Legal
Privacy Policy
Last updated: 17 August 2026
This policy explains what AgarwoodWholesale does with the information you send us through the enquiry form on this website, by email, or through WhatsApp — and what it does not do with it.
It is written for business buyers. If you are in the European Economic Area or the United Kingdom, the sections on legal basis, international transfer and your rights are the ones that matter to you. They are written to be read rather than to be technically compliant and unreadable.
1.Who is responsible for your data
AgarwoodWholesale is the controller. We operate from No. 7, Guan Zhu Town, Dian Bai District, Maoming City, Guangdong, China.
We have not appointed an EU representative under Article 27 GDPR. We do not offer goods to consumers in the EU and we do not monitor anyone’s behaviour. We respond to business enquiries that are sent to us. If you believe that assessment is wrong for your situation, tell us and we will deal with it rather than argue about it.
To reach us about anything in this policy, use the contact page or the WhatsApp number listed there.
2.What we collect
From the enquiry form, only what you type into it:
- Your name, company, email address, destination country and the content of your enquiry.
- Anything further you choose to send us by email or WhatsApp — including, at order stage, a delivery address, a consignee contact, a VAT/EORI or importer registration number, and your customs broker’s details.
- Standard server logs kept by our hosting provider: IP address, browser user-agent and timestamp. We do not use these to build any profile of you.
3.What we do not collect
No payment card or bank data is collected through this website. Payment instructions are exchanged directly on an invoice, not through any form here.
No advertising identifiers, no behavioural profiles, no automated decision-making, and no sale or rental of your details to anyone. We do not add enquirers to a mailing list without asking first.
4.Why we use it, and on what legal basis
To answer your enquiry, prepare a quotation and, if you order, to produce, document and ship the goods. Under the GDPR that is Article 6(1)(b) — steps taken at your request before a contract, and then performance of the contract itself.
To meet export, customs and accounting obligations that apply to us in China and to the shipment in your country. That is Article 6(1)(c).
To keep ordinary business correspondence, to check that a payment instruction is genuine, and to protect ourselves against fraud. That is Article 6(1)(f) — our legitimate interest in running the business without being defrauded, balanced against the fact that the data involved is business contact data rather than anything sensitive.
5.Who else sees it
As few parties as the job allows. Specifically:
- Web3Forms — the service that relays the enquiry form to our inbox. It receives whatever you typed into the form.
- Our email provider, and our website hosting provider (server logs only).
- Carriers and their agents — DHL, FedEx or the ocean carrier and forwarder handling your consignment — who need the consignee name, address and contact to deliver.
- Customs authorities in China and in the destination country, and your own nominated broker where you have named one. Customs data is a legal requirement, not a choice either of us has.
6.Your data leaves the EEA — read this one
We are in China. There is no European Commission adequacy decision for China. We have not put Standard Contractual Clauses in place with our own customers. So it is worth being direct about what that means rather than burying it.
When you send an enquiry, your data is transferred to and stored in China. For an enquiry and any order that follows, we rely on Article 49(1)(b) GDPR: the transfer is necessary to take steps at your request before entering a contract, and then to perform it. That derogation fits an enquiry-and-order relationship, which is the only relationship this website creates.
What that derogation does not cover is marketing, profiling or building a prospect database — so we do none of those things from this site. If we ever want to, we will need a different legal basis and we will come back to you before, not after.
If you would rather your details were not processed in China at all, do not use the form: ask your agent or forwarder to approach us on your behalf. We will deal with them instead.
7.How long we keep it
Enquiries that do not lead to an order: deleted within 24 months of the last message, unless you ask us to delete them sooner.
Order, shipping and customs records: kept for as long as Chinese customs and accounting law requires us to keep them — customs documentation for three years from clearance, accounting records for the longer statutory periods that apply to them. We cannot delete these on request while that obligation is running, and we will say so plainly if you ask.
WhatsApp conversations sit on the device and in that account until deleted; we clear out old threads periodically.
8.Cookies, analytics and embedded video
This website sets no cookies of its own, and runs no analytics, tag manager, advertising pixel or session-recording tool. There is nothing to consent to, which is why you are not being asked to.
Video is embedded click-to-load: nothing is requested from YouTube. No YouTube cookie is set, until you click play on a video. If you never click, the third party never sees you.
If we add analytics later, this section changes first and a consent mechanism goes in where the law requires one.
9.Your rights
You can ask us what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, or ask for a copy in a portable format. Where we rely on legitimate interest, you can object.
Write to us through the contact page. We will reply within 30 days. The only requests we will refuse are ones that would break a record-keeping obligation we do not control — and if that happens we will tell you which obligation and for how long it runs.
If you are in the EEA or the UK you also have the right to complain to your data protection authority. In Germany that is the supervisory authority of your federal state; in the UK it is the ICO. You do not need our permission and you do not need to complain to us first.
10.Changes to this policy
The date at the top is the date of the current version. Changes that affect what we do with data already collected will be flagged on this page rather than made quietly.
The commercial side — payment, delivery terms, claims and governing law — is set out separately under terms of sale.