Privacy Policy

Who Is Responsible for Your Data

The data controller for this website, the customer dashboard and the TruMark QC Store is Huizhou Bolang Technology Co., Ltd., trading as TruMark QC. Unified Social Credit Code 91441381MACXR9203L. Registered office: Room 05-06, 9/F, Zhongrun Da Building, No. 8 Science and Technology Road, West District, Daya Bay, Huiyang District, Huizhou, Guangdong 516083, China.

For any question about your personal data, or to make any of the requests listed under Your Rights, write to hello@trumarkqc.com. A person reads that address; there is no separate privacy mailbox to get lost in.

Information We Collect

When you use our services or interact with our website, we may collect the following information:

• Full name, email address, phone number, and company name
• Factory addresses and supplier contact details
• Product specifications, order details, and inspection requirements
• Inspection data including photographs, measurements, and test results
• Store order requests — your contact details, shipping address, and the products you request when you submit an order through the TruMark Store
• Billing and payment information processed through secure third-party processors
• Ordinary server request logs generated when your browser loads a page — the page requested, the time, your IP address, your browser's user-agent string, and the referring page
• Aggregate usage measurements from Cloudflare Web Analytics, which runs on every page — page views, the page or search engine that referred you, how long the page took to load, and the browser, operating system and country your browser already discloses with any request. It is cookieless: it sets no cookie, stores nothing on your device, gives you no identifier, and cannot follow you to other websites
• Google Analytics measurements — only if you have accepted analytics on this device. If you have, Google Analytics sets its own cookies, keeps a random identifier in your browser, and the measurements go to Google as well as to us. Until you click Accept, the Google script is never loaded and nothing is collected this way. Our Cookie Policy describes both services in full, and you can change your answer at any time

How We Use Your Information

• Service delivery — scheduling inspections, coordinating with inspectors, generating reports
• Communication — sending inspection updates, service notifications, and responding to inquiries
• Reporting — compiling inspection reports, quality analytics, and trend data for your account
• Account management — maintaining your dashboard, preferences, and service history
• Analytics — page-view, referrer and page-speed figures, used to decide which pages to rewrite and which are too slow. From Cloudflare Web Analytics they are aggregate counts with no identifier attached. From Google Analytics, which runs only if you accepted it, they are attached to an identifier held in your browser. Neither is sold, and Google's advertising signals stay off: the consent settings we send deny ad storage, ad personalisation and ad user data, and accepting analytics does not turn any of them on

Our Legal Basis for Each Purpose

• Orders, quotes, bookings and your customer account — performance of a contract with you, or the steps leading up to one at your request (Art. 6(1)(b)). If you ask us to quote an inspection, we need the product, the factory and a way to reply to you; without them there is nothing to quote.
• Answering enquiries — our legitimate interest in replying to someone who has contacted us (Art. 6(1)(f)). You can ask us to delete the enquiry afterwards.
• Keeping the site and the accounts secure — our legitimate interest in preventing abuse (Art. 6(1)(f)). This is the only reason we keep sign-in attempt counters and session records, and it is why those records exist at all.
• Invoicing and tax records — compliance with a legal obligation (Art. 6(1)(c)).
• Google Analytics — your consent, and nothing else (Art. 6(1)(a)). Decline or ignore the banner and no analytics data is collected. You can withdraw it at any time from our Cookie Policy.
• The newsletter — your consent (Art. 6(1)(a)). Every issue carries an unsubscribe link, and unsubscribing withdraws it.

Data Sharing

We do not sell, rent, or trade your personal data. Your information is shared only with:

• Assigned inspectors — limited to the factory address and inspection scope required to perform their duties
• Laboratory partners — product samples and relevant specifications for testing purposes only
• Payment processors — encrypted billing data necessary to process transactions securely
• Order-processing and messaging tools — store order requests are routed through our workflow-automation and customer-relationship systems so our team can confirm availability and invoice you; if you provide a WhatsApp number, we may reply to you on WhatsApp
• Shipping carriers — your name, shipping address, and contact number, as required to deliver store orders
• Cloudflare, our hosting and infrastructure provider — every request you make to this site reaches Cloudflare before it reaches us, so it necessarily receives your IP address, your browser's user-agent string, the page you asked for and the page that referred you. It also runs the cookieless page-view measurement described above and holds those aggregate counts on our behalf. This is disclosed here because a list that says "only" has to be complete, and a host is a recipient of your data whether or not anyone thinks of it as one
• Google — only if you have accepted analytics on your device. In that case your page views and the identifier Google Analytics keeps in your browser go to Google. Decline, or never answer, and nothing reaches Google at all

The Companies That Process Data for Us

These are the companies that handle personal data on our behalf, what each one receives, why, and where it is established. There are no others.

