 months.

When personal data is no longer required for the purposes for which it was collected, we will securely delete or irreversibly anonymize it.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of access: You have the right to request confirmation of whether we process your personal data and, if so, to obtain a copy of that data along with information about how and why we process it.
• Right of rectification: You have the right to request that we correct inaccurate or incomplete personal data we hold about you.
• Right of erasure: You have the right to request deletion of your personal data in certain circumstances, such as where the data is no longer necessary for the purpose for which it was collected or where you withdraw consent.
• Right to restrict processing: You have the right to request that we limit the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller where technically feasible and where processing is based on consent or contract.
• Right to object: You have the right to object to processing of your personal data based on our legitimate interests, including processing for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction if you believe our processing of your personal data violates applicable law.

10.1 CCPA / CPRA Rights (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights:

• Right to know: You have the right to request that we disclose what personal information we collect, use, disclose, and sell or share. You may request this information up to twice in a 12-month period.
• Right to delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing: We do not sell your personal information as defined under the CCPA, nor do we share it for cross-context behavioral advertising. However, you retain the right to direct us not to sell or share your personal information.
• Right to limit use of sensitive personal information: We do not collect sensitive personal information as defined under California law through our website.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any of the rights described above, please contact us at service@huanniindustry.autos with the subject line Data Subject Request. We will respond to verified requests within the timeframes required by applicable law. We may need to verify your identity before processing your request, which may require you to provide additional information.

11. Childrens Privacy

Our website and services are not directed to, and we do not knowingly collect personal data from, children under the age of 16. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at service@huanniindustry.autos. Upon verification, we will take steps to delete such information from our systems promptly.

12. International Data Transfers

HONG KONG HUANNI INDUSTRIAL CO., LIMITED is headquartered in the Hong Kong Special Administrative Region. Personal data we collect may be transferred to, stored in, and processed in Hong Kong and in other jurisdictions where we or our service providers maintain facilities. These jurisdictions may have data protection laws that differ from those in your country of residence.

When we transfer personal data across international borders, we implement appropriate safeguards to ensure an adequate level of protection. These safeguards include:

• Transferring data only to jurisdictions that have been recognized as providing an adequate level of data protection by the relevant authority;
• Entering into Standard Contractual Clauses approved by the European Commission or the UK Information Commissioners Office, as applicable;
• Implementing supplemental technical and organizational measures where required by applicable law or regulatory guidance.

You may request additional information about the specific safeguards applied to international transfers of your personal data by contacting us at service@huanniindustry.autos.

13. Third-Party Links and Services

Our website may contain links to external websites, platforms, and services that are not owned, operated, or controlled by HONG KONG HUANNI INDUSTRIAL CO., LIMITED. These links are provided for your convenience and informational purposes only. We are not responsible for the privacy practices, content, or security of any third-party websites. We encourage you to review the privacy policies of every website you visit before providing any personal data.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or operational requirements. When we make material changes, we will post the updated policy on this page with a revised Last updated date and, where appropriate, provide notice through our website or by email to individuals with whom we have an ongoing relationship.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of our website after any changes constitutes your acceptance of the updated policy.

15. Contact Information

If you have any questions, concerns, requests, or complaints regarding this Privacy Policy or our data handling practices, please contact us using the details below:

We are committed to resolving any concerns you may have about your privacy. Please contact us in the first instance so that we may address your concern directly. If you remain unsatisfied with our response, you have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data in Hong Kong (https://www.pcpd.org.hk) or the data protection supervisory authority in your jurisdiction.