Privacy Policy & Cookie Notice

1. Who we are

This website, oemcosmeticsodm.com (the "Site"), is operated by Guangzhou Laiyue Biological Group Co., Ltd, a cosmetics contract manufacturer (OEM / ODM) registered in the People's Republic of China, with its registered and manufacturing address at:

Weiguan Cosmetics Creative Industrial Park, No. 18 Huahai Road, Huashan Town, Huadu District, Guangzhou, China

• Data protection contact: adon@oemcosmeticsodm.com
• Telephone / WhatsApp: +86 18709713948

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR and the Data Protection Act 2018, and equivalent laws in other jurisdictions, we act as the data controller (or, where we process data solely on a client's instructions, as a data processor — see section 2).

We are not established in the EU or the UK. If you are in the EEA, the UK or Switzerland and need a local point of contact, please write to adon@oemcosmeticsodm.com. Where Article 27 GDPR / Article 27 UK GDPR applies to us, we will appoint a representative and publish their details here before that requirement takes effect for us.

2. Scope of this policy

This policy explains what personal data we collect through the Site and in the course of normal business communication (email, telephone, WhatsApp, WeChat, trade shows, samples and orders), why we collect it, how we use and protect it, and the rights you have.

It does not apply to:

• third-party websites you reach by following a link from the Site — please read their own privacy notices;
• personal data we process on behalf of a client while manufacturing or developing products for them. In that case the client is the controller and we act as a processor under a written data-processing agreement; requests should be directed to that client.

3. Summary at a glance

What we collect	Why	Legal basis	Kept for
Name, company, email, phone, product interest, message you send us	To answer your enquiry and quote for manufacturing services	Steps prior to a contract; our legitimate interests in running a B2B business	24 months from last contact
IP address, browser/user-agent, referring page, page visited, date and time	To keep the Site secure and to measure aggregate traffic	Our legitimate interests in website security and analytics	30 days (rolling)
Session cookie (OEMCAPSESSID)	To keep your form submission secure (anti-CSRF) and remember short-lived page messages	Strictly necessary — no consent required	Up to 7 days, or until you clear cookies

We do not use advertising cookies, we do not run third-party trackers, and we do not sell or share your personal information for cross-context behavioural advertising. The Site loads no third-party fonts, scripts or content delivery networks: every asset is served from our own domain.

4. Personal data we collect

4.1 Information you give us

When you submit an enquiry through any form on the Site, we collect:

• your name and company name;
• your email address and, if you provide it, your telephone number;
• the product, category or project you are interested in;
• the content of your message and any information you choose to include;

and we also record a few technical anti-abuse values that are submitted with the form but which you never see: a CSRF security token, a signed submission timestamp, and a hidden "honeypot" field used to detect automated spam. We also record the page you came from so that we can reply in context.

If you contact us by email, telephone or messaging apps, or if you place an order or request samples, we will also hold the correspondence and the contact and delivery details you give us.

Please do not send us special category data (for example health data, racial or ethnic origin, political opinions, religious beliefs, biometric data, or trade-union membership) and please do not send us personal data of anyone else unless you have their permission. We do not ask for, and do not wish to receive, this kind of information.

4.2 Information collected automatically

Like almost every website, our server records basic technical information when you request a page. This is retained in our own database and used only for security and aggregate statistics (see section 7):

• IP address (including the country derived from it, where our hosting environment supplies it);
• browser and operating-system type (user-agent string);
• the page you requested and the page you came from (referrer);
• the date and time of the request;
• a flag indicating whether the request came from an automated bot or crawler;
• a pseudonymous visitor hash calculated as MD5(IP address + user-agent + date), which we use to count unique visitors per day without building a profile of you.

This information is collected server-side. It is not linked to any cookie, and it is not shared with, or made available to, any advertising or analytics company.

4.3 Information we receive from others

We do not buy or receive personal data from data brokers or advertising networks. We may receive your business contact details from a colleague, a trade-show directory or a referral within our industry — in which case we will tell you where we got them the first time we contact you.

