Politique de confidentialité

1. Who we are

NEXA Global Space Solutions ("NEXA", "we", "us") is an exporter of interior, joinery and building-material packages. Our operations base is in Foshan, Guangdong, China. We are the controller (and, where the GDPR applies, the data controller responsible for the processing described below) of the personal data collected through nexadeco.com.

Privacy contact for all requests and questions: danizhi@nexadeco.com or +86 153 7390 9896 (WhatsApp, 24/7). We do not operate a statutory data protection officer; our export compliance team handles privacy requests and answers within 30 days.

2. What this policy covers

This policy explains what personal data we collect when you browse our website, submit a request for quotation (RFQ), ask for a sample box, or correspond with our sales and engineering teams; why we collect it; how long we keep it; who we share it with; and the rights you have under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). It does not cover third-party websites we link to.

3. Personal data we collect

Category	Examples	How we get it
Identifiers	Full name, business email address, company or architecture studio, destination country and city	You type it into our RFQ form, sample-box form or an email to us
Business and project information	Project type, budget range, target timeline, products required, estimated volume in square metres, project requirements, optional cloud link to drawings or floor plans	You provide it in the same forms
Commercial records	Quotations, order confirmations, delivery terms, correspondence, claims and inspection reports	Created while we prepare or perform your order
Internet and device data	IP address, user agent, requested URL, timestamp, referrer, screen size, and a parsed device/browser/operating-system label; for statistics, a salted one-way hash (SHA-256, truncated to 16 hexadecimal characters) derived from your IP address	Recorded automatically by our server, security tooling and first-party visit counter
Staff account data (admin area only)	Username, business email, full name, role, bcrypt password hash, sign-in timestamps and IP addresses, audit trail	Created when NEXA staff accounts are provisioned

We do not collect special-category data (health, biometric, political, religious or trade-union data), we do not intentionally collect data from children, and we do not use automated decision-making or profiling that produces legal effects. Please do not send us identity documents, payment-card numbers or other sensitive material through the website forms.

4. Why we use your data and our legal bases

Purpose	Legal basis (GDPR Art. 6)
Answering your RFQ, preparing quotations, sample boxes and technical specifications	Steps taken at your request before entering a contract, and performance of a contract
Producing, inspecting, shipping and supporting your order, including claims handling	Performance of a contract
Protecting the website against spam, scraping, credential attacks and abuse; keeping security and audit logs; rate-limiting sign-in attempts	Legitimate interests in keeping our systems and our customers' data safe
Understanding which pages are useful through first-party, cookie-less statistics	Consent where required (you can reject non-essential storage in the cookie banner), otherwise our legitimate interest in improving the website
B2B follow-up about products and projects relevant to your enquiry	Legitimate interests in developing our business with professional contacts; consent where local law requires it
Accounting, tax, export and customs documentation, sanctions screening	Compliance with legal obligations

Where we rely on legitimate interests, we have balanced those interests against your rights: the data involved is business contact data, the impact on you is limited, and you may object at any time (see section 9). You can withdraw consent at any time without affecting processing carried out before withdrawal.

5. Cookies, local storage and analytics

We do not set advertising or cross-site tracking cookies. Our website uses essential browser storage only: your language choice, your cookie-banner choice, and — for signed-in NEXA staff — an admin session token. Our visit statistics are first-party and cookie-less: we store the page path, the referring page, the screen size and a parsed device/browser/OS label, together with a salted hash of the IP address that cannot be reversed into the original address. The full inventory, durations and browser controls are in our Cookie Policy.

6. Who we share data with

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share it only with:

• Hosting and infrastructure providers that operate our website and email under our instructions (currently Hostinger).
• Freight forwarders, carriers, customs brokers and inspection agencies where this is necessary to quote, ship, clear or inspect your order.
• Professional advisers (accountants, auditors, lawyers) bound by confidentiality, and authorities where the law or a valid legal request requires it.
• Communication and design tooling that our team uses to answer you (business email; font delivery through Google Fonts; WhatsApp when you choose to click a chat link).

Processors act only on our documented instructions and are bound by confidentiality and security obligations.

