LLegal

Privacy policy

What we collect when you send an enquiry, why we collect it, who processes it on our behalf, and how to have it removed.

Applies tobocasteel.com
Data controller
Effective from[TBC] date of publication
Contact for data requests

1 — Who we are

The company behind this site

This website is operated by , a steel furniture manufacturer based in Wuyi County, Jinhua, Zhejiang, China. is the export brand used on this site; it is the same company, not a separate reseller.

For the purposes of data protection law, that company is the controller of the personal data described below. Data protection questions and requests go to .

ARegistered name —
BRegistration number — [TBC] unified social credit code, to be confirmed against the business licence
CRegistered address — [TBC] full street address, to be confirmed
DPlant address — Wuyi County, Jinhua, Zhejiang, China; street detail [TBC]
EEmail —

2 — Scope

What this site does, and does not do

This site is a product catalogue and an enquiry channel for business buyers. There is no online checkout, no customer account, no payment page and no newsletter subscription.

Because of that, we collect far less than a retail site would. We do not ask for payment details, and we do not build profiles of individual consumers. The only form on the site is the quote request at /request-a-quote.

If you contact us through WhatsApp instead of the form, that conversation is handled by WhatsApp under its own privacy terms; we receive your phone number, your profile name if you have set one, and the content of the messages you send.

3 — What we collect

The data, field by field

Everything below comes either from what you type into the enquiry form or from the standard technical data any web server receives.

IdentificationYour name and company name, so a quotation can be addressed and followed up.
Contact detailsEmail address, and a WhatsApp or telephone number if you choose to give one.
MarketDestination country, used to work out freight, compliance requirements and voltage or standard variants.
RequirementProduct category, quantity, and the message you write. Please do not include personal data about other people in the message field.
AttachmentsDrawings, spec sheets or photos you upload in support of a quotation. These may contain your own customer's information, so send only what is needed for the quote.
Technical dataIP address, browser type, the page requested and the time of the request, recorded by our hosting and security provider as part of normal operation and abuse prevention.
Analytics and advertising dataOnly where the tags described in section 5 are active: pages viewed, approximate location derived from IP, device type and campaign parameters. See section 5 for the current status of each tag.

We do not ask for, and do not want, special category data (health, religion, political views and similar). If you send it anyway, we will delete it once the enquiry is closed.

4 — Why we use it

Purposes, and nothing beyond them

01Answering your enquiry — preparing a price, a lead time and a drawing-based proposal.
02Sampling and production — where an enquiry becomes an order, the same details are used to build and ship it.
03Records and legal obligations — export documentation, tax and accounting records, and defence of legal claims.
04Site improvement — understanding which categories and pages buyers actually look at.
05Advertising measurement — where advertising tags are active, measuring whether a campaign produced enquiries rather than only clicks.
06Abuse prevention — blocking spam submissions and automated scraping of the catalogue.

Where EU or UK law applies, we rely on: performance of a contract or steps taken at your request (purposes 01–03); our legitimate interest in running and improving a B2B website (purposes 04 and 06); and consent where required by local law for analytics and advertising cookies (purpose 05). You can withdraw consent at any time by contacting us or by changing your browser settings.

5 — Cookies and tags

What runs on the pages today

Cookies are small files a site stores in your browser. This site uses very few, and the advertising and analytics tags are being added as the site goes live — the current status of each is stated below rather than described as if it were already running.

AGoogle Fonts — active. Font files are requested from Google's servers, which means your IP address is visible to Google when a page loads. No cookie is set by this site for fonts.
BCloudflare — active. Hosting, CDN and security. Sets strictly functional cookies where needed for protection against abuse.
CGoogle Analytics 4 — [TBC] status: being connected. When active it sets first-party cookies (names beginning _ga) and reports aggregated traffic: pages, referrers, approximate location, device type.
DMeta Pixel — [TBC] status: being connected. When active it sets cookies (names beginning _fbp) and sends page and event data to Meta Platforms for advertising measurement and audience building.
EConsent tool — [TBC] a cookie banner will be added before advertising runs in regions that require prior consent. Until it is in place, advertising tags are not enabled for EU or UK traffic.