5. Why we use it & our legal bases

Under the GDPR and UK GDPR we must have a legal basis for each purpose. The table below sets out our purposes and the corresponding legal bases.

Purpose	Legal basis (GDPR / UK GDPR Art. 6)
Responding to your enquiry; preparing quotations, samples and specifications	Art. 6(1)(b) — steps at your request prior to entering a contract
Performing a contract we have with you or your company (manufacturing, supply, shipping)	Art. 6(1)(b) — performance of a contract
Keeping the Site secure, preventing spam, fraud and abuse; troubleshooting	Art. 6(1)(f) — our legitimate interests in protecting our systems and visitors
Understanding aggregate traffic so we can improve the Site and our product pages	Art. 6(1)(f) — our legitimate interests in running and improving a B2B website
Keeping accounting, tax and shipping records; complying with export and customs law	Art. 6(1)(c) — compliance with a legal obligation
Establishing, exercising or defending legal claims	Art. 6(1)(f) — our legitimate interests
Sending you commercial information about our services	Art. 6(1)(a) — your consent, or Art. 6(1)(f) where you are an existing business contact

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. Because this is a business-to-business website and the information involved is limited (the contact details you choose to send us, and non-identifying technical data), we consider that balance weighs in favour of processing — but you may object at any time (see section 12).

6. Cookies and similar technologies

"Cookies" are small text files stored by your browser. The Site uses a deliberately minimal set.

Cookie	Type	Purpose	Duration
OEMCAPSESSID	First-party, strictly necessary	Identifies a server-side session so that security tokens (anti-CSRF) work correctly, so that form submissions are protected, and so that short-lived status messages can be shown. Without it, forms on the Site cannot be submitted safely.	Up to 7 days, or until you clear your cookies; the data behind it lives on our server for the duration of the session

The cookie is set with the Secure, HttpOnly and SameSite=Lax attributes, which means it is only transmitted over encrypted connections, is not readable by JavaScript, and is not sent on cross-site requests.

Because the Site uses only strictly necessary cookies, and no advertising or third-party analytics cookies, no cookie-consent banner is required under the EU ePrivacy Directive (as implemented in France by the CNIL's guidelines), the UK PECR, or comparable rules. If we ever introduce non-essential cookies or third-party analytics, we will add a consent mechanism that blocks those cookies until you actively agree, and we will update this policy first.

You can delete or block cookies at any time in your browser settings. Blocking the session cookie will not stop you reading the Site, but it will prevent you from submitting the enquiry form.

7. Website analytics

We measure traffic with a self-hosted, first-party counter built into our own server software. It:

• does not use cookies and does not fingerprint your device across sites;
• does not track you across other websites and does not build advertising profiles;
• records the technical fields listed in section 4.2 into our own database;
• uses a daily-rotating hash so that the same visitor is counted once per day, after which the link between the hash and the day is broken;
• ignores requests from known search-engine and AI crawlers, monitoring services and security scanners.

The purpose is strictly limited to knowing how many people visit which pages and where they come from, so that we can improve the Site. We rely on our legitimate interests for this (section 5), and you may object at any time — see section 12.

8. Who we share data with

We do not sell your personal data, and we do not share it for advertising. We disclose it only:

• to service providers who help us run the Site and our business, acting on our instructions and under confidentiality — for example our hosting provider, our email provider, and our IT support;
• to logistics, customs and certification partners, to the extent necessary to deliver samples or goods and to obtain the export documents your order requires;
• to professional advisers (accountants, auditors, lawyers) where necessary, under professional confidentiality;
• where the law requires it, or where we must respond to a lawful request from a competent authority, court or regulator;
• in connection with a business transfer, if all or part of our business is reorganised, merged or sold, in which case we will tell affected individuals and require the recipient to honour this policy.

