1. 适用范围与责任主体

本《BD Seller 隐私政策》（“本政策”）适用于 BD Seller 移动应用及与其直接相关的商户服务。服务运营方及一般平台账户、安全、基础设施和合规处理的责任主体为：

BD Seller 由供应商、商户及其员工代表所属企业使用。对于所属企业自行决定用途和方式处理的员工、客户、采购方或交易信息，所属企业可能是独立的个人信息处理者或控制者；Wynie 则可能按企业指令提供平台处理，同时为账户安全、服务运营和法定义务决定必要处理。具体法律角色取决于实际处理情形及适用法律。

本政策不适用于 Apple 或交易对手方自行运营的服务。相关第三方会按其自己的隐私文件处理信息。我们的《BD Seller 用户服务协议》另行规范平台使用。

2. 数据主体与信息来源

本政策涉及的数据主体可能包括企业管理员及成员、供应商联系人、采购方及其收货联系人、业务往来人员、举报人和支持请求人。我们可能从以下来源取得信息：

• 您直接提供：注册、验证、完善资料、上传资质或媒体、发布商品、报价、聊天及联系支持时提供；
• 所属企业提供：管理员邀请您、分配角色、录入企业或成员信息、导入业务资料时提供；
• 采购方或交易对手提供：询价、订单、采购需求、聊天、收货和履约过程中提供；
• 服务自动产生：登录、会话、访问接口、上传下载或执行操作时生成安全和操作记录；
• 您依法有权使用的商业来源：例如企业公开资料或企业已合法取得的客户资料。

3. 我们处理的信息

某些企业资质、交易文件或收货信息在特定法域可能被视为敏感个人信息。我们仅在具体目的必要、采取更严格保护并具备适当法律依据时处理；依法需要单独同意的，我们会另行取得。请勿在自由文本或附件中主动加入不必要的身份证件、金融账户、健康或生物识别信息。

拒绝提供标明为必要的信息，可能导致我们无法创建或保护账户、验证企业、完成上传、处理交易或提供相应功能。可选字段可留空，且通常不影响其他核心功能。

4. 处理目的与法律依据

我们不会将个人信息用于与下列目的不相容的新目的，除非依法另行告知并取得所需依据：

在欧洲经济区、英国或瑞士法律适用时，我们根据具体情形依赖合同履行、法律义务、经权衡的合法利益或同意。在中国《个人信息保护法》适用时，我们依赖同意或该法允许的其他处理条件；法律要求单独同意、书面同意或个人信息保护影响评估时，我们将采取相应步骤。撤回同意不影响撤回前处理的合法性。

5. 设备权限与本地数据

应用会在您主动使用相关功能时请求以下系统权限：

• 相机：拍摄营业执照、资质、商品或聊天图片，以及录制视频；
• 相册读取：选择您指定的图片或视频进行上传；
• 相册写入：将您选择保存的商品或聊天媒体写入设备；
• 麦克风：在您录制含声音的视频时采集声音；
• 文件访问：由系统文件选择器选择并上传 PDF、图片、视频或其他支持的业务文件。

您可以在设备系统设置中撤回相机、相册或麦克风权限。撤回不会影响此前合法处理，但相应拍摄、选择、保存或录制功能将无法使用；账户和不依赖该权限的功能通常仍可使用。文件选择由您每次主动触发。

截至本政策生效日，BD Seller 不请求精确定位、通讯录、日历、蓝牙、健康数据或广告跟踪权限；不集成第三方广告或行为分析 SDK、支付 SDK，也不使用第三方系统推送 SDK。业务提醒可通过应用内接口或实时连接提供。应用可在设备本地保存语言、主题、会话和必要缓存；这些数据可通过退出登录、应用功能、系统设置或卸载应用清除，具体取决于设备系统。