7. International transfers

We are established in China and our hosting and team are primarily located there and in the region where our hosting provider operates. When personal data of individuals in the European Economic Area, the United Kingdom or Switzerland is transferred to us or to a processor outside those areas, we rely on appropriate safeguards: the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), together with encryption in transit and access controls. You may request a copy of the relevant safeguards by writing to the contact address above.

8. How long we keep data

Record	Retention period
RFQ, quotation and correspondence records	36 months after our last contact with you, then deleted or anonymised
Order, invoice, customs and warranty records	As long as tax, export and warranty law requires, then deleted
First-party visit statistics (aggregate)	14 months
Server and security logs (including salted IP hashes)	90 days
Failed admin sign-in audit records	24 months
Database backups	14 days on a rolling schedule
Admin/staff accounts	For the life of the account plus 12 months, then deleted or anonymised

9. Your rights

Subject to the conditions in the applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy;
• Rectify inaccurate or incomplete data;
• Erase data that we no longer need for the purpose it was collected;
• Restrict processing while a dispute about accuracy or lawfulness is resolved;
• Object to processing based on our legitimate interests, including direct B2B follow-up;
• Portability — receive data you provided in a structured, machine-readable format or have it transmitted to another controller;
• Withdraw consent at any time, for example by rejecting or changing your cookie choice;
• Lodge a complaint with your local supervisory authority (in the EU/UK, the data protection authority of your country or region).

To exercise any right, email danizhi@nexadeco.com with "Privacy request" in the subject line. We respond within 30 days and will ask you to confirm your identity only to the extent necessary. Exercising your rights is free of charge, and we will not discriminate against you for doing so.

10. California privacy notice (CCPA/CPRA)

If you are a California resident, this section applies to you. In the last 12 months we have collected the following categories of personal information: identifiers (name, business email, company, country/city, IP address); commercial information (products, quantities, budget range, purchase and delivery records); internet or network activity (pages viewed, referrer, device/browser/OS labels); and professional information (company, role, project type). We use these categories for the business purposes described in section 4 and disclose them only to the service providers and authorities listed in section 6.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CPRA. Our position on "Do Not Sell or Share My Personal Information" is therefore simply that there is nothing for you to opt out of - and we will honour an opt-out request all the same. We do not knowingly collect or sell the personal information of consumers under 16 years of age, and we do not use or disclose sensitive personal information for purposes that require a "limit use" request. Because we do not sell or share personal information, we do not offer a financial incentive in exchange for personal information.

California residents have the right to know, to delete, to correct, to opt out of sale or sharing (which does not apply to our practices), to limit the use of sensitive personal information (which we do not collect), and to be free from discrimination for exercising these rights. Submit a request by emailing danizhi@nexadeco.com or by calling/WhatsApping +86 153 7390 9896. We verify requests by matching the details of the request with the contact details we hold; an authorised agent may submit a request with written permission and we may contact you to confirm it. We respond within 45 days, extendable once by a further 45 days with notice.

11. Marketing communications

We send B2B follow-up about your own enquiry and, occasionally, relevant product updates. Every such message tells you how to opt out, and you can email us at any time to be removed. We do not send marketing to consumer addresses.

12. Children

Our services are sold business-to-business. Our website is not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Security

We protect personal data with TLS encryption in transit, hashed (bcrypt) admin passwords, hashed-and-salted IP addresses for statistics, rate-limited and audited admin sign-in, role-based access control, least-privilege database accounts and rolling backups. No method of transmission or storage is completely secure, but we review these measures regularly and will notify you and the competent authority without undue delay where a breach affecting your rights occurs.

14. Changes to this policy

We review this policy at least once a year and whenever our data practices change. The "Effective 20 October 2026" date below always reflects the current version. If a change materially affects how we use personal data we already hold, we will announce it on this page and, where we have your email address and the law requires it, contact you directly. Continuing to use the website after a change means you accept the updated policy; where consent is the legal basis, we will ask for it again.

15. How to contact us

NEXA Global Space Solutions — Privacy Team, Foshan, Guangdong, China.
Email: danizhi@nexadeco.com
WhatsApp / Phone: +86 153 7390 9896 (24/7)
We answer privacy requests within 30 days (45 days for California requests).

Effective 20 October 2026. Last updated 20 October 2026.