9. International transfers

We are based in China. Our servers, and those of our hosting provider, are located outside the European Economic Area and the United Kingdom. This means that if you contact us from the EEA, the UK, Switzerland or another region with transfer restrictions, your personal data will be transferred to, and stored in, a country whose data-protection laws may differ from those of your own.

• EEA → China/Hong Kong: where required, we rely on the European Commission's Standard Contractual Clauses (and any additional safeguards the law requires), or on the fact that the transfer is necessary for the performance of a contract with you or to take steps at your request before entering into one.
• UK → China/Hong Kong: the UK International Data Transfer Agreement / Addendum, or the transfer derogations in Article 49 UK GDPR.
• Switzerland: the Swiss–EU adequacy framework and the FADP.
• China: where personal information is transferred out of China, we comply with the cross-border requirements of the Personal Information Protection Law, including obtaining your separate consent where required (see section 14).

You may contact us for more information about the safeguards we use. Note that by sending a business enquiry you are asking us to respond, which necessarily involves this transfer.

10. How long we keep data

Category	Retention period
Business enquiries that do not lead to an order	24 months from the last contact, then deleted
Correspondence relating to an active or completed order	For the duration of the relationship and then 24 months
Accounting, tax, customs and shipping records	As required by applicable Chinese accounting and tax law (currently up to 10 years)
Server logs and traffic statistics	30 days, on a rolling basis
Session cookie	Up to 7 days, or until you clear your browser cookies

Where a retention period has expired, we delete the data or irreversibly anonymise it so that it can no longer be linked to you.

11. How we protect data

• the Site is served over HTTPS (TLS), so data in transit is encrypted;
• session cookies are Secure, HttpOnly and SameSite=Lax;
• forms are protected by CSRF tokens, a submission-time check and a honeypot against automated abuse;
• access to our systems and databases is limited to personnel who need it, by individually named accounts;
• we do not collect or store payment-card data on this Site;
• we keep our software and dependencies patched and review access regularly.

No method of transmission or storage is completely secure. If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where the law requires, you, without undue delay.

12. Your rights — EEA, UK, Switzerland & France

If you are in the EEA, the UK or Switzerland, you have the right to:

• be informed about how we use your data (this policy);
• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data;
• erase data ("right to be forgotten") where there is no continuing lawful reason for us to keep it;
• restrict processing while a dispute about it is resolved;
• object to processing based on our legitimate interests, and to direct marketing always;
• data portability — receive data you provided in a structured, machine-readable format, or have it transmitted to another controller;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of prior processing;
• not be subject to solely automated decisions with legal or similarly significant effects — we do not make any;
• complain to a supervisory authority (see section 21).

In France, these rights are set out in the Loi Informatique et Libertés (Loi n° 78-17) and supervised by the CNIL, which also publishes the reference framework for cookies and trackers to which we have aligned section 6.

To exercise any right, email adon@oemcosmeticsodm.com. We will respond within one month (extendable by two months for complex requests, and we will tell you if so). We may ask for proof of identity, and we do not charge a fee unless a request is manifestly unfounded or excessive.

13. Additional rights — United States

If you are a resident of California, the CCPA/CPRA gives you the right to know what personal information we collect, use and disclose; to request a copy; to request deletion or correction; to opt out of the "sale" or "sharing" of personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising your rights. Residents of other US states with comprehensive privacy laws (for example Virginia, Colorado, Connecticut, Utah, Texas and others) have comparable rights.

• Categories we collect: identifiers (name, email, phone, IP address); commercial information (products you enquire about, order history); internet or network activity (pages visited, referrer, user-agent); professional information (company, job role). Sources and purposes are described in sections 4, 5 and 7.
• We have not sold or shared personal information for cross-context behavioural advertising in the preceding 12 months, and we do not do so. We do not use or disclose sensitive personal information for purposes that require a "limit use" right.
• Authorised agents: you may use an agent to make a request on your behalf if they provide written authorisation signed by you (or a power of attorney).
• To exercise your rights, email adon@oemcosmeticsodm.com with the subject line "US privacy request".

