1. Scope and data controller

This Policy applies to the B2B Direct mobile app and the global B2B product discovery, sourcing request, enquiry, order and communication services provided through it. Where a merchant independently decides how to process information received in a transaction, it may act as an independent controller and its practices are governed by its own notice and applicable law.

The data controller or personal information handler is:

We process data under laws applicable to where business takes place and where users are located. These may include China's Personal Information Protection Law, the EU General Data Protection Regulation (“GDPR”) and the Swiss Federal Act on Data Protection (“FADP”). The precise rights and legal bases depend on the law that actually applies.

2. Data we collect and process

“Required” means the relevant core feature cannot operate without the data. “Optional” means you can withhold it, although a related profile, media or communication feature may not work. Collection screens also identify fields that are mandatory in context.

Do not place unrelated identity documents, financial-account data, health data, precise location or other sensitive personal data in free text, attachments or chat. If business and law genuinely require such data, first verify the recipient and transmission method.

3. Sources of data

• Directly from you: registration, profile, addresses, enquiries, sourcing requests, content, attachments and support communications.
• From your use: search, browsing, favourites, cart, message state, order flow and security logs.
• From merchants or transaction participants: quotations responding to your enquiry, order confirmations, shipping and after-sales status, and chats or dispute material in which you jointly participate.
• From the device: camera, photos, microphone or files you select only after you trigger a feature and grant permission. We do not continuously read this content in the background without reason.

4. Purposes and legal bases

We use data to provide accounts and business matching; connect you with merchants; process enquiries, orders, delivery and support; provide chat and community features; prevent fraud, moderate and secure the Service; comply with law, respond to lawful requests and establish, exercise or defend legal rights; and analyse operation and improve features using aggregated or de-identified information.

Depending on applicable law, our legal bases may include:

• Contract and pre-contract steps: registration, sign-in, search, enquiries, orders, chat and other services you request;
• Consent: device permissions, optional profile data and processing or transfers for which consent is legally required. You may withdraw consent, without affecting processing already lawfully carried out;
• Legal obligations: regulatory, tax, audit, safety and complaint requirements and legally required retention or disclosure;
• Legitimate interests: where applicable law permits and after balancing interests, account and network security, fraud prevention, troubleshooting, Service maintenance and legal claims; and
• Other grounds under Chinese law: necessity to enter or perform a contract to which you are party, perform legal duties, respond to public-health needs or urgently protect life or property, and other grounds provided by law.

We do not use personal data for a new purpose that is unreasonably unrelated to these purposes. If notice or consent is legally required for a new purpose, we will complete it before processing.

5. Device permissions

You can withdraw permissions in iOS Settings. Withdrawal does not affect processing already completed under valid permission, but stops new permission access. The app currently does not require precise location or contacts permission.

6. Sharing, public disclosure and recipients

We do not sell personal data or provide it to data brokers. We share only as follows:

• Merchants and transaction participants. When you start a chat, we show the relevant merchant only the nickname, avatar, media you choose to display through profile features, and messages and media you send as needed for communication; an ordinary customer profile or chat does not automatically reveal your phone number or delivery address. We provide the necessary contact name, phone number, delivery address, sourcing request, product and order content to the corresponding merchant only when you submit an enquiry or order and that information is needed for quotation or fulfilment. A merchant is responsible for information it independently retains and uses.
• Other Platform users. Sourcing requests, comments, likes and public profile elements you choose to post are displayed as indicated on the screen. Do not include contact or personal data you do not want made public.
• Service providers. Providers of cloud hosting, databases, object storage, content delivery, security logging and SMS verification process data only under our instructions and as needed to provide the service, subject to contractual, confidentiality and security duties.
• Professional advisers and authorities. We may provide necessary data to audit, legal or security advisers, courts, law enforcement, regulators or public authorities to meet legal duties, protect rights or address an emergency.
• Corporate transactions. In a merger, reorganisation, financing or business succession, necessary data may be provided under confidentiality and law. If the controller changes, we will give legally required notice and continue to protect your rights.

Except for competent public authorities acting independently under law, we use contracts, Platform rules or other appropriate arrangements to require recipients of personal data shared from the Platform to provide the same or equivalent protection required by this Policy and applicable data-protection requirements, appropriate to their role, including purpose limitation, security, confidentiality, retention and deletion, and assistance with individual rights.

If you provide another person's recipient or contact details, ensure you are entitled to provide them for the transaction and explain the necessary processing to that person.

7. Key service providers

Providers, regions and arrangements may change for reliability and compliance. If a change materially affects your rights, we will update this Policy and provide notice or obtain consent where law requires.

8. Transfers between China and Europe

B2B Direct is a global Platform. Because the operator is in Switzerland, primary cloud infrastructure is in Milan, Italy, and content delivery may use network points needed to improve access speed, your data may be transferred from your country or region to the European Economic Area, Switzerland or a relevant network point, or remotely accessed by authorised personnel where genuinely necessary to provide the Service. For example, a Chinese user's account, transaction or media may be stored in Italy.

Depending on the law that actually applies, we will adopt the required safeguards, which may include data-processing agreements, access and minimisation controls, EU Standard Contractual Clauses or another recognised mechanism, transfer impact assessments, and a Chinese security assessment, standard contract, personal-information protection certification or other lawful route where required. We do not claim that a certification has been obtained where it is not yet applicable or complete. Where separate consent is required, before transfer we will separately explain the recipient, purpose, means, categories and rights method and obtain that consent.

