Privacy Policy
NEXA Global Space Solutions ("NEXA", "we", "us") designs, manufactures and supplies interior and architectural products for projects worldwide. This policy explains what personal data we collect through nexadeco.com, why we collect it, who we share it with, how long we keep it and what you can ask us to do with it.
1. Who we are and how to contact us
The data controller for this website is NEXA Global Space Solutions, Global Operations Base, Foshan, Guangdong, China.
- Privacy contact and rights requests: danizhi@nexadeco.com
- WhatsApp (24/7 sales and support): +86 153 7390 9896
- Postal enquiries: Global Operations Base, Foshan, Guangdong, China
We are a China-based exporter. We do not maintain an establishment in the European Union, so we are not required to appoint an Article 27 representative; we handle requests directly at the address above and answer within 30 days.
2. Summary
| What we collect | Why | How long |
|---|---|---|
| Inquiry form fields (name, company, email, country/city, project type, product, estimated volume, budget range, timeline, floor-plan link, message) | To answer your request, prepare a quotation and supply samples | 24 months from the last contact; 36 months if it becomes an order |
| Server logs (IP address, user-agent, requested URL, timestamp, referrer) | To keep the site online, secure and fast, and to diagnose faults | 90 days |
| Browser storage: language preference, cookie choice | To remember your language and your consent decision | Until you clear it or we publish a new policy version |
| Aggregated, cookie-less page views (path, referrer, screen size, language; IP one-way hashed) | To understand which pages are useful | Up to 12 months, aggregate only |
We do not sell your personal information, we do not run advertising or cross-site tracking, and we do not use your data to train third-party AI models.
3. Information you give us
When you submit the inquiry form on the home page or the Contact page, or when you email or message us on WhatsApp, we receive the details you choose to provide:
- Identity and contact data: full name, company or design studio, business email address, destination country and city, and a phone or WhatsApp number if you include one.
- Project data: project type (villa, hotel, apartments, healthcare, retail, office, education or other), product required, estimated volume or square metres, budget range, expected timeline, a link to a floor plan or cloud folder, and your message or requirements.
- Order data (once you place an order): billing and delivery addresses, tax or VAT identifiers where required, purchase-order references and payment confirmations.
Everything except the fields marked as required in the form is optional. A hidden anti-spam field
(_honey) is used to reject automated submissions; if a bot fills it, that submission is
discarded and not stored.
Please do not send us special-category data (health, religion, political opinions, biometrics) or another person's data unless you have their permission to share it for the purposes above.
4. Information collected automatically
Like every website, our servers record technical data when a page is requested. Our web server (Hostinger) writes standard access logs containing:
- your IP address (used to route the response and to rate-limit abuse);
- the user-agent string your browser sends (browser, version, operating system, device class);
- the URL requested, the HTTP status code, the response size and the time of the request;
- the referrer, if your browser sends one (the page that linked you here).
We also run a first-party page-view counter that stores only the requested path, the referring host, your screen size and your language. In that counter your IP address is salted and one-way hashed with SHA-256 and only the first 16 hexadecimal characters are retained, so it cannot be reversed into an IP address; the user-agent is reduced to device, browser and operating system. The counter sets no cookie and stores no visitor identifier.
6. Why we use your information (and our legal bases)
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Answering your inquiry, preparing quotations, sending samples | Contact and project data | Steps taken at your request before entering a contract – (1)(b); our legitimate interest in responding to business enquiries – (1)(f) |
| Performing an order: production, quality inspection, shipping, customs and after-sales | Contact, project and order data | Performance of a contract – (1)(b); compliance with export, tax and accounting law – (1)(c) |
| Protecting the website (rate limiting, spam and abuse prevention, security incidents) | IP address, user-agent, request metadata, anti-spam field | Our legitimate interest in a secure, available service – (1)(f) |
| Measuring which pages are read, in aggregate | Cookie-less page-view records | Your consent where required – (1)(a); otherwise our legitimate interest in improving the site – (1)(f) |
| Remembering your language and consent choices | Browser storage | Consent / strictly necessary storage – (1)(a) and ePrivacy Art. 5(3) exemption |
Where we rely on legitimate interests, we have balanced them against your rights: the data involved is business-contact data, the impact on you is minimal, and you can object at any time (see section 11). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
We send transactional email only in reply to your request. If we ever send a commercial newsletter, it will be opt-in, with a one-click unsubscribe link in every message.
8. International transfers
We are based in China and our hosting, mail and operational records may be processed in China, the European Union and the United States. Where personal data of EEA, UK or Swiss residents is transferred outside those areas, we rely on the appropriate safeguards of the GDPR (Chapter V), principally the European Commission's Standard Contractual Clauses and, where relevant, the UK Addendum, together with the technical measures described in section 10. You may request a copy of the safeguards using the contact details in section 1.
