This privacy policy explains how we handle personal data when you visit this website or send us an inquiry. We have written it with the EU General Data Protection Regulation (GDPR) and the UK GDPR in mind, because many of our customers are in Europe.
1. Who we are
This website is operated by Nanjing Tuohuang International Trade Co., Ltd., trading as LuckyScaffolding ("we", "us"). We are the controller of the personal data described in this policy.
- Address: Xibei Industrial Zone, Nanjing, Jiangsu Province, China
- Email: leolisuper360@gmail.com
For any privacy question or request, email us at leolisuper360@gmail.com.
2. What personal data we collect
Quote requests and inquiries. When you use the form on our contact page we collect your name, email address, phone / WhatsApp number, company name (optional), the product you are interested in and the project details you choose to give us.
Email and WhatsApp. If you contact us by email or WhatsApp, we receive your contact details and the content of your messages.
Technical data. When you visit the website, our hosting provider processes your IP address, browser type and the pages you request so that the site can be delivered and protected against attacks. We do not use this data to identify you or to build a profile of you.
We do not ask for, and ask you not to send, sensitive data such as health information.
3. Why we use your data and our legal basis
- To answer your inquiry and prepare quotations — necessary to take steps at your request before entering into a contract (GDPR Art. 6(1)(b)).
- To carry out an order, arrange shipping and provide after-sales support — performance of a contract (Art. 6(1)(b)).
- To keep business correspondence and follow up on quotations we have sent — our legitimate interest in running our business (Art. 6(1)(f)).
- To keep the website secure and working — our legitimate interest (Art. 6(1)(f)).
- To keep records required by tax and accounting law — legal obligation (Art. 6(1)(c)).
We do not sell your data, we do not send newsletters unless you have asked for them, and we do not use automated decision-making or profiling.
4. Cookies and tracking
We use Google Analytics 4 to understand how visitors use our website (pages visited, time on site, country). This sets analytics cookies only if you click Accept on the cookie banner. If you decline, no analytics cookies are set and no data is sent to Google. Our fonts are hosted on our own server, so no data is sent to font providers.
Strictly necessary: our hosting provider, Cloudflare, may set a security cookie (such as __cf_bm) to distinguish real visitors from bots. This cookie does not track you across websites and does not require consent.
Analytics cookies set after consent (Google Analytics 4):
- _ga — distinguishes visitors; expires 26 months.
- _ga_NY9RHW1N21 — session state for this property; expires 26 months.
Legal basis: consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time by clearing your browser cookies for this site.
5. Who we share your data with
Your data is seen only by our sales and engineering staff who handle your inquiry. We also use these service providers, who process data on our behalf:
- Cloudflare, Inc. — website hosting and security; stores the inquiries submitted through our form.
- Google LLC — our business email (Gmail), used to receive and answer your messages; and Google Analytics 4, used to analyse site usage (only if you consent).
- WhatsApp / Meta — only if you choose to contact us on WhatsApp, under WhatsApp's own privacy policy.
- Freight forwarders and shipping companies — only when you place an order and we need to deliver it.
We may also disclose data where the law requires it.
6. International transfers
We are based in China, so your inquiry is read and answered by our team in China. China is not covered by an EU adequacy decision. We transfer your data there because it is necessary to respond to your request and to carry out pre-contractual steps you have asked for (GDPR Art. 49(1)(b)), or to perform a contract with you (Art. 49(1)(c)).
Cloudflare and Google may process data in the United States and other countries. They protect transfers with the safeguards required by the GDPR, such as the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.
7. How long we keep your data
- Inquiries that do not lead to an order: up to 2 years after our last contact with you, then deleted.
- Customer and order records: for as long as tax and accounting law requires.
- Technical and security logs: kept by our hosting provider for a short period, normally no more than a few weeks.
8. Your rights
Under the GDPR and the UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to our use of your data;
- receive your data in a portable format;
- withdraw any consent you have given, at any time.
To use any of these rights, email leolisuper360@gmail.com. We will reply within one month. You also have the right to complain to the data protection authority in the EU country where you live or work, or to the Information Commissioner's Office (ICO) in the UK.
9. Security
The website is served over an encrypted (HTTPS) connection, and access to inquiries is limited to staff who need it. No method of transmission over the internet is completely secure, but we take reasonable measures to protect your data.
10. Children
This website is intended for businesses. It is not directed at children under 16, and we do not knowingly collect their data.
11. Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it was last changed.
12. Contact us
Questions about this policy or your data: leolisuper360@gmail.com. For product inquiries please use our contact page.