Protection levels differ by country, but we require recipients to protect data under applicable law, contract and this Policy. Contact us for a summary of safeguards relevant to you.

9. Retention and account deletion

While an account exists, we retain data only as needed to provide features, operate securely and meet obligations. The period depends on data type, transaction cycle, risk, disputes and legal requirements:

• Account credentials, profile, addresses, favourites, cart, interactions and notifications are generally retained until you delete the item or account. Short-term security logs are kept only as needed for troubleshooting, fraud prevention and security audit.
• When in-app account deletion takes effect, credentials, personal profile and media, addresses, favourites, cart, interactions, notifications and identifiable login logs are immediately deleted or anonymised.
• Transaction records covering orders, quotations, delivery, related chats and attachments are kept until the transaction is completed and for at least three years from completion. After account deletion, these records—including delivery details, related chats and attachments—are not visible on either the buyer or merchant side. Only authorised Platform operations personnel may retrieve them under controlled procedures where genuinely necessary for fulfilment, audit, dispute resolution, fraud prevention or a legal duty.
• At the end of the minimum period, the system automatically and permanently deletes or destroys the records unless law, a fraud investigation or an unresolved dispute requires longer retention. Any extension is limited to what is needed for that purpose, followed by deletion or destruction when the reason ends.
• Local device preferences can be cleared through app settings, system settings or by deleting the app. Clearing local data does not itself delete the server account.

You can initiate deletion in account settings. We may verify the current session or identity to prevent impersonation. Deletion cannot be reversed and does not cancel a contract already made with a merchant, so save necessary records and address incomplete transactions first.

10. Security and incident response

We apply reasonable organisational and technical measures appropriate to the data and risk, including protections in transit, access permissions and separation of duties, authentication, logging and anomaly monitoring, backups, provider management and staff confidentiality. Only personnel authorised for a work-related need may access personal data.

No internet service is absolutely secure. Use a unique, sufficiently strong password, never give another person a verification code, and verify merchants and payment instructions. If a personal-data incident may risk your rights, we will investigate, contain impact, and notify regulators and affected people as applicable law requires, describing the nature, possible effect, response and protective steps available to you.

11. Your data rights

Subject to applicable law and its exceptions, you may have the right to:

• be informed, access data and receive a copy;
• correct or complete inaccurate or incomplete data;
• erase data, delete an account, or restrict or object to particular processing;
• receive data in a structured, commonly used and machine-readable form and request transfer where law provides;
• withdraw consent, disable device permissions or opt out of non-essential processing;
• request an explanation of processing rules, cross-border recipients and significant automated decisions; and
• complain to a competent data-protection or cyberspace authority.

You can edit profile and addresses, manage content and permissions, and request deletion in account settings. You may also email support@b2bdirect.online. State the account, scope of request and location. To protect the account, we perform verification proportionate to the request's risk and do not require unnecessary data.

We respond within the time under applicable law. China-related requests are normally addressed, or a reasonable extension explained, within 15 working days. Where GDPR applies, we normally respond within one month and may lawfully extend for complex or multiple requests with reasons. Swiss and other requests follow local statutory periods. We reject or charge a reasonable fee for manifestly unfounded, repetitive or excessive requests only where law permits and will explain available remedies.

Withdraw an iOS permission through Settings. Withdrawal does not affect processing lawfully carried out beforehand. Data required for contract performance, legal duties or legal claims may not be immediately erased, but its purpose and access will be restricted.

12. Automated processing, analytics and advertising

The Platform may use search criteria, categories and product interactions you initiate to provide in-service search and relevant content. It currently does not make decisions producing legal or similarly significant effects solely by automated processing. We currently do not integrate third-party advertising, behavioural analytics or crash analytics SDKs, do not track across apps or websites, and do not use personal data for third-party behavioural advertising.

We may use aggregated or de-identified operational statistics to understand stability and use. We take measures to prevent reasonable re-identification. If data remains identifiable, this Policy continues to apply.

13. Children's data

The Service is for businesses and professional sourcing and is not directed to children. You must have the legal capacity required in your location. If you do not, use is permitted only with parental or legal-guardian consent and supervision and where law allows. We do not knowingly create behavioural-advertising profiles of children.

If a guardian believes a child provided data without valid authorisation, contact us. We will verify the request and erase the data or take other appropriate action under law.

14. Updates to this Policy

We may update this Policy for changes in law, features, data practices or providers. The version, publication and effective dates appear at the top. For a change materially affecting purposes, data categories, sharing or your rights, we will give advance in-app or other reasonable notice. Where consent is required, we will obtain it before the new processing begins.

You may print or save this version and contact us for a historical version applicable to a particular period.

15. Contact and complaints

To exercise a right, ask about this Policy, report a security event or make a complaint, contact:

We will acknowledge and investigate a complaint. If you are dissatisfied, you may complain to a competent authority where you live, such as the Swiss Federal Data Protection and Information Commissioner, the applicable European data protection authority, or a competent Chinese cyberspace and personal-information protection authority. Contacting us does not limit your right to seek regulatory or judicial relief directly.

The Chinese and English versions are intended to have the same meaning. An ambiguity will be interpreted under applicable law and in a clear and reasonable manner for users, without limiting mandatory rights.