Privacy Policy
SinoSource Ltd ("SinoSource", "we", "us", "our") is committed to protecting your personal data in accordance with the UK GDPR and the EU General Data Protection Regulation (Regulation (EU) 2016/679). This policy explains what personal data we collect, why we collect it, how we use it, and your rights as a data subject.
Data controller: SinoSource Ltd, a limited company registered in England & Wales under Company No. 17216773. Registered office: Unit A 82 James Carter Road, Mildenhall, IP28 7DE. Contact: info@getsinosource.com.
1. Data We Collect
Information you provide directly
- Contact & enquiry forms: first name, email address, company name, country, plan interest.
- Lead magnet / free guide: email address and optionally company name.
- Onboarding form (post-purchase): name, company, email, language preference, niche, import volume, sales channel, compliance concerns, existing suppliers, and any freetext notes you choose to provide.
- Sourcing requests (client portal): request description and any supporting details you submit.
Information collected automatically
- Server logs: IP address, browser type, pages visited, referrer, timestamps. retained by our hosting provider in standard server logs.
- Optional analytics on public pages: if you accept optional cookies, Google Analytics receives usage events, device/browser information, approximate location, and shortened or otherwise processed network identifiers. Our first-party product-interest analytics also records which public tools were used, referral/UTM context, and an email only when you submit one through a form. Neither analytics system runs in the authenticated portal or admin panel.
- Optional live chat on public pages: if you accept optional cookies, Crisp processes chat messages, contact details you provide, and technical connection data. It is not loaded in the authenticated portal or admin panel.
- Remote fonts: some public pages request font assets from Google Fonts or Bunny Fonts, which may receive your IP address and browser request data. See Google's Privacy Policy and Bunny Fonts information.
Payment data
All payment processing is handled by Stripe, Inc. We never see or store your full card number, CVC, or bank details. Stripe is a PCI-DSS Level 1 certified processor. See Stripe's Privacy Policy.
2. How We Use Your Data
- To fulfil and manage your service (deliver decision reports and monitoring, process payments, send account messages and, when needed, one-time activation codes).
- To respond to contact and support enquiries.
- To send the free EU Compliance Guide you requested.
- To send transactional emails related to your account (e.g. new report available, request update).
- To improve the website and service based on aggregate, anonymised usage patterns.
- To comply with our legal obligations (e.g. invoice retention for tax purposes).
We do not sell your personal data, use it for profiling, or share it with advertisers.
3. Legal Basis Under GDPR
- Contract performance (Art. 6(1)(b)): processing necessary to deliver a subscription you have purchased.
- Legitimate interests (Art. 6(1)(f)): operating the website, preventing fraud, improving the service.
- Consent (Art. 6(1)(a)): optional cookies (beyond strictly necessary), and sending marketing or newsletter emails where you have opted in. You may withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)): retaining financial records as required by applicable tax law.
4. Who We Share Data With
We share personal data only with the following processors and only to the extent necessary:
- Stripe (Stripe, Inc.): payment processing and subscription management. Stripe Privacy Policy.
- Hostinger: website, application, email, and database hosting.
- Brevo: transactional and opted-in marketing email delivery.
- Google (Alphabet Inc.): fonts on some public pages, optional public-site analytics, and Google account sign-in. Google Privacy Policy.
- Bunny.net: font delivery on public pages.
- Crisp: optional live-chat support, loaded only after optional-cookie consent.
- Cloudflare and Anthropic: secure delivery and processing of AI-assisted supplier research requests. We minimise personal data included in research prompts.
All processors are bound by data processing agreements. Stripe and Google may process data outside the EEA under Standard Contractual Clauses.
We may disclose personal data if required to do so by law, or in response to a valid legal request by public authorities.
5. Cookies & Tracking
We use the following cookies:
- Strictly necessary: secure session cookies used by the client portal and admin panel. These are essential for service delivery and do not require consent.
- Functional: first-party cookies such as
sino_consent, sino_theme, sino_lang, and sino_currency store consent and interface preferences. Client, report, request, and admin data is served from the database.
- Optional analytics and chat: on public pages, Google Analytics, first-party product-interest analytics (using the
sino_vid visitor cookie), and Crisp are disabled until you choose “Accept optional” in the cookie banner. Choosing “Essential only” prevents all three from running. None is loaded in the authenticated portal or admin panel.
You can change your choice by deleting the sino_consent cookie and reloading the site. Optional services will remain disabled until you consent again.
6. Data Retention
- Contact & lead magnet submissions: stored in our own database and retained for 24 months from submission, then deleted.
