Privacy notice

The controller for the DRAIXCOR Platform is Nanjing Siluhuacheng Technology Co., Ltd. (南京丝路华承科技有限公司), Room 319, No. 20 Xiaowei Street, Xuanwu District, Nanjing, 210018, P.R. China. Legal representative: Hua Haiyan. Privacy and rights requests: draixcor@163.com.

No data protection officer is currently appointed. GLOBEREX SPAIN SOLUCIONES SLU is disclosed as a product-safety representative only and is not automatically the representative under Article 27 GDPR. Because the controller is outside the EEA and targets EU customers, the Article 27 position and, if required, the correct EU privacy representative must be finalised before paid commercial launch.

This notice covers visitors, registered buyers, prospective and approved sellers, reviewers and people contacting support. DRAIXCOR controls Platform accounts, security, seller onboarding, marketplace oversight, advertising administration and the shared support record.

For a marketplace order, the disclosed seller may be an independent controller for data it needs to accept, deliver, invoice, handle conformity or comply with law. The seller must give any additional notice it requires. DRAIXCOR does not authorise a seller to use buyer data for unrelated marketing.

You provide identity and contact data, login email, addresses, account preferences, basket and order details, messages, return or refund evidence, reviews and consent choices. Sellers provide business identity, representatives, register, bank and tax data, listings, product-safety and EPR evidence, team members and support replies.

The service generates order and payment status, shipment events, timestamps, audit records and security logs such as IP address, device/browser information and request identifiers. Essential browser storage records the basket, compare list and consent choice. Data may also come from the responsible seller, payment or logistics provider, public registers, product-safety authorities and fraud or compliance checks.

Article 6(1)(b) GDPR: create and authenticate accounts, take pre-contract steps, process orders, route messages, returns and refunds and provide requested seller functions. Article 6(1)(c): tax, accounting, product safety, recalls, marketplace trader traceability, consumer, EPR and authority duties.

Article 6(1)(f): secure the service, prevent fraud and abuse, keep audit evidence, improve non-optional reliability, defend claims and perform proportionate marketplace moderation. Article 6(1)(a): optional analytics, personalised advertising, marketing email or another feature that expressly asks for consent. Consent can be refused or withdrawn without losing basic shopping access.

Supabase provides the email/password authentication service. The project is configured in the Central EU (Frankfurt) region. Supabase receives login identifiers, encrypted authentication credentials, confirmation and recovery events, session tokens and security metadata needed to operate the account.

DRAIXCOR records the legal-text version, language and time accepted at registration. Passwords are not visible to DRAIXCOR staff. Confirmation and recovery links must be kept private; support will never ask for a password. Provider subprocessors and any relevant transfer safeguards remain governed by the service contracts and the international-transfer section below.

Data is disclosed on a need-to-know basis to the seller identified on an order, authentication and hosting providers, payment providers shown at checkout, warehouses, carriers, return and repair partners, communication and email providers, professional advisers, auditors and insurers. Authorities receive data only where lawfully required or needed for product safety.

A marketplace seller receives only the order, delivery and case information necessary for its contract and duties. DRAIXCOR keeps the shared case history for oversight. We do not sell personal data. If the business or Platform is reorganised, data may transfer subject to confidentiality, purpose limitation and required notice.

The controller is established in China, so authorised access from China can be an international transfer. Some providers or subprocessors may also operate outside the EEA. Where no adequacy decision applies, DRAIXCOR must use an appropriate mechanism such as the European Commission Standard Contractual Clauses, assess transfer risks and apply supplementary technical and organisational measures where necessary.

You may request information about the relevant safeguard or a copy with protected commercial or security details redacted. Paid launch remains conditional on completing and documenting the processor list, data-processing agreements, transfer mechanism and EU-representation analysis.

Account data is kept while the account is active and then deleted or anonymised after closure unless it remains linked to orders, safety events or claims. Order, invoice and tax records are kept for the statutory period, commonly eight to ten years depending on the record and applicable country. Seller traceability data is retained for at least the period required by the DSA and longer only where another duty or claim requires it.

Support, return and refund files are normally kept through the applicable limitation period; security logs only for a proportionate period unless an incident requires preservation; consent records while the choice is active and as long as needed to prove compliance. Legal holds, recalls and authority orders can extend a period. Data is then deleted, anonymised or access-restricted.

Subject to the legal conditions, you may request access (Article 15), rectification (16), erasure (17), restriction (18), data portability (20) and object to processing based on legitimate interests or direct marketing (21). You may withdraw consent at any time; withdrawal does not affect earlier lawful processing.

Send a request to draixcor@163.com. We may verify identity and normally respond within one month, with any lawful extension explained. You may complain to the data-protection authority in your habitual residence, workplace or the place of the alleged infringement, and you retain the right to a judicial remedy.

DRAIXCOR does not currently make a solely automated decision that produces legal or similarly significant effects for a buyer. Security or fraud rules may flag activity, but a materially adverse decision should be reviewable by a person. If this changes, the notice and legally required safeguards will be updated before use.

Contextual advertising may use the page, category or search currently viewed without a cross-site profile. Optional measurement or personalised advertising stays off until valid consent is recorded. Seller advertising reports should use aggregated or appropriately minimised data unless a lawful, disclosed basis permits more.

DRAIXCOR uses role-based access, encrypted transport, secure session cookies, audit logging, separation of seller access and protected evidence storage appropriate to the risk. No internet service is absolutely secure. Users should use a unique password, protect email access and report suspected compromise promptly.

Where a personal-data breach creates a legal notification duty, DRAIXCOR will notify the competent authority and affected people within the applicable time and with the information required by law. Access is limited to staff and providers who need it and are bound by confidentiality or equivalent duties.

The shop and buyer account are not directed to children. A person without legal capacity must not register or order independently. If we learn that a child’s data was collected without a valid legal basis or required guardian involvement, we will restrict the account and delete the data unless retention is legally required.

Strictly necessary storage includes Supabase authentication cookies after sign-in, “draixcor-consent” for the privacy choice, “draixcor_cart_v1” for the requested basket, “draixcor_compare_v1” for the comparison list and temporary “draixcor_payment_mode” session storage during checkout. These support a service requested by the user, security or the consent record and do not load optional analytics.

At this version, no optional analytics or personalised-advertising cookie is activated. If one is introduced, it must be listed here or in the preference panel with provider, purpose and duration, remain off before consent and be as easy to reject or withdraw as to accept. Browser controls can delete storage, but doing so may sign the user out or clear local basket and preferences.

This notice is updated when data use, providers, law or Platform functions materially change. The date and version are shown on the page; material account-related changes are communicated appropriately. An updated notice does not convert a legal basis or revive withdrawn consent.

Questions, rights requests and privacy complaints: draixcor@163.com. Product-safety questions can use the same address but are handled under the product-safety process.