• Cloudflare — hosting, the customer-account database, and the cookieless page-view measurement. Receives every request you make to this site, which necessarily includes your IP address, your browser's user-agent string and the page you asked for, plus whatever you type into a form. Established in the United States and operating a global network; your request is served by whichever of its locations is nearest you.
• Google (Analytics 4) — page views, referrers and page timings, tied to an identifier in your browser. Only if you accepted analytics. Established in the United States.
• Resend — transactional email. Receives your name, email address, company and the contents of what you submitted, because that is what the notification to our team and the confirmation we send you both contain. Established in the United States.
• Supabase — the database behind our legacy request system, which holds order, quote and report records. Receives the contact details and order contents you submit through it. Established in the United States; the region in which your records are stored is not confirmed at the date of this policy and will be stated here once it is.
• SendGrid (Twilio) — outbound mail sent by the same legacy request system. Receives your email address and the message. Established in the United States.
• Anthropic — two AI assistants. One reads each quote request submitted through the quote form on this website and gives it a priority score that our team sees beside the request; it receives what you typed into that form (name, email address, company, phone, product, quantity, factory city and notes). The other is the support chat inside the customer dashboard: when you use it, it receives your message together with your name, email address and service tier so it can answer you in context. Neither decides anything about you on its own, and Anthropic receives nothing from a visitor who submits no quote and uses no chat. Established in the United States.
• Microsoft (Microsoft 365) — hosts our email. Every email you send us, our replies, and the notifications our systems send our team about what you submitted are stored in that mailbox. Established in the United States.
• WhatsApp (Meta) — only if you message us on WhatsApp or ask us to reply there. It receives your phone number and the messages you exchange with us. Established in the United States; for users in the EU and EEA the service is provided by WhatsApp Ireland Limited.

None of these companies may use your data for its own purposes. We do not sell, rent or trade personal data to anyone, and there is no advertising network anywhere on this site.

Data Security

We implement industry-standard safeguards to protect your data:

• Encryption in transit (HTTPS) for every page, form and sign-in on this site
• Encryption at rest by our hosting providers, as described under The Companies That Process Data for Us
• Access to customer records limited to signed-in TruMark QC staff
• Rate limiting and session records kept for the sole purpose of preventing abuse of the accounts

Data Retention

• Inspection reports and associated photographs are retained for 7 years from the date of inspection
• Account data is retained for the duration of your business relationship plus 2 years after closure
• Store order request records (contact, shipping address, order contents) are retained in line with our invoicing and tax record-keeping obligations
• Every form submission — quotes, bookings, store order requests, partner and billing enquiries — is kept as a business record of what we were asked to do. You can ask us to delete yours. Write to hello@trumarkqc.com and we will remove the contents and your contact details, keeping only the fact that a request of that type was received on that date where we need it for our accounts
• Server request logs are kept only as long as needed to operate and defend the site, and are never used to build a behavioural profile of you
• Cloudflare Web Analytics measurements are held by Cloudflare on our behalf for its own standard retention period. They are aggregate counts with no cookie and no device identifier attached, so there is no record there to single you out of
• Google Analytics data — collected only from visitors who accepted analytics — is held by Google on our behalf under the retention setting on our property. Turning analytics off from our Cookie Policy deletes the identifier from your browser and stops any further collection

Your Rights

In compliance with the GDPR, the CCPA, China's Personal Information Protection Law (PIPL) and other applicable data protection regulations, you have the right to:

• Access — request a copy of all personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your personal data, subject to legal retention requirements
• Export — receive your data in a portable, machine-readable format
• Objection and restriction — object to processing we carry out on the basis of our legitimate interest, or ask us to restrict it while a question is resolved
• Withdraw consent — for analytics, from the control on our Cookie Policy; for the newsletter, from the unsubscribe link in any issue. Withdrawing is as easy as giving it and costs you nothing else

To exercise any of these rights, contact us at hello@trumarkqc.com. We will respond within 30 days.

If you think we have handled your personal data wrongly, please tell us first — but you do not have to. You may lodge a complaint with the data-protection authority in your country of residence, and nothing in this policy restricts that right.

International Transfers

Our operations are in China, and our controlling entity is registered there — see section 1 of our Terms of Sale. If you are in the EU, the UK or elsewhere, using this site necessarily transfers your data out of your country: to us in China, and to the processors listed under The Companies That Process Data for Us.

Six of those — Resend, SendGrid, Supabase, Anthropic, Microsoft and WhatsApp (Meta) — are established in the United States. Google is too, and receives data only if you accepted analytics. Cloudflare is US-established and serves your request from whichever of its global locations is nearest you, so your request may be handled anywhere on that network. We rely on each provider's standard data-processing terms, which incorporate the European Commission's Standard Contractual Clauses, for the transfers we make to them.

Cookies

We set one cookie of our own, and only when you sign in: a strictly necessary session cookie that keeps you signed in (described in our Cookie Policy). No advertising or cross-site tracker is loaded anywhere on this site. One measurement script runs on every page whatever you choose — Cloudflare Web Analytics — which counts page views, referrers and page-load times. It is cookieless: it stores nothing on your device, holds no identifier for you, and cannot recognise you on another site.

Google Analytics is the one thing here that does set cookies, and it runs only if you say so. A banner asks on your first visit; until you click Accept, no Google script is loaded and no analytics cookie exists on your device. If you do accept, Google Analytics sets its own cookies and keeps an identifier in your browser until you change your answer — which you can do at any time from the control on our Cookie Policy page. Cookie Settings in the footer of every page takes you there.

We also keep a small amount of data in your browser's own storage — your store cart, your dashboard session, your interface settings, your answer to the analytics question, and any form submission waiting to be retried. Our Cookie Policy lists every item, what it is for, when it is written, and how to clear it.

Contact Us

For any privacy-related question, or to make any request under Your Rights:

Email: hello@trumarkqc.com

Controller: named in full in section 1 of our Terms of Sale — see the note at the top of this policy.

Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date.