Privacy Policy
Last updated: 14 July 2026
Baoding Sunshine Enterprises Ltd. (“SUNSHINE”, “we”, “us”) is the controller responsible for personal data collected through this business-to-business website. This notice explains how we process information from website visitors, business contacts, and people who submit an enquiry.
1. Controller and privacy contact
Baoding Sunshine Enterprises Ltd.
No. 27, Jintong Road, South Side of Yawei Bridge, Heping Street, Gaobeidian City, Baoding, Hebei Province, China
Email: cheer@ch-sunshine.com
Telephone: +86 156 5288 6713
We have not described this contact as a Data Protection Officer because no formal DPO appointment is stated. Privacy requests may be sent to the address above.
2. Information we process
- Enquiry data: name, email address, company, product interest, project requirements, and the message you submit.
- Correspondence and project data: follow-up emails, technical requirements, quotation history, and records necessary to discuss or perform a business relationship.
- Technical and security data: IP address, browser or device information, request time, requested URL, and security events recorded in server logs.
- Third-party media data: if you choose to load Google Maps or play a YouTube video, Google may receive your IP address, browser information, referring page, and interaction data under its own privacy terms.
3. Purposes and legal bases
| Purpose | Legal basis where the GDPR applies |
|---|---|
| Responding to an enquiry and taking requested pre-contractual steps | Article 6(1)(b), where applicable; otherwise our legitimate interest under Article 6(1)(f) in handling business enquiries |
| Project communication, supplier/customer relationship management, and service support | Article 6(1)(b) and/or Article 6(1)(f) |
| Website security, fraud prevention, diagnostics, and availability | Article 6(1)(f) |
| Accounting, tax, sanctions, export-control, or other mandatory records | Article 6(1)(c) |
| Loading optional YouTube or Google Maps content | Your affirmative choice to load that third-party service; the service then processes data under its own terms |
We do not use website enquiries for unrelated consumer advertising, sell personal data, or make decisions producing legal or similarly significant effects solely by automated means.
4. Recipients and service providers
Access is limited to authorised SUNSHINE sales, engineering, administration, and IT personnel who need the information. We may use hosting, security, form, email-delivery, backup, and professional-adviser providers acting under appropriate contractual and confidentiality obligations. Data may also be disclosed when required by law or needed to establish, exercise, or defend legal claims.
5. International transfers
SUNSHINE is established in China. If you contact us from the European Economic Area or United Kingdom, your enquiry is transmitted to and handled in China. China is not covered by an EU adequacy decision. Where data-protection law requires a transfer safeguard, the relevant parties must use an appropriate legal mechanism and supplementary measures; transfers that are strictly necessary to respond to a step you requested may also be assessed under the limited derogations provided by applicable law. Contact us if you require information about the mechanism relevant to your enquiry.
6. Retention
- Unsuccessful or inactive enquiries: normally up to 24 months after the last meaningful contact.
- Active project and customer records: for the business relationship and then for the applicable legal, tax, warranty, limitation, and dispute periods.
- Routine web-server logs: normally no longer than 30 days unless a security incident requires longer preservation.
We may retain a minimal suppression or evidence record where necessary to honour an objection, demonstrate compliance, or protect legal rights.
7. Cookies and external media
The public website is designed not to load YouTube or Google Maps when a page first opens. Those services are contacted only after you select the relevant play or load button. YouTube uses a privacy-enhanced embed domain, but Google may still process data once playback begins. Essential WordPress cookies may be used for administrators and security functions. If non-essential analytics or marketing tools are introduced, this notice and the consent mechanism must be updated before activation.
8. Your rights
Subject to applicable law, you may request access, correction, erasure, restriction, portability (where its conditions apply), or object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. We may need information to verify your identity and normally respond within one month where the GDPR applies.
You may lodge a complaint with the data-protection authority in your habitual residence, place of work, or place of an alleged infringement in the EEA. Contact details are available through the European Data Protection Board’s supervisory-authority directory.
9. Security and changes
We use access controls, encrypted transport, backups, and operational safeguards appropriate to the nature of the website. No transmission or storage method is risk-free. Material changes to this notice will be published on this page with a revised date.