6. 可见范围与信息共享

我们不出售或出租个人信息，也不将个人信息提供给数据经纪商。为提供服务，信息可能在以下必要范围内可见或被披露：

• 所属企业：管理员和具有相应角色的成员可查看成员资料、角色、企业活动、商品、报价、方案、交易、聊天和文件。访问范围取决于权限配置和业务需要。
• 采购方或交易对手：企业和店铺资料、商品媒体、报价、方案、订单、通信和履约所需联系人信息会向相关交易对手显示。内部备注不应向采购方显示，除非用户主动复制或共享。
• 公开或平台范围：选择发布的企业介绍、Logo、店铺和商品内容可向潜在采购方或其他平台用户展示。请勿在公开字段放置不必要的个人联系方式。
• 专业顾问和交易承继方：为审计、法律主张、保险、融资、重组或并购确有必要时，可在保密和合法保障下向专业顾问或潜在承继方披露。
• 公共机关和权利保护：根据有权机关的合法要求，或为保护用户、平台和公众的权利、安全与财产所必要时依法披露。我们会审查请求的合法性并在允许范围内限制披露。

若您从聊天或订单中下载资料并在平台外分享，该后续处理由您和所属企业负责。请仅向有权接收的人发送，并采用适合信息敏感程度的安全方式。

7. 服务供应商

我们委托以下主要技术供应商在提供服务所必需的范围内处理信息。我们会根据适用法律通过合同、访问限制、保密和安全要求约束供应商，并要求其仅按指示或合法服务目的处理。除依法独立履职的有权公共机关外，我们要求从平台获得共享个人信息的第三方根据其角色提供与本政策及适用的数据保护和平台要求相同或同等的保护，包括目的限制、安全、保密、保存与删除及协助响应个人权利：

供应商的具体基础设施和子处理安排可能因安全、容量或法律要求发生变化。若变化会显著影响个人信息处理，我们会依第 15 节通知。移动操作系统和 App Store 由 Apple 独立运营，Apple 对其设备、商店和账户数据的处理适用其自己的隐私条款。

8. 中国与欧洲之间的跨境处理

BD Seller 支持中国及欧洲的跨境 B2B 业务。主要平台数据托管于 AWS 意大利米兰区域（eu-south-1），内容传输可能经过靠近用户的 AWS CDN 边缘节点。因此，信息可能从您所在国家或地区传输至意大利、CDN 节点或交易参与方所在的其他地区，且当地数据保护规则可能不同。

我们会根据适用法律和具体传输采取适当措施，包括数据最小化、加密传输、访问控制、供应商尽调和合同保障、跨境风险或影响评估，以及适用时采用标准合同条款或其他合法传输机制。中国法律要求安全评估、标准合同、认证、个人信息保护影响评估、告知或单独同意时，我们会在相应处理前采取所需步骤；欧洲或瑞士法律要求充分性依据、适当保障或例外时亦同。

本政策对跨境路径的说明本身不替代法律要求的单独同意。若特定传输需要您的单独同意，应用或相关流程会另行请求；拒绝可能使依赖该传输的账户或跨境协作功能无法提供。您可联系我们了解与您情况相关的保障概要。

9. 保存期限

我们不会仅因技术上可以而永久保存个人信息。我们依据服务和租户存续、业务与交易需要、账户安全、企业指令、法定义务、审计、诉讼时效和争议情况，按实现目的所需的最短期限保存，并定期评估删除或匿名化：

• 个人账户与认证资料：通常保存至个人账户注销、成员关系终止或认证目的结束；安全争议或法律保留要求存在时，可对必要记录限制访问后延长保存。
• 企业与资质资料：在企业租户存续、验证有效和适用合规义务期间保存；过期资料仅在审计、资质历史、争议或法律要求所需范围内受限保留。
• 商品、报价、方案、聊天、店铺和交易资料：作为企业资产在租户服务、业务连续性及履约所需期间保存，之后按合同、交易、税务、审计、法定义务和争议期限所需的最短期限进入受限归档。
• 登录、安全和操作日志：在调查异常、维护系统安全、审计和故障排查所需的最短合理期限内保存；目的结束后删除、聚合或去标识化，依法需要保留的除外。
• 支持和权利请求：保存至请求解决，并在证明合规、防止重复滥用及处理争议所需的期限内受限保留。