9. How long we keep information
| Record | Retention | Why this period |
|---|---|---|
| Inquiry / quotation correspondence (form, email, WhatsApp) | 24 months after the last contact | Project cycles in construction typically run 6–18 months; two years lets us answer follow-ups accurately |
| Order, invoice and shipping records | 36 months after delivery, then deleted or anonymised | Contractual limitation periods, tax and customs record-keeping duties |
| Web-server access logs (IP, user-agent) | 90 days, rotated automatically | Security investigations need only a short window |
| Aggregated page-view records (hashed IP prefix) | Up to 12 months | Year-on-year traffic comparison; no re-identification possible |
| Cookie-consent record (your browser only) | Until you clear it or a new policy version is published | Evidence of the choice you made |
| Database backups | Rotating window of the 14 most recent backups | Disaster recovery; older copies are overwritten |
| Spam-flagged submissions | Not stored | Discarded at submission time |
When a retention period ends we delete the records or irreversibly anonymise them so they can no longer be linked to you.
10. How we protect information
- The site is served over HTTPS (TLS 1.2 / 1.3) with HSTS and automatic certificate renewal.
- Back-office access is limited to named staff with individual accounts, password hashing and role-based permissions; administrator sign-in is rate-limited against brute force.
- Forms include anti-spam protection and are validated server-side; uploaded links are never executed.
- Database backups are compressed, access-controlled and rotated (14 most recent copies).
- Staff are instructed to handle inquiry data only for the purposes in section 6.
No system is perfectly secure. If a breach affects your rights, we will notify you and the competent supervisory authority without undue delay and within the deadlines required by law (72 hours under GDPR Art. 33).
11. Your rights (EEA, UK and Switzerland)
Subject to the conditions in the GDPR (and the UK GDPR / Swiss FADP), you have the right to:
- Access the personal data we hold about you and receive a copy (Art. 15).
- Rectify inaccurate or incomplete data (Art. 16).
- Erase data when it is no longer necessary, when you withdraw consent or when processing is unlawful (Art. 17).
- Restrict processing while a dispute about accuracy or lawfulness is resolved (Art. 18).
- Data portability – receive the data you provided in a structured, machine-readable format or have it transmitted to another controller (Art. 20).
- Object to processing based on legitimate interests, including profiling, and to direct marketing at any time (Art. 21).
- Withdraw consent at any time (Art. 7(3)) – use Cookie settings for consent given in the banner.
- Not be subject to a decision based solely on automated processing that produces legal effects (Art. 22).
Email danizhi@nexadeco.com with the subject "Privacy request". We reply within 30 days and may extend once by a further 60 days for complex requests, telling you why. We may ask for proof of identity if we cannot tell who is asking.
12. Your rights in California and other US states
If you are a California resident, the CCPA as amended by the CPRA gives you the right to:
- Know the categories and specific pieces of personal information we have collected, the sources, the business purposes and the categories of recipients.
- Delete personal information we hold about you, subject to legal exceptions.
- Correct inaccurate personal information.
- Opt out of the sale or sharing of personal information and of the use of personal information for cross-context behavioural advertising. We do not sell or share personal information and we do not run behavioural advertising, so there is nothing to opt out of; see section 13 for the signals we honour.
- Limit the use of sensitive personal information. We do not collect sensitive personal information for the purpose of inferring characteristics.
- Non-discrimination for exercising your rights.
- Use an authorised agent to make a request for you, with written permission.
Residents of Virginia, Colorado, Connecticut, Utah and other states with comprehensive privacy laws have equivalent rights of access, correction, deletion, portability and appeal. Send requests to danizhi@nexadeco.com; if we refuse, you may appeal the decision by replying to our answer, and we will review it independently.
13. Sale, sharing and Global Privacy Control
We do not sell personal information for money or other valuable consideration, and we do not share it for cross-context behavioural advertising. We honour the Global Privacy Control (GPC) signal: when your browser sends it, no non-essential script or storage is enabled and the cookie-less page-view counter stays off. We do not treat a "Do Not Track" header as consent to anything.
14. Children
This site is a business-to-business platform for construction and interior projects. It is not directed at children, and we do not knowingly collect data from anyone under 16. If a person under 16 has submitted data, write to us and we will delete it.
15. Automated decision-making
We do not use your data for automated decisions that produce legal or similarly significant effects. Anti-spam and rate-limiting checks are automated but only reject clearly abusive traffic; they do not make decisions about your inquiry. A human always reads and answers project inquiries.
16. Changes to this policy
When we change how we use personal data we publish a new version here and update the effective date at the top of this page. Material changes are announced on this page and, where we hold your email address for an active inquiry, by email. If the change relies on consent, we ask for it again through the cookie banner.
17. Complaints and contact
We would rather fix a problem than have you escalate it, so write to danizhi@nexadeco.com first. You also have the right to lodge a complaint with your local data-protection authority – in the EU or EEA the supervisory authority of your habitual residence, place of work or the place of the alleged infringement, in the UK the Information Commissioner's Office (ico.org.uk), and in California the California Privacy Protection Agency (cppa.ca.gov).
Controller: NEXA Global Space Solutions, Foshan, Guangdong, China · Email: danizhi@nexadeco.com · Effective: 20 October 2026 · Version: 1.0