Specific purposes.
Limited data.

Controller and privacy contact

Zhejiang GENAN Industry & Trade Co., Ltd.浙江舸楠工贸有限公司 (“GENAN”, “we”, “us”) is the controller of personal data collected through genanurban.com. Our business is established in Lishui, Zhejiang, People's Republic of China.

Privacy contact: [email protected]. We have not appointed a data protection officer because the current website processing does not involve large-scale regular monitoring or large-scale processing of special-category data. The privacy contact handles data-protection enquiries.

GENAN has no establishment in the EEA. If an Article 27 GDPR representative becomes legally required for targeted EEA processing, the representative's name and EEA contact address will be published in this section before that processing begins.

Personal data we collect

Project enquiries

We collect the name, company, business email, country or market, project type, product reference and project description you provide. If you voluntarily upload a drawing or specification, we store the sanitized file name, file type, file size and file. We also record the submission page, referring website host and, when present in the address, standard campaign tags and an advertising click identifier. We do not store the full referring URL or unrelated URL query values with the enquiry.

Required fields are marked with an asterisk. We need those fields to identify and respond to the requested B2B project. If you do not provide them, we cannot process the enquiry. Attachments, product references and project-type selections are optional. Please do not include payment-card data, government identifiers, health data or other sensitive personal data.

Technical and security data

Our hosting and security providers process request IP address, browser and device information, timestamps, requested URLs, response status, security signals and similar logs needed to deliver and protect the website. The enquiry endpoint temporarily converts an IP address into a one-way, time-limited token to limit abuse; the raw IP address is not written to the enquiry database.

Optional services

If, and only if, you consent, GENAN stores a privacy-limited first-party visit record containing an anonymous random visitor and session identifier, page path, referring host, campaign tags, coarse country or region, device class and browser language. We do not store the full referring URL or raw IP address in this visitor database. Google Analytics may also process page, device and interaction data for aggregated measurement. Google translation may process technical data, page content and language choice to translate the page. Details and browser storage durations are in the Cookie Policy.

GENAN Content Publisher

If you separately use GENAN Content Publisher, the desktop tool handles the TikTok account identifier, display name, profile image, OAuth tokens, selected media, captions and publishing settings needed for the action you request. OAuth credentials are encrypted on the authorized computer and are not submitted through this public website. TikTok is an independent controller for data it processes under its own policy.

Purposes and legal bases

Our legitimate interests do not override your rights and freedoms. We minimize fields, restrict access, expire records and provide an objection route. You may request information about the relevant balancing assessment.

We do not sell personal data, use enquiry contents for unrelated advertising, or send marketing email merely because you submitted a project enquiry. A separate opt-in is required for electronic marketing where applicable.

Recipients and processors

• Authorized GENAN sales, project and system-administration staff, limited by role and need to know.
• OpenAI Sites and Cloudflare, which provide application hosting, delivery, security, D1 database and R2 file storage.
• Our business email provider when we respond to an enquiry or receive a privacy request.
• Resend, which sends the automatic internal notification about a new website enquiry to GENAN's designated inbox. The message contains the submitted enquiry details and uses the sender's business email as the reply-to address.
• Google Analytics and Google translation only after the corresponding consent.
• TikTok when a Content Publisher user requests authorization, upload or publication.
• Professional advisers, courts or authorities only where necessary to establish or defend legal claims or comply with law.

WhatsApp is an external Meta service. No WhatsApp resource is embedded in our page; data is sent to Meta only if you choose the WhatsApp link and continue on its service.

International transfers

GENAN is established in China and provides global B2B support, so personal data submitted to us is accessible in China. Our infrastructure providers may also process data in the United States and other countries in which they or approved subprocessors operate.

Where GDPR Chapter V applies to a transfer, we use an adequacy decision where available or contractual safeguards based on the European Commission's Standard Contractual Clauses, together with supplementary security and data-minimisation measures where required. The current OpenAI Data Processing Addendum and Cloudflare Data Processing Addendum contain data-processing and transfer terms. You may request information about the applicable safeguard through our privacy contact; commercially confidential text may be redacted.

Retention and deletion

Expired website enquiries are excluded from normal access and deleted automatically during website enquiry or administration activity. A verified deletion request may result in earlier deletion unless retention is legally required. When a legal hold applies, data is isolated and used only for that purpose.

Your rights

Where the GDPR applies, you may request access, correction, deletion, restriction, objection and data portability. You may withdraw consent at any time without affecting processing carried out before withdrawal. You also have the right to lodge a complaint with a supervisory authority in the EEA country of your habitual residence, place of work or the alleged infringement.

Visit Exercise your data rights for the request method, verification safeguards and response timetable. We normally respond within one month. We may extend by up to two further months for a complex or numerous request, but will notify you within the first month.

Security measures

Measures include HTTPS, network-level abuse protection, data-minimizing forms, upload size and file-signature validation, isolated object storage, authenticated and allowlisted administrative access, private no-store downloads, security response headers, least-privilege access, retention controls and deletion tooling. Content Publisher uses official OAuth, PKCE, state validation and encrypted local credential storage.

No system is risk free. We maintain an incident process to contain, document and assess personal-data breaches and, where required, notify the competent supervisory authority within 72 hours and affected individuals without undue delay.

Other required information

No solely automated decisions

We do not use website enquiry data for solely automated decisions that produce legal or similarly significant effects, and we do not profile people for such decisions.

Children

The website and Content Publisher are business services not directed to children. We do not knowingly request children's personal data. Contact us for deletion if a child supplied data.

Data about another person

Do not include another person's personal data in a project brief or attachment unless you are authorized to provide it and have given them the information required by applicable law.

Policy changes

Material changes are dated and published before they take effect where practicable. If an optional purpose changes materially, the existing browser consent is invalidated and a new choice is requested.