- Sign-in identity: retained while your portal account exists. Self-service account deletion immediately removes the login identity, linked sign-in methods, device links, verification/reset records, and links between that identity and client workspaces.
- Client workspace and service records: reports, supplier evidence, documents, messages, sourcing activity, and other engagement records are normally retained while the service is active and reviewed for deletion or anonymisation within 12 months after cancellation. These records can belong to a client organisation or be shared with other authorised users, so deleting one login identity does not erase the workspace. We may retain a record longer where the client instructs us to, another lawful basis applies, or a legal claim requires it.
- Payment records: retained for the period required by applicable UK accounting and tax law.
- Server logs: typically 30–90 days depending on hosting provider configuration.
7. Your Rights
Under GDPR, you have the following rights regarding your personal data:
- Access: request a copy of the personal data we hold about you.
- Rectification: ask us to correct inaccurate or incomplete data.
- Erasure ("right to be forgotten"): ask us to delete your personal data where there is no compelling reason for continued processing.
- Restriction: ask us to stop actively processing your data (while retaining it) in certain circumstances.
- Portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interests.
- Withdraw consent: where processing is based on consent, you may withdraw at any time without affecting prior processing.
Delete your sign-in identity yourself: if you have a portal account, open the client portal, expand "Delete my account", and confirm. This action is immediate and irreversible for the login identity and the identity-owned records listed in section 6. It disconnects that identity from client workspaces; it does not delete shared or organisation-owned workspace records, reports, uploaded evidence, sourcing activity, or records we must retain.
To request erasure, restriction, or a copy of personal data held inside a client workspace, or to ask us to delete an eligible workspace, contact info@getsinosource.com. We will verify authority over the workspace and respond within 30 days.
For all privacy matters, contact us at: info@getsinosource.com.
If you are not satisfied with our response, you may lodge a complaint with the UK Information Commissioner's Office at ico.org.uk, or with the supervisory authority in the EU/EEA country where you live or work.
Terms of Service
These Terms govern your use of the services provided by SinoSource Ltd, a company registered in England & Wales under Company No. 17216773 ("SinoSource", "we", "us", the "Service"). By purchasing a subscription or using the website, you agree to these Terms. Please read them carefully.
9. Service Description
SinoSource provides supplier decision reports, ongoing monitoring, portal tools, and an optional 90-day Managed execution engagement for European SME importers sourcing from China. Each activation covers the product family and buying scope agreed during onboarding.
The EU-Readiness Score is a comparative intelligence tool, not a legal certification. It reflects our assessment of suppliers based on available documentation and publicly available regulatory data at the time of publication. It does not constitute legal advice, and it does not guarantee that any supplier or product will pass conformity assessment, customs inspection, or market surveillance. You are solely responsible for ensuring your products comply with all applicable EU regulations. Always engage qualified testing laboratories and/or legal counsel for formal compliance verification.
10. Subscription & Billing
- Essential includes an activation and then renews monthly for monitoring until cancelled. Managed is billed over a defined three-month engagement and does not continue at the Managed rate without a new agreement.
- You may cancel Essential at any time via the Stripe Customer Portal link provided in your client dashboard. Cancellation takes effect at the end of the current billing period; you retain access until then. Managed early termination follows the written three-month engagement terms.
- Research and digital report work can begin after onboarding and scope confirmation. Refund and cancellation eligibility follows the published policy and any mandatory rights that apply.
- The founding activation price is limited to the first five eligible Essential clients. Ongoing monitoring is priced separately at the amount shown at checkout.
- We reserve the right to discontinue the Service with 30 days' notice, in which case we will refund any unused portion of the current billing period.
11. Disclaimer & Limitation of Liability
The Service is provided "as is" and "as available." To the maximum extent permitted by applicable law, SinoSource expressly disclaims all warranties of any kind, whether express or implied, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement.
SinoSource shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, data, goodwill, or business opportunity, arising out of or in connection with your use of the Service. even if we have been advised of the possibility of such damages.
Our total aggregate liability to you for any claim arising under these Terms shall not exceed the total fees paid by you in the three (3) calendar months preceding the event giving rise to the claim.
12. Governing Law & Disputes
These Terms are governed by the laws of England and Wales. The courts of England and Wales have jurisdiction, subject to any mandatory consumer protection rules that apply in your country of residence.
EU consumers may also use the EU Online Dispute Resolution platform.
Changes to These Terms
We may update these Terms and the Privacy Policy from time to time. We will notify active subscribers of material changes by email at least 14 days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated Terms.
Questions? Email us at info@getsinosource.com