You can block or delete cookies in your browser at any time; the site will still work. You can also opt out of Google Analytics with Google's browser add-on, and adjust advertising preferences in your Google and Meta account settings.

6 — Who processes it

Processors, not buyers

We do not sell personal data, and we do not pass enquiry details to unrelated third parties for their own marketing. The categories below are the processors that make the site work.

Form handlingThe quote request form is delivered through a form-processing service (currently Formspree) that receives the submission and forwards it to our inbox. It stores submissions for a limited period on our behalf.
EmailBusiness email is hosted by Google (Google Workspace). Enquiry emails and their attachments reside in that mailbox.
Hosting and securityThe site is served through Cloudflare, which processes request data as a content delivery and security provider.
AnalyticsGoogle Analytics 4, where active, processes aggregated usage data on our behalf.
AdvertisingMeta Platforms, where the Pixel is active, processes event data for campaign measurement.
Logistics and customsWhere an enquiry becomes a shipment, the consignee details and documents needed for export are shared with the freight forwarder, carrier and customs broker handling that shipment.
Professional advisersAccountants, auditors or lawyers, where necessary to comply with the law or to establish or defend a legal claim.

Where we are legally required to disclose data — for example a lawful request from a competent authority — we will disclose only what the request covers.

7 — Where it goes

International transfers

Our own operations are in China. Several processors listed above run infrastructure outside China, mainly in the United States and the European Union, so enquiry data may be transferred to and stored in those regions.

Where the law requires safeguards for a transfer out of the EEA or the UK, we rely on the standard contractual clauses published by the European Commission, together with the processor's own technical and organisational measures. Contact us if you need the detail of the arrangement that applies to a specific processor.

8 — How long

Retention

Enquiry records are kept while the request is live, then for as long as needed to deal with a resulting order, warranty claim or legal obligation.

Our working retention periods: enquiries that do not become orders — [TBC] months, after which they are deleted from the form service and the mailbox; order, invoice and export records — kept for the period required by Chinese accounting and tax law, and for as long as a warranty or claim could still be brought.

Analytics data is retained in aggregated form according to the analytics property's retention setting ([TBC] once configured). Server logs held by the hosting provider follow that provider's own retention period.

9 — Your rights

Asking for a copy, a correction, or deletion

One route for all of it: write to with the subject line “Data request”. You do not need to use a form.

AAccess — ask what we hold about you and receive a copy.
BCorrection — ask us to fix inaccurate contact or company details.
CDeletion — ask us to delete an enquiry. We will delete it from the form service and the mailbox, and tell you when it is done. Records we must keep for tax, customs or a live claim are the only exception, and we will say which ones and why.
DObjection and restriction — ask us to stop using your data for advertising measurement, or to restrict processing while a request is checked.
EPortability — ask for the data you gave us in a structured, machine-readable file.
FComplaint — you may complain to your local data protection authority. If you are in the EU or UK, that is the authority where you live or work.

We answer data requests within 30 days. If a request is complex or we receive several from the same person, we may extend that period and will tell you why. We may ask for enough information to confirm that the request relates to you, because we do not want to hand one company's enquiry to another.

10 — Security

How it is protected

The site is served over HTTPS end to end. Access to the enquiry mailbox is limited to staff who answer quotations, protected by two-step verification, and the form service is restricted to submissions coming from this domain.

No system is perfect. If a breach affects your data and creates a risk to your rights, we will notify you and the competent authority as required by applicable law.

11 — Children

Business buyers only

This site sells to businesses. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has sent us information, write to the address above and we will delete it.

12 — Changes

Updates to this policy

If the way we handle data changes — for example when the analytics or advertising tags go live, or when a new form service is used — this page is updated and the effective date below changes. The version published here is the one that applies.

Version 1.0 · Effective from [TBC] · Last reviewed [TBC]

13 — Contact

Where to write

For any question about this policy, or to exercise a right described in section 9:



Wuyi County, Jinhua, Zhejiang, China

Terms of use →