Privacy Policy

1. Who we are and how to contact us

Zhejiang Balford Mechatronics Co., Ltd. ("Balford", "we") makes precision deep-drawn metal housings, magnetic isolation sleeves and stamped components. Our registered address is 2# Guangfa Road, Yaojiang, Zhuji, Shaoxing, Zhejiang 311800, China.

Privacy contact: shawn@balford.net, +86 135 8846 2222. This is the single point of contact for every privacy request. We are the controller for the purposes of the EU/UK GDPR and the personal information handler (个人信息处理者) for the purposes of China's PIPL. Our processing does not meet any of the Article 37 GDPR triggers, so no statutory Data Protection Officer has been appointed; requests sent to the address above are answered within 30 days.

2. What this policy covers

This policy explains what personal data we collect through balford.net, our online quotation and DFM tools, and our email and WhatsApp channels; why we collect it; where it is processed; and the rights you have. Regional annexes for the EEA, the UK and Switzerland (§12), mainland China (§13) and California (§14) apply in addition to the main sections.

3. Information you give us

• Contact and enquiry details — name, company, email address, telephone number, country, and the part information you send us (drawings, material, quantities, tolerances, target price).
• Drawings and technical files — treated as confidential engineering information and used only to review feasibility and prepare a quotation. Files sent through our online estimate tool are processed to produce that estimate and are not kept on the estimation service.
• Correspondence — emails and messages you exchange with us.

Where a field is needed to answer your enquiry we mark it as required; everything else is optional.

4. Information collected automatically

• Server access logs — IP address, browser type, requested page and timestamp, kept for 30 days for security, abuse prevention and troubleshooting. Legal basis: legitimate interests (GDPR Art. 6(1)(f)).
• Analytics — Google Analytics 4, and only with your consent. This site runs Google Analytics 4 (G-YE5HTNWY08) in Google Consent Mode v2 with all storage denied by default. Until you accept analytics in the cookie banner the tag runs cookieless: no _ga cookies are written, no identifier is stored on your device, ads_data_redaction is on and IP addresses are anonymised. If you accept, GA4 sets the cookies listed in §6 and we use the resulting aggregate statistics to improve our pages.

We do not run advertising, remarketing, retargeting, social plug-in or cross-site tracking tags on this site; we do not build advertising audiences; and we do not use your data for creditworthiness or to train general AI models.

5. Third-party services actually present on this site

We reviewed every third-party request the site makes. This is the complete list:

• Google Analytics 4 — aggregate usage statistics; loads cookieless and ads-denied, identifies you only after you consent.
• YouTube (youtube-nocookie.com) — embedded videos, loaded only when you click play.
• Google Docs — hosting for downloadable brochures and catalogues, opened only when you follow a download link.
• Google Search Console API — read-only statistics for our own website, used inside our internal server-side SEO tool, never in your browser.

We do not use Google Ads, DoubleClick, Google Maps embeds, externally hosted Google Fonts, Meta pixels, LinkedIn Insight or any other advertising or retargeting tag.

Balford runs a self-hosted search-console tool for its own website. When it is connected to Google we request read-only access (https://www.googleapis.com/auth/webmasters.readonly) to Search Console properties that our own Google account already owns or manages; that data is used only to analyse the search performance of our own website, is never sold, rented or shared, is not used for advertising or creditworthiness, and is not used to train general AI models. OAuth tokens are stored encrypted on our own server and can be revoked at any time. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Cookies and similar technologies

Before you choose, we set no cookies at all. Your banner choice is stored in your browser's local storage (balford_cookie_consent_v1), not in a cookie, and you can change or withdraw it at any time with the "Cookie settings" button in the footer.

• Your cookie choice — balford_cookie_consent_v1 (local storage, not a cookie), set when you click Accept or Reject.
• Analytics (optional) — _ga, _ga_YE5HTNWY08, set by Google Analytics 4 only after you accept analytics; delete them at any time in your browser.
• Staff sign-in — balford_admin_session, set only for Balford administrators.

We set no advertising or marketing cookies. Consent for analytics is specific, informed and freely given, and refusing it leaves the site fully usable. See the Cookie Policy for the full description.

7. Who we share data with

Only the processors needed to run the business: our hosting and cloud provider, our email provider, our analytics provider (Google, only after consent) and — for aggregate search data about our own website — our SEO data provider. Payment and logistics partners receive only what an order requires. We never sell personal data.