租户关停后，我们目前不能承诺立即、自动地从全部活动系统及循环备份中完成物理删除。数据会先限制访问；当合同、法定义务、交易、审计、安全和争议目的结束后，删除或匿名化活动副本，备份中的副本随安全备份周期覆盖，除非法律保留要求继续适用。

10. 个人注销、离职与企业资产

10.1 发起注销

您可通过应用内账户设置提供的注销入口发起个人账户删除。若无法登录或因安全原因无法完成，可通过第 16 节邮箱联系我们。为防止冒名删除，我们可能核验账户控制权、企业角色和未完成的交接。提出注销不以发送普通邮件为唯一方式。

10.2 删除或匿名化的个人资料

在处理注销后，我们会停用个人登录，并删除或匿名化个人用户名、手机号、邮箱、密码、已设置的 POS 登录 PIN、个人资料、API 或 MCP 凭据及可识别登录日志，但为安全事件、法律义务、权利主张或防止欺诈确有必要的最小记录可在严格限制下保存至目的结束。相关会话会被撤销。

10.3 继续由企业管理的资料

在您职务中形成的商品、报价、需求方案、聊天、店铺、客户和交易记录可能属于所属企业的业务记录。为维持合法业务连续性，这些资料不会仅因个人成员注销或离职而全部删除，而可继续由获授权企业成员访问；历史作者会在合理可行范围内匿名化或替换为非个人标识。所属企业仍须遵守自身的保存和数据主体权利义务。

10.4 租户关停

企业租户关停应由获授权管理员提出。关停后企业资料进入受限归档，并依据第 9 节的目的和期限标准处理。企业管理员应在可用功能及合法权限范围内提前完成必要导出和成员交接。企业控制权存在争议时，我们可暂缓不可逆操作并要求适当授权证明。

11. 您的权利与请求方式

根据适用法律及具体情形，您可能享有：知情和解释；访问、查阅或获取副本；更正或补充；删除；限制处理；反对基于合法利益或直接营销的处理；撤回同意；数据可携带；注销账户；要求说明自动化决定；以及向监管机关投诉等权利。依法适用于已故人员近亲属或授权代理人的权利也会得到处理。

请求路径：

1. 可先使用应用内个人资料、权限或注销功能；
2. 对所属企业决定用途的员工、客户或交易资料，可先联系企业管理员或其隐私负责人；
3. 也可通过第 16 节邮箱直接联系 Wynie。我们会协助识别合适的责任主体，不会仅因企业也负有责任而拒绝合理协助。

为保护账户、企业秘密和他人信息，我们可能要求验证身份、账户控制权或代理授权，并可能对过度、重复或明显无依据的请求依法限制或收取合理费用。我们会说明拒绝或限制的主要理由及可用申诉方式。

我们将在适用法律规定期限内回复。在中国法律和现行规则适用时，通常在 15 个工作日内处理；在 GDPR 适用时，通常在一个月内回复，复杂或大量请求可依法延长并说明；瑞士或其他地区按相应法定期限或合理期限处理。撤回设备权限可在系统设置中完成，撤回同意不影响此前处理的合法性。

12. 安全保护与事件响应

我们结合信息性质和风险采取合理的技术与组织措施，包括传输保护、适当的存储加密、访问控制和角色权限、凭据保护、日志和监控、网络防护、备份、供应商管理、员工保密和事件响应。企业管理员同样应配置最小权限、及时移除离职成员并保护导出副本。

没有任何系统能保证绝对安全。若发生个人信息安全事件，我们会采取遏制、调查、修复和风险降低措施，并在适用法律要求时向主管机关和受影响个人通知事件性质、可能影响、已采取措施和可用建议。

