Legal
Privacy Policy
How Naturmix collects, uses, shares and retains the information you give us when you place an order, ask about wholesale or brief an OEM project.
This is a template, not signed-off legal advice
This document was drafted for the Naturmix website build to show the structure, tone and level of detail the finished policy needs. It must be reviewed and adapted by qualified counsel before launch — in particular the sections on international transfers, PIPL and GDPR lawful bases, retention periods and the supervisory authority named for complaints. Do not publish it as-is, and do not rely on it as a compliance record.
Open items for counsel: confirm whether an EU/UK representative is required, confirm the CBPR / standard contractual clause route for China–U.S. transfers, confirm the CCPA “notice at collection” wording for California buyers, and name the analytics and email vendors actually deployed in production.
1. Who we are
Naturmix is the beverage ingredient brand of Guangzhou Haoen Fengshi Food Co., Ltd. (HEFS), a food manufacturer established in 1998 and operating a 50,000 m² fruit processing park in Conghua District, Guangzhou, China. HEFS is the controller of the personal information described in this policy.
This policy covers naturmix.com, the shopping account attached to it, and the sales, sample and OEM correspondence that follows from them. It does not cover third-party websites we link to, or the separate privacy practices of the distributors who resell Naturmix products under their own contracts.
2. What we collect
Naturmix sells to businesses. Almost everything we hold is business contact data — a named person acting for a company — rather than consumer data. We collect it in four ways.
2.1 Information you give us directly
- Enquiry, quotation and sample forms: name, company, work email, phone or WhatsApp number, country, store type, number of locations, estimated monthly volume, the SKUs you are interested in, your shipping address and any free-text notes you write.
- Account and ordering data: company legal name, billing and delivery addresses, purchase order numbers, assigned customer group (Distributor, Chain Account or OEM Partner), agreed payment terms, saved product lists and order history.
- Documents you upload: resale or tax exemption certificates, signed purchase orders, import licences, and brand artwork or dielines supplied for private-label work.
- OEM briefs: target flavour profiles, competitor references, target landed costs and any formulation constraints you share with our laboratory.
2.2 Information we collect automatically
- IP address, approximate country, browser and device type, referring page, pages viewed and the time of the visit — collected in server logs and, where deployed, in first-party analytics.
- Cart contents, selected customer group, favourites, recently viewed SKUs and form drafts, stored in your browser’s local storage under keys prefixed nm_. This data stays on your device until you clear it; on this demo build it never leaves the browser.
2.3 Information from third parties
- Credit and trade-reference reports, when you apply for Net 30 terms.
- Delivery status and proof-of-delivery data from freight carriers and customs brokers.
- Business contact details from trade shows, industry directories and publicly listed company pages, used only to make a first B2B approach and always with an opt-out in the first message.
2.4 What we do not collect
We do not ask for, and do not want, special-category data, government ID numbers of individuals, or payment card numbers. Card payments are processed by our payment provider and Naturmix receives only the last four digits, the card brand and an authorisation result.
3. Why we use it, and on what basis
We use your information only for the purposes below. Where the GDPR or UK GDPR applies, the lawful basis is shown in the right-hand column; where the PRC Personal Information Protection Law applies, processing is based on contract necessity or on the consent you give when you submit a form.
| Purpose | What it involves | Lawful basis |
|---|
Swipe the table sideways to see the lawful basis →
We do not use your information for automated decision-making that produces legal effects. Credit terms are approved by a person, not an algorithm.
4. Cookies and local storage
We keep the cookie footprint deliberately small. Nothing in the “strictly necessary” category can be switched off without breaking the cart or your contract pricing; everything else is off until you accept it in the cookie banner.
| Category | Examples | Lifetime | Consent |
|---|
Swipe the table sideways to see lifetimes and consent →
You can clear the nm_ keys at any time from your browser’s site settings, or by signing out of the account centre. Doing so empties your cart and hides contract pricing until you sign in again — prices, specifications and delivery times stay visible either way. Blocking cookies entirely at browser level will prevent checkout from working.
5. Who we share it with
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We disclose it only to the categories of recipient below, each under a written contract that limits them to our instructions.
If HEFS is ever party to a merger, acquisition or asset sale, customer records may transfer to the acquiring entity. You would be notified before any transfer changes how your information is used.
6. International transfers
Naturmix operates from China and ships through a distribution partner in California, so your data necessarily crosses borders:
- Order and shipping data for U.S. deliveries is transferred to our U.S. distribution partner and to the carrier handling the lane.
- Enquiry, quotation and OEM data is processed on servers in mainland China and, for the customer relationship system, in Singapore.
- Where personal data of EU, UK or Swiss individuals is transferred out of those regions, we rely on the European Commission’s standard contractual clauses together with a transfer risk assessment.
A copy of the transfer mechanism used for your account is available on request from the address in section 10.
7. How long we keep it
We keep records only as long as we need them, then delete or anonymise them on a scheduled job.
| Record | Retention | Why |
|---|
Swipe the table sideways to see the reason →
8. How we protect it
Access to customer records is role-based: a sample desk manager sees sample and contact records, and only the finance team sees payment and credit data. Traffic to naturmix.com is TLS-encrypted, uploaded certificates are stored encrypted at rest, administrative access requires multi-factor authentication, and access logs are reviewed monthly. Suspected breaches involving personal data are assessed within 24 hours and notified to affected customers and the relevant authority where the law requires it.
No system is perfectly secure. Please do not email us bank details, and treat any message asking you to change our payment account as fraudulent until you have confirmed it by phone on the number published on this site.
9. Your rights
Depending on where you are, you have some or all of the following rights over your personal information:
To exercise any of these, email the address below with “Data request” in the subject line and the company the request relates to. We respond within 30 calendar days and may ask you to confirm your identity or your authority to act for the company. Exercising a right is always free; we may charge a reasonable fee only for a manifestly excessive repeat request.
You may also complain to your local data protection authority. We would prefer the chance to put it right first.
10. Business use only
Naturmix sells food ingredients to adults. The site is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe a minor has submitted information through our forms, contact us and we will delete it.
11. Changes to this policy
We update this policy when our processing changes or when the law does. The version number and the “last updated” date at the top of this page always reflect the current text. Material changes — a new purpose, a new category of recipient or a longer retention period — are emailed to account holders at least 14 days before they take effect.
12. Contact us
Questions about this policy, or about the data we hold on your account, go to the same team that handles your orders.