14. Additional rights — China

If you are located in mainland China, the Personal Information Protection Law ("PIPL") also gives you the right to be informed and to decide on the processing of your personal information; to access and copy it; to request correction or completion; to request deletion; to withdraw your consent; to request an explanation of our processing rules; and to have your personal information transferred to a designated third party where the legal conditions are met. Rights relating to a deceased person's personal information may be exercised by their close relatives in accordance with the law.

We process personal information on the bases permitted by Article 13 PIPL (including your consent, the conclusion or performance of a contract, and our legitimate business needs within a reasonable scope), and we apply the minimum-necessary principle. Where we transfer personal information outside China, we obtain your separate consent in accordance with Article 39 PIPL and comply with the cross-border requirements of Articles 38–40.

We have not appointed a personal information protection officer, as we are not required to do so; enquiries may be sent to adon@oemcosmeticsodm.com, and we will respond within 15 working days. You may also complain to a competent Chinese authority.

15. Other jurisdictions

• Canada: we handle personal information in accordance with PIPEDA. You may ask to see your information and to have it corrected.
• Australia: we handle personal information in accordance with the Privacy Act 1988 and the Australian Privacy Principles.
• Brazil: we handle personal data in accordance with the LGPD, and honour the rights it grants to data subjects.

16. Children's privacy

The Site is a business-to-business website and is not directed at children. We do not knowingly collect personal data from anyone under 16 (or under 13 in the United States, or the minimum age in your country). If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

17. Marketing communications

We send commercial information only where you have asked for it or where we have an existing business relationship and the law allows it. Every message tells you how to opt out, and you can also ask us at any time at adon@oemcosmeticsodm.com. Opting out of marketing does not stop us from replying to an enquiry or performing a contract.

18. Do Not Track & Global Privacy Control

We do not track visitors across third-party websites, and we do not use the kind of technology that "Do Not Track" signals are designed to control, so those signals have no further effect here. If your browser sends a Global Privacy Control ("GPC") signal, we treat it as a valid opt-out of sale/sharing — which has no practical effect, because we do not sell or share personal information.

19. Third-party links & embeds

The Site may link to third-party websites (for example certification bodies or industry organisations). We are not responsible for their content or their privacy practices.

As of the date of this policy, the Site embeds no third-party content — no external maps, video players, social plug-ins, web fonts or CDNs. If we later embed third-party content whose provider would receive your IP address or set cookies, we will either obtain your consent first or load it only after you actively click to activate it, and we will update this policy.

20. Changes to this policy

We may update this policy from time to time, for example to reflect changes in our practices or in the law. The "Last updated" and "Version" lines at the top of this page always show the current version. If we make a material change, we will take reasonable steps to bring it to your attention before it takes effect.

21. Contact & complaints

For any question about this policy or your personal data, or to exercise any right:

• Email: adon@oemcosmeticsodm.com
• Post: Guangzhou Laiyue Biological Group Co., Ltd, Weiguan Cosmetics Creative Industrial Park, No. 18 Huahai Road, Huashan Town, Huadu District, Guangzhou, China

We would like the chance to resolve your concern first — but you always have the right to complain to your local supervisory authority. These include:

• France: Commission Nationale de l'Informatique et des Libertés (CNIL), www.cnil.fr
• UK: Information Commissioner's Office (ICO), ico.org.uk
• Germany: the supervisory authority of your federal state (www.bfdi.bund.de lists them)
• Ireland: Data Protection Commission, dataprotection.ie
• China: the Cyberspace Administration of China and other competent authorities
• a list of all EEA authorities is published by the European Data Protection Board at edpb.europa.eu

This Privacy Policy is published together with our Disclaimer & Terms of Use. It is not legal advice to you; if you need advice about your own situation you should consult a qualified professional in your jurisdiction.