如发现可疑登录、错误收件人、公开暴露、恶意文件或凭据泄露，请立即在账户内终止会话或重置凭据，并联系 support@b2bdirect.online。请勿在报告中附上不必要的密码、完整验证码或第三方敏感信息。

13. 跟踪、营销与自动化决定

截至本政策生效日，BD Seller 不包含第三方广告、跨应用广告跟踪、第三方行为分析或第三方崩溃报告 SDK；我们不出售个人信息，也不以数据经纪业务为目的共享。应用可能使用安全日志和必要的服务指标来认证、排错和保护服务，这不用于跨公司广告画像。

我们可使用规则或技术信号识别异常登录、滥用或恶意内容，但不会仅依靠自动化处理作出对您产生法律效力或类似重大影响的最终决定。如未来引入此类决定，我们会依法说明逻辑和影响，并在要求时提供人工复核、表达意见和提出异议的途径。

本静态政策页面本身不设置 cookies、不使用 localStorage，也不加载外部分析、字体、图片、脚本或广告资源。托管服务商仍可能为网络安全产生标准服务器访问日志，其处理依本政策的安全目的和保存标准。

14. 未成年人

BD Seller 是面向企业和专业人员的商业服务，并非为儿童设计。我们不会以儿童为目标开展营销或故意要求其创建企业账户。用户应具备当地法律要求的相应民事行为能力和企业授权；如法律要求监护人同意，必须同时取得监护人同意及所属企业授权。

如您认为儿童在无适当授权或同意的情况下向我们提供了个人信息，请联系我们。我们会核实并依适用法律删除、限制或采取其他适当措施。

15. 政策更新

我们可能因服务功能、供应商、处理活动或法律变化更新本政策。新版本会标明版本和生效日期，并通过应用内通知、相关网页、电子邮件或其他合理方式告知重大变化。适用法律要求提前通知、重新同意或单独同意时，我们会遵守。

重大更新生效前，我们会在合理可行范围内提供查阅和保存机会。继续使用不替代法律明确要求的同意。我们会依适用法律保留并在需要时提供历史版本。

16. 联系我们与投诉

如需提出隐私请求、询问跨境保障、报告安全问题或投诉，请联系：

我们鼓励先联系我们，以便尽快解决问题。您也有权依法向所在地或相关处理活动有管辖权的个人信息或数据保护机关投诉，例如中国有权网信部门、瑞士联邦数据保护和信息专员（FDPIC），或欧洲经济区成员国的数据保护监管机关。此项权利不受先行联系我们的限制。

1. Scope and responsible parties

This BD Seller Privacy Policy (the “Policy”) applies to the BD Seller mobile application and directly related merchant services. The Service operator and the party generally responsible for platform accounts, security, infrastructure, and compliance processing is:

Suppliers, merchants, and their personnel use BD Seller for their Organizations. Where an Organization independently determines the purposes and means of processing employee, customer, buyer, or transaction information, it may be an independent personal-information handler or controller. Wynie may process platform data on the Organization’s instructions while determining necessary processing for account security, Service operations, and legal obligations. The exact legal roles depend on the processing circumstances and applicable law.

This Policy does not apply to services independently operated by Apple or a trading counterparty. Those third parties process information under their own privacy documents. Our BD Seller User Service Agreement separately governs platform use.

2. Data subjects and sources

People covered by this Policy may include enterprise administrators and members, supplier contacts, buyers and delivery contacts, business correspondents, reporters, and support requesters. We may obtain information from:

• you directly, when you register, verify, complete a profile, upload qualifications or media, publish products, quote, chat, or contact support;
• your Organization, when an administrator invites you, assigns roles, enters organization or member data, or imports business material;
• buyers or counterparties, through inquiries, orders, sourcing requests, chats, delivery, and performance;
• the Service automatically, through security and operational records generated when you sign in, maintain a session, use an interface, upload or download, or perform an action; and
• business sources you may lawfully use, such as public organization information or customer data lawfully obtained by the Organization.

