Privacy Policy

Who operates this website

Doublefly Industry is operated by Ningbo Doublefly Industry And Trade Co., Ltd (宁波双翔工贸有限公司), unified social credit code 91330205MA2CMXXF4R. Our registered address is Room 1-23, Building 008, No. 7 Hongxing Road, Jiangbei District, Ningbo, Zhejiang, China. For privacy questions, contact sales@nbdoublefly.com. Johnson handles privacy requests, with Yasline as authorised cover.

Scope of this notice

This notice covers browsing our company website and contacting us directly by business email about corporate procurement. Our manufacturing and sourcing services are offered to company legal entities. This website does not accept online inquiry submissions, provide customer accounts or take online payments. We do not deploy advertising pixels or optional analytics.

Information used when you browse

Our delivery and security provider, Cloudflare, handles technical request information needed to deliver and protect the website. This can include your IP address, requested resource, request time, browser information and security-related signals. We do not build advertising profiles or use this information to track your browsing across unrelated websites.

Our application records limited security event codes and UTC timestamps, such as whether a request was served or access was refused. These application records do not contain inquiry text, email contents, passwords, URL query strings or a visitor IP address. We have configured a private Cloudflare R2 archive restricted to EU jurisdiction for necessary network security records. The configured export for nbdoublefly.com contains the client IP address, UTC request time, request correlation ID, requested host, HTTP method, URL path without its query string, response status and the security action when available. It excludes Cookie and Authorization headers, full query strings, message bodies and email contents. Provider-controlled technical records are separate from these application records. Access to our administrative service is restricted to authorised staff.

Information in direct email correspondence

If you choose to email us, we receive the sender address, message and attachments that you send, together with normal email delivery information. A message may include your name, business contact details, company, role and sourcing requirements. Please provide only information relevant to your business inquiry, and do not send payment credentials, identity documents or sensitive personal information.

The email link opens your own email application. This website does not send the message for you and does not copy it into the website inquiry database. We use Alibaba enterprise mail to receive and manage this correspondence. Our authorised team in China reads and responds to it; the website does not make messages publicly available.

Purposes and legal grounds

We use necessary technical information to deliver the website, prevent unauthorised access, investigate faults and protect the service. We use relevant business correspondence to answer your request, discuss product requirements, prepare a quotation or sample discussion and conduct proportionate follow-up related to your project. We do not treat an email inquiry as permission for unrelated marketing.

Where EU or UK data protection law applies to a particular activity, we assess our legitimate interests in operating a secure service and answering the relevant business request against your rights and reasonable expectations. We use a contract ground only when its conditions apply to the individual concerned, rather than assuming an employee is personally a party to their company’s contract. Under applicable Chinese law, necessary security records support our legal security obligations; where consent is required for correspondence or another activity, it must be informed, voluntary and specific to that use. An email request is not blanket consent to marketing, new purposes or unrestricted disclosure. You may withdraw applicable consent, object to relevant processing or ask us to stop non-essential follow-up.

Service providers and international processing

Cloudflare provides website delivery and security. Its global delivery and authorised processing can involve different countries. Cloudflare's applicable Customer Data Processing Addendum includes EU Standard Contractual Clauses and UK Addendum provisions for transfers to which those clauses apply.

Alibaba enterprise mail, whose published policy identifies Alibaba Cloud Computing Ltd. (阿里云计算有限公司) as the service provider, provides our direct business email service. Our company and authorised staff are based in China, where correspondence is accessed and handled. If you email us from another country, this involves sending information to our business in China. The applicable arrangements must be assessed for the particular provider and transfer; Cloudflare's agreement does not cover a separate disclosure to another provider. Contact us for information about the arrangements relevant to your information.

We do not copy incoming email messages into a public website database. Access to business correspondence is limited to authorised staff and necessary service providers. We may disclose limited information when required by applicable law or necessary for a properly assessed legal claim.

How long information is kept

Our minimal application-side security event records are retained for at least six calendar months, subject to relevant legal or security holds. This showcase does not run automatic deletion of these application records. Authorised staff must review retention and approve any deletion separately after the minimum period and any required preservation have ended. Our private R2 network log archive has an automatic expiry rule of 184 days, covering at least six calendar months. Lifecycle removal is asynchronous, so it may not occur at the exact expiry instant. Any necessary preservation required by law is assessed and access-restricted separately. Cloudflare-controlled service and security records follow the applicable service settings and provider arrangements; these are not represented as six-month application records. We review the records needed for security and applicable legal requirements and restrict access to them.

Unconverted business correspondence enters manual review 12 months after the last interaction. Review should be completed within 30 days. A further retention period requires a recorded reason and is limited to 90 days at a time. If there is no continuing necessary and lawful reason to retain the information, authorised staff delete or anonymise it. Agreed orders, financial records, disputes and other legal obligations may require a different justified period.

Mailbox-provider recovery copies and security records may follow separate service schedules and legal requirements. We do not promise immediate removal of every provider-controlled recovery copy. Necessary deletion and restriction instructions are retained to prevent inappropriate reuse after a recovery.

Cookies, security and external email applications

We do not deploy optional analytics or advertising cookies in this version. Necessary delivery, security or administrative authentication services may use essential technical storage where needed. The public Contact page does not load an inquiry challenge widget. Your own email provider and application handle the email you choose to send under their arrangements.

We use HTTPS, protected administrative access, restricted permissions, server-side secret management and security records. No technical service can guarantee absolute security.

Your rights and how to contact us

Depending on applicable law, you may request access, correction, deletion, restriction or portability of your information, or object to processing. Where processing relies on consent, you may withdraw it without affecting lawful prior processing. Email sales@nbdoublefly.com. We use proportionate checks to verify a request and do not request identity documents by default.

We normally respond to EU or UK GDPR rights requests within one month. Where the applicable law permits an extension, we explain the reason within the initial period. Other applicable deadlines and lawful exceptions are assessed for the request. You may complain to the competent data protection authority, including the UK Information Commissioner where applicable.

Changes to this notice

We update this notice when the website or approved processing arrangements change. The published notice shows its version and effective date.