Privacy policy

1. Scope and responsible entity

This policy applies to people who browse this website, create an account, submit a request for quote or review, place or track an order, make a payment, or request after-sales service. XINDA is responsible for personal information processed in operating the website and transactions; the entity named in the formal quotation, order confirmation, or invoice governs the specific transaction.

Independent third-party websites and services have their own privacy notices.

2. Information we process

Information you provide

• Name, employer, department, title, email, phone number, and contact preferences.
• Billing, shipping, tax, procurement, end-user, and end-use information.
• Models, quantities, applications, requested dates, BOMs, drawings, files, and correspondence.
• Account identifiers, address book entries, orders, service requests, and reviews.
• Photos, videos, serial numbers, test results, and repair records related to quality issues.

Transaction and service information

We record quotations, carts, orders, currencies, amounts, payment status, shipping, refunds, invoicing, and support status. Payment providers process sensitive payment credentials directly; we do not store full card numbers or security codes.

3. Sources of information

Information may come from:

• You, your employer, purchasing agent, or a colleague acting for you.
• Account, quotation, checkout, review, email, and service forms.
• Payment institutions, carriers, distributors, and service partners.
• Browsers, server logs, and cookies required for secure sessions.
• Lawful public or authorized sources used for trade compliance, fraud prevention, or business verification.

Before submitting information about someone else, make sure you are authorized and provide them with this policy.

4. Purposes and legal bases

We process information only for appropriate business purposes, including to:

• Respond to inquiries and confirm models, compatibility, price, stock, lead time, and trade terms.
• Manage accounts, orders, payments, delivery, invoices, returns, and repairs.
• Provide support, traceability, safety notices, and product-service information.
• Protect accounts and the website and detect fraud, abuse, security incidents, and duplicate requests.
• Maintain records and meet tax, accounting, quality, and trade-compliance obligations.
• Establish, exercise, or defend legal rights and enforce website and transaction terms.

Depending on the context, processing may rely on a contract or pre-contract request, a legal obligation, legitimate interests, or your consent. You may withdraw consent where applicable without affecting earlier lawful processing.

5. Cookies, logs, and device data

We use cookies and similar storage required for login, carts, checkout, security, language, and currency preferences. Blocking them may prevent those functions from working.

Servers may record IP address, time, path, referrer, browser, device and operating-system information, response status, and security events for operations, troubleshooting, capacity planning, and abuse prevention.

When enabled in administration, Google Analytics 4 may measure traffic and commerce funnels, Microsoft Clarity may analyze interaction and session experience, and Meta Pixel may measure Facebook and Instagram conversions. In opt-in regions these services load only after permission; elsewhere an opt-out model may apply. Events can include page and campaign information, device data, provider identifiers, product or model IDs, currency, value, and quote or order conversion status.

With the relevant analytics or advertising category active, first-party attribution may retain UTM parameters, gclid or fbclid, landing page, referrer, and capture time. First and most recent valid touchpoints may be attached to a quotation or order; a direct visit does not replace an earlier valid campaign source.

We do not send card data, order access tokens, credentials, form bodies, email addresses, phone numbers, or shipping addresses in analytics events. Pages containing payment or order-access credentials remove sensitive query parameters and suspend tools that would read the complete browser URL.

Cookie settings in the footer let you change analytics and advertising choices. Rejecting optional categories does not block product browsing, quotations, carts, accounts, or payments. Do Not Track or Global Privacy Control is honored according to the configured policy.

6. Payments, orders, and accounts

Online payment is available only where an eligible order displays an active, contracted provider. That provider processes payment credentials, device data, identity checks, and fraud signals under its own terms. We receive only the transaction identifier, status, amount, currency, and limited payment-method summary needed to complete the order.

We protect account passwords and never ask you to email a password or full card details. Published reviews show only the submitted content and selected public name; email, order, and moderation records remain private.

7. Service providers and sharing

Where necessary for the purposes above, information may be provided to:

• Hosting, database, object-storage, cybersecurity, and website-operations providers.
• Analytics and advertising providers such as Google, Microsoft, and Meta when the relevant category is allowed.
• Payment, banking, accounting, invoicing, and fraud-prevention providers.
• Email, support, carrier, customs, warehouse, repair, and supply-chain partners.
• Authorized personnel, affiliated service teams, professional advisers, and lawful authorities.

Providers acting for us must use information only for agreed purposes and apply appropriate safeguards. Information may transfer with the business in a merger, reorganization, financing, or asset transaction, subject to confidentiality and law.

8. International processing

Customers, carriers, payment institutions, and technology providers may operate in different countries, so information can be accessed, stored, or processed outside your region. We use contractual safeguards, access controls, data minimization, or other available protections as required.

9. Retention

We keep personal information only while there is a business or legal need, considering record type, order and warranty cycles, security, disputes, tax, accounting, product quality, and trade-compliance duties.

• Account records normally remain until closure and expiry of required security and compliance periods.
• Quotation, order, payment, logistics, invoice, and service records follow transaction and statutory requirements.
• Unsuccessful inquiries remain only as long as needed for follow-up, audit, and abuse prevention.
• Security logs are kept for a limited investigation, recovery, and protection period.
• First-party attribution cookies last no more than 30 days; attached attribution snapshots follow the business record.

After expiry, information is deleted, anonymized, or isolated and restricted in backups until deletion is practical.

10. Information security

We use organizational and technical measures proportionate to risk, including separation of duties, least-privilege access, transport and password protection, logging, backups, and credential management. No internet transmission or storage method is completely secure; suspected incidents are investigated, contained, remediated, and notified as required.

11. Your rights and choices

Depending on applicable law, you may ask for access, correction, deletion, restriction, portability, or objection; withdraw consent; change analytics and advertising choices; or complain to a competent authority.

State the request and relevant account, quotation, or order. We may verify identity, authorization, and scope. Some records cannot be deleted immediately because of transactions, legal duties, disputes, or the rights of others; where applicable, we will explain why.

12. Children, updates, and contact

This site is intended for business, research, and professional purchasers, not children. Contact us if you believe a child supplied personal information without proper authorization.

We may update this policy for service, technology, or legal changes and will revise the version and effective date above. Material changes may also be highlighted on the site. Privacy requests can be sent using the policy contact below.