3. Information we process

Certain qualification, transaction, or delivery records may be considered sensitive personal information in some jurisdictions. We process them only when necessary for a specific purpose, with stronger protection and an appropriate legal basis; where separate consent is required, we will request it separately. Do not place unnecessary identity, financial-account, health, or biometric information in free-text fields or attachments.

If you decline information identified as required, we may be unable to create or protect an account, verify an Organization, complete an upload, process a transaction, or provide the relevant function. Optional fields may be left blank and generally do not prevent use of other core functions.

4. Purposes and legal bases

We will not use personal information for a new purpose incompatible with those below unless we provide any legally required notice and obtain an appropriate basis:

Where European Economic Area, United Kingdom, or Swiss law applies, we rely on contract performance, legal obligation, balanced legitimate interests, or consent depending on the context. Where China’s Personal Information Protection Law applies, we rely on consent or another processing condition permitted by that law. We take the required steps where law requires separate or written consent or a personal-information-protection impact assessment. Withdrawing consent does not affect processing lawfully conducted beforehand.

5. Device permissions and local data

The application requests the following system permissions when you actively use a relevant function:

• Camera: capture a business license, qualification, product or chat image, or record video;
• Photo library read: select an image or video you specify for upload;
• Photo library write: save product or chat media you choose to your device;
• Microphone: collect sound when you record a video with audio; and
• File access: use the system file picker to select and upload a PDF, image, video, or other supported business file.

You may withdraw camera, photo-library, or microphone permission in device settings. Withdrawal does not affect prior lawful processing, but the corresponding capture, selection, saving, or recording function will stop working; accounts and functions that do not depend on the permission generally remain available. You actively trigger the file picker each time.

As of the effective date, BD Seller does not request precise location, contacts, calendar, Bluetooth, health, or advertising-tracking permission; it has no third-party advertising or behavioral-analytics SDK, payment SDK, or third-party system-push SDK. Business alerts may be provided through in-app interfaces or real-time connections. The application may store language, theme, session, and necessary cache data locally. Depending on the device system, you can clear this by signing out, using an app function or system setting, or uninstalling the application.

6. Visibility and information sharing

We do not sell or rent personal information or provide it to data brokers. To provide the Service, information may be visible or disclosed as necessary to:

• Your Organization: Administrators and appropriately authorized members may view member profiles, roles, enterprise activity, products, quotations, proposals, transactions, chats, and files. Visibility depends on access configuration and business need.
• Buyers and counterparties: Organization and storefront profiles, product media, quotations, proposals, orders, communications, and contact data required for performance are shown to the relevant counterparty. Internal notes should not be shown to buyers unless a user deliberately copies or shares them.
• Public or platform audiences: An Organization description, logo, storefront, and product material chosen for publication may be shown to prospective buyers or other platform users. Do not place unnecessary personal contact details in public fields.
• Professional advisers and successors: Where necessary for audit, legal claims, insurance, financing, restructuring, or acquisition, information may be disclosed to advisers or a potential successor subject to confidentiality and lawful safeguards.
• Public authorities and protection of rights: We disclose under a lawful request from a competent authority or as lawfully necessary to protect the rights, safety, and property of users, the platform, or the public. We review legal validity and limit disclosure where permitted.

If you download information from a chat or order and share it outside the platform, you and your Organization are responsible for that subsequent processing. Send it only to authorized recipients and use security appropriate to its sensitivity.

7. Service providers

We engage the main technical providers below to process information only as necessary to provide the Service. Under applicable law, we use contracts, access restrictions, confidentiality, and security requirements and require providers to process only on instructions or for lawful service purposes. Except for competent public authorities acting independently under law, we require third parties receiving personal information shared from the platform to provide the same or equivalent protection required by this Policy and applicable data-protection and platform requirements, appropriate to their role, including purpose limitation, security, confidentiality, retention and deletion, and assistance with individual rights:

Provider infrastructure and subprocessors may change for security, capacity, or legal reasons. If a change materially affects personal-information processing, we will provide notice under Section 15. The mobile operating system and App Store are independently operated by Apple, whose own privacy terms govern its processing of device, store, and Apple-account data.