8. International transfers

We are based in China, so personal data you send us is processed in China.

• From the EEA, the UK or Switzerland to China. Where you send us an enquiry or place an order, the transfer is necessary for the performance of a contract with you or for pre-contractual steps taken at your request (GDPR Art. 49(1)(b)), which is the legal basis we currently rely on. Where a transfer is repetitive or large-scale we will put the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, module two) in place with the recipient before that transfer, together with a transfer impact assessment, and will update this policy when we do.
• Into China (PIPL). Where a cross-border transfer rule applies, we use the standard contract with the competent Chinese authority (CAC) or another PIPL-recognised route, and obtain separate consent where PIPL requires it.
• Other countries. Our hosting provider operates outside mainland China; sub-processors are listed on request.

9. How long we keep it

• Quotation enquiries that do not become orders — up to 24 months.
• Engineering files for accepted orders — for the life of the part programme plus five years, as required for traceability.
• Server access logs — 30 days.
• Analytics data — as configured in Google Analytics.

10. Security

Encrypted transport (HTTPS) for everything you send us, access control on our systems, and least-privilege access to customer data. Only the people who need a file to quote or manufacture it can open it.

11. Your rights

You may ask for a copy of your personal data, ask us to correct or delete it, restrict processing, object to processing, ask for portability, or withdraw consent at any time (withdrawal does not affect processing already carried out). Write to shawn@balford.net or +86 135 8846 2222; we respond within 30 days. If you are not satisfied you may complain to your local supervisory authority, or to the Cyberspace Administration of China for PIPL matters.

12. Annex for the EEA, the UK and Switzerland (GDPR)

• Legal basis. (a) your consent (Art. 6(1)(a)) for analytics cookies; (b) performance of a contract or pre-contractual steps at your request (Art. 6(1)(b)) for quotations, orders and delivery; (c) our legitimate interests (Art. 6(1)(f)) in answering business enquiries, securing the site and keeping business records — balanced against your rights, and you may object at any time.
• Rights. Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right not to be subject to solely automated decisions (Arts. 15–22). We do not carry out automated decision-making or profiling with legal effects.
• Transfers. See §8; the safeguard instrument is available on request.
• Breach notification. If a breach is likely to result in a risk to your rights and freedoms we notify the competent supervisory authority without undue delay and, where required, you (Arts. 33–34).
• Complaints. You may lodge a complaint with the supervisory authority where you live, work, or where the alleged infringement occurred.

13. Annex for mainland China (PIPL)

• We handle personal information in accordance with the Personal Information Protection Law of the PRC, the Data Security Law and the Cybersecurity Law, on the basis of your consent and/or the necessity of concluding or performing a contract with you.
• Rights. You may access, copy, correct or supplement your personal information, request deletion, withdraw consent, request an explanation of our handling rules, and ask us to transfer your information to another handler where technically feasible.
• Cross-border. Where your information is transferred out of China and a statutory route applies, we use the standard contract filed with the Cyberspace Administration of China (or another PIPL-recognised mechanism) and obtain separate consent where required.
• Technical files. Drawings and technical files may identify your company and product programme; we treat them as confidential business information and disclose them only to the staff and processors that need them.
• Minors. Our services are for businesses; we do not knowingly handle personal information of children under 14.

14. Annex for California (CCPA/CPRA)

• We do not sell your personal information and we do not share it for cross-context behavioural advertising as those terms are defined by the CCPA/CPRA.
• California residents may request to know the categories and specific pieces of personal information we hold, request deletion or correction, opt out of sale/sharing (not applicable, as we do not sell or share), limit the use of sensitive personal information, and exercise these rights without discrimination.
• Categories collected in the last 12 months: identifiers (name, email, phone, company, country); commercial information (part requirements, quantities, quotations); internet activity (pages viewed, only with analytics consent); professional information (company, role).
• Sources: you, your emails and drawings, our website, and analytics (with consent). Purposes: quoting, order fulfilment, customer support, security, site improvement. Recipients: the processors listed in §7.
• Requests: write to shawn@balford.net. We verify using the email address you contact us from and, if needed, information about your business relationship with us.

15. Children

This site is intended for business use and is not directed at children under 16.

16. Changes to this policy

Any change will be published on this page with a new effective date. Where a change materially affects how we use your data we will ask for fresh consent rather than treating continued use of the site as acceptance.