Privacy Policy

This Privacy Policy explains how Cncartbuy (“Cncartbuy”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you visit cncartbuy.com (the “Website”), create an account, place an order, submit an inquiry, use our buying-agent, forwarding or warehouse services, or otherwise contact us. Cncartbuy has warehouse operations in Guangzhou, China, and fulfilment through partner warehouses in the United States, Canada, the United Kingdom and Germany.

Please read this policy together with our Terms of Service, Refund and Returns Policy, Shipping and Compensation Policy and Prohibited Items Policy. If you do not agree with this policy, please do not use the Website or our services.

1. Who is responsible for your data

Cncartbuy is the controller of the personal data described in this policy, except where we process data on behalf of a business customer, as described in section 8. You can reach us about any privacy matter through the Contact page on our website. Our company details are shown in the footer of the Website.

2. Personal data we collect

We collect only the data we need to provide and improve our services.

2.1 Data you give us

• Account data: your name, email address, password (stored in hashed form), country, preferred currency and language, and the shipping addresses you save in your address book.
• Order data: the products you buy, product links and specifications you submit for our buying-agent service, notes and special requests, delivery addresses (including the addresses of your own customers if you use our dropshipping services), order amounts and order history.
• Forwarding and warehouse data: parcel forecasts (domestic tracking numbers, item names, quantities, declared values and goods types), purchase receipts you upload to claim a parcel, customs declaration details you provide or confirm before shipment, and your choices of optional services such as extra photos, priority handling or shipping insurance.
• Inquiry data: when you use Get a Quote, Ask about this item, a bulk inquiry, a sourcing request or a corporate forwarding request, we collect your name, email address, country, WhatsApp number if you choose to provide it, product links or descriptions, quantities, target prices and currency, notes, and any files you upload. For corporate forwarding requests we also collect your company name, contact person, goods category, weight and volume, destination and shipping frequency.
• Uploaded files: inquiry attachments may be images (JPG, PNG or WebP) or PDF documents, up to 5 files per message, each no larger than 10 MB. Please do not upload files that contain personal data you do not need to share, such as identity documents or other people’s details.
• Payment data: the payment method you choose, payment references, transaction status and, for offline bank (wire) transfers, the transfer receipt you upload so that we can confirm your payment. Card and wallet details are entered directly with our payment processors; we do not store full card numbers.
• After-sales data: the reason for your request, photos or videos you upload, and our correspondence with you about returns, refunds and claims.
• Communications: messages you send us through the Website, by email or through WhatsApp where we offer it, and records of your consent choices.
• Marketing preferences: whether you have opted in to marketing emails. This is a separate, optional choice and is never pre-selected.

2.2 Data we collect automatically

• Technical data: IP address, browser type, device type, operating system, pages viewed, referring pages, the country you select on the Website and approximate location derived from your IP address.
• Security data: logs of sign-in attempts, rate-limiting and anti-abuse checks (including CAPTCHA challenges), and records needed to protect the Website from automated scraping and fraud.
• Cookies and similar technologies: see section 6.

2.3 Data we receive from others

• Payment processors tell us whether a payment succeeded, failed or was refunded.
• Suppliers, warehouses and carriers send us order status, tracking numbers and delivery events.
• Warehouse staff record inspection results and photos of the goods we receive for you.

3. How and why we use your data

We use personal data for the following purposes and, where the GDPR or UK GDPR applies, on the following legal bases:

Where we rely on legitimate interests, we have balanced those interests against your rights. You can object to this processing as described in section 10.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Automated checks, such as blocking products that cannot be sold to your country or flagging prohibited keywords, are used to apply our policies and can be reviewed by our team on request.

4. Inquiry attachments and file removal

Files you upload to an inquiry thread are used only to understand and answer your request and to prepare a quote. They are visible to you and to our staff who handle inquiries.

Once a file has been sent, you cannot delete it yourself, but you can ask us to remove any file you uploaded by selecting Request removal next to the file. This option is available whether you are signed in or viewing the thread through a secure link. While your request is pending you can withdraw it by selecting Cancel request.

We process removal requests within 2 business days. When a file is removed, the thread shows “File removed at customer request” in its place. If we cannot remove a file, for example because we need it to establish or defend a legal claim or to meet a legal obligation, we will tell you in the thread that the request was declined and explain why. This does not affect your other rights under section 10.

Guest users who submit an inquiry without an account receive an email containing a secure link to that inquiry. Each secure link opens only that inquiry and expires after 30 days; a new link is included in every reply or quote we send, and you can request a fresh link at any time through Find my inquiry in the Website footer. If you later register with the same verified email address, your earlier inquiries are linked to your account.

5. How we share your data

We do not sell your personal data. We share it only as needed to provide our services, to comply with the law or to protect our rights, and only with:

• Suppliers and fulfilment partners: for products shipped from our overseas warehouses, we share the delivery name, address, phone number where provided, and order contents with the supplier that operates the warehouse, so it can pack and ship your order and handle returns.
• Online marketplaces and sellers in China: when we buy goods for you, we place the order in our own name and have it delivered to our Guangzhou warehouse. We generally do not need to share your personal data with these sellers.
• Warehouse operations: our Guangzhou warehouse staff use your customer code, order details and parcel information to receive, inspect, photograph, store, pack and ship your goods.
• Carriers, logistics providers and customs brokers: we share the recipient’s name, address, phone number where provided, and the parcel’s contents, declared value, weight and dimensions so that the parcel can be transported, cleared through customs and delivered. Customs authorities in the countries of transit and destination may receive this data.
• Payment processors and banks: card networks, online payment and digital wallet providers, and the banks involved in a wire transfer receive the data needed to process your payment or refund and to prevent fraud. Each processor handles your data under its own privacy policy.
• Service providers: hosting, content delivery, security, email delivery and similar providers that process data on our instructions and under confidentiality obligations.
• Shipping-rate providers: to calculate shipping estimates we send the destination country, weight and dimensions of a parcel. We do not send your name or contact details for this purpose.
• Professional advisers and authorities: lawyers, accountants and auditors, and courts, regulators, tax, customs or law-enforcement authorities where we are required or permitted by law to disclose data.
• Business transfers: a buyer or successor if our business, or part of it, is reorganised, sold or transferred, subject to this policy.