8. International processing between China and Europe

BD Seller supports cross-border B2B activity in China and Europe. Core platform data is hosted in the AWS Milan, Italy region (eu-south-1), and content delivery may pass through AWS CDN edge locations near users. Information may therefore move from your country or region to Italy, a CDN edge location, or another region where transaction participants are located, whose data-protection rules may differ.

Depending on applicable law and the specific transfer, we use appropriate measures such as data minimization, encrypted transmission, access control, provider diligence and contractual safeguards, transfer risk or impact assessments, and, where applicable, standard contractual clauses or another lawful transfer mechanism. Where Chinese law requires a security assessment, standard contract, certification, personal-information-protection impact assessment, notice, or separate consent, we take the required steps before the relevant processing; we do likewise where European or Swiss law requires an adequacy basis, appropriate safeguard, or permitted derogation.

This Policy’s description of transfer routes does not replace separate consent required by law. If a specific transfer requires your separate consent, the application or relevant flow will request it. Refusal may prevent an account or cross-border collaboration feature that depends on the transfer. Contact us for an outline of safeguards relevant to your circumstances.

9. Retention

We do not retain personal information forever merely because storage is technically possible. Based on Service and tenant duration, business and transaction needs, account security, Organization instructions, legal obligations, audits, limitation periods, and disputes, we retain information for the shortest period needed for the purpose and review it for deletion or anonymization:

• Individual account and authentication data: generally until account deletion, termination of membership, or the end of the authentication purpose; necessary records may remain under restricted access for a security dispute or legal hold.
• Organization and qualification data: while the tenant operates, verification remains relevant, and compliance obligations apply; expired material remains restricted only as needed for audit, qualification history, disputes, or law.
• Products, quotations, proposals, chats, storefronts, and transactions: as enterprise assets during tenant service, business continuity, and performance, then in a restricted archive for the shortest period needed for contractual, transaction, tax, audit, legal-obligation, and dispute purposes.
• Login, security, and activity logs: for the shortest reasonable period needed to investigate anomalies, secure systems, audit, and troubleshoot; then deleted, aggregated, or de-identified unless law requires retention.
• Support and rights requests: until resolution and then under restriction as needed to demonstrate compliance, prevent repeated abuse, and handle disputes.

After tenant closure, we cannot currently promise immediate, automatic physical deletion from every active system and rotating backup. Access is first restricted. When contractual, legal, transaction, audit, security, and dispute purposes end, active copies are deleted or anonymized and backup copies are overwritten through the secure backup cycle, unless a legal hold continues.

10. Individual deletion, departure, and enterprise assets

10.1 Starting deletion

You can request individual account deletion through the deletion entry in in-app account settings. If you cannot sign in or complete the process for security reasons, contact us at the email in Section 16. To prevent fraudulent deletion, we may verify control of the account, your enterprise role, and unfinished handover. Ordinary email is not the only way to submit a deletion request.

10.2 Personal data deleted or anonymized

After processing deletion, we disable personal access and delete or anonymize the individual username, phone number, email, password, any configured POS sign-in PIN, profile, API or MCP credentials, and identifiable login logs. Minimum records necessary for a security incident, legal obligation, legal claim, or fraud prevention may remain under strict restriction until that purpose ends. Related sessions are revoked.

10.3 Data remaining under Organization administration

Products, quotations, sourcing proposals, chats, storefront, customer, and transaction records created in your work may be business records of the Organization. For lawful continuity, they are not all deleted merely because an individual member leaves or deletes an account and may remain available to authorized Organization members. Historical author identifiers are anonymized or replaced with non-personal labels where reasonably feasible. The Organization remains responsible for its own retention and data-subject duties.