6. Cookies and similar technologies

We use cookies and similar technologies to run the Website, remember your choices and, with your consent, understand how the Website is used.

• Strictly necessary cookies keep you signed in, keep your cart, remember your selected country and currency, protect forms against abuse and remember your cookie choices. These cannot be switched off because the Website does not work without them.
• Non-essential cookies, such as analytics or marketing cookies, are not loaded until you agree to them.

When you first visit the Website, our cookie banner lets you accept or reject non-essential cookies; both options are presented equally. You can change your choice at any time through Cookie Settings in the Website footer. You can also block or delete cookies in your browser settings, although some parts of the Website may then stop working.

7. International transfers

We operate in China, and our partners operate in China, the United States, Canada, the United Kingdom, Germany and the other countries through which parcels travel. Your personal data will therefore be transferred to and processed in countries outside the country where you live, including countries that may not have the same level of data protection as yours.

Where the GDPR or UK GDPR applies, we protect these transfers with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, or rely on another lawful transfer mechanism, such as a transfer that is necessary to perform our contract with you, for example handing your address to an international carrier. You can ask us for more information about the safeguards we use through the Contact page on our website.

8. When we act for business customers

If you are a seller who uses our dropshipping or bulk ordering services, you may send us personal data about your own customers, such as names and delivery addresses. We process that data on your behalf and only to fulfil and support your orders. You are responsible for having a lawful basis to share that data with us and for informing your customers. We will assist you with requests from your customers where required by law.

9. How long we keep your data

We keep personal data only for as long as we need it for the purposes described in this policy:

• Account data is kept while your account is open. If you ask us to delete your account, we delete or anonymise your data, except where we must keep it as described below.
• Order, payment, refund and compensation records, including order snapshots, are kept for as long as required by tax, accounting and other legal obligations and for the period during which legal claims may be brought.
• Inquiry threads and attachments are kept while they are needed to handle your inquiry, any resulting order and any related follow-up, unless you ask us to remove a file or delete your data sooner.
• Warehouse photos and inspection records are kept while they are needed to support your order, any claim and our records of the shipment.
• Security and technical logs are kept for a limited period needed to protect the Website and investigate incidents.
• Marketing preferences are kept until you withdraw consent, after which we keep a record of your opt-out so that we respect it.

When data is no longer needed, we delete it or anonymise it so that it can no longer identify you.

10. Your rights

Depending on where you live, you may have the following rights over your personal data.

10.1 European Economic Area and United Kingdom

Under the GDPR and the UK GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict our processing in certain circumstances;
• receive your data in a portable format and have it transferred to another provider;
• object to processing based on our legitimate interests, and object at any time to direct marketing;
• withdraw consent at any time, without affecting processing carried out before withdrawal; and
• lodge a complaint with your local data protection authority, such as the supervisory authority in your EU member state or the Information Commissioner’s Office in the United Kingdom.

10.2 California and other US states

If you are a resident of California or another US state with a comprehensive privacy law, you may have the right to:

• know what categories and specific pieces of personal information we have collected about you, the sources, the purposes and the categories of third parties we disclose it to;
• request deletion of your personal information;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information for cross-context behavioural advertising, and limit the use of sensitive personal information; and
• not be discriminated against for exercising your rights.

We do not sell personal information and we do not knowingly share it for cross-context behavioural advertising. The categories of personal information we collect are described in section 2, the sources in section 2 and the categories of recipients in section 5. You may use an authorised agent to submit a request, and we may ask for proof of the agent’s authority.

10.3 Exercising your rights

You can download or delete your account data from your account settings. You can unsubscribe from marketing emails using the link in any marketing email or in your account settings. For any other request, contact us through the Contact page on our website. We may need to verify your identity before acting on a request. We will respond within the time required by applicable law. If we cannot fully meet a request, for example because we must keep certain records by law, we will explain why.

11. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encrypted HTTPS connections across the Website, hashed passwords, role-based access so that staff see only the data they need, two-factor authentication for administrative accounts, limits on file types and sizes for uploads, keeping payment credentials out of our systems, and regular backups. No method of transmission or storage is completely secure, so please use a strong, unique password and keep your login details confidential.

12. Children

Our services are intended for businesses and for adults who can enter into binding contracts. They are not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us through the Contact page on our website and we will delete it.

13. Third-party websites and services

The Website contains links to third-party platforms, such as the online marketplaces where products are listed, payment providers and carrier tracking pages. Their privacy practices are governed by their own policies, and we are not responsible for them.

14. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. If we make material changes, we will notify you by email or through a notice on the Website before the changes take effect.

15. Contact us

If you have questions about this policy or how we handle your personal data, or you want to exercise your rights, please contact us through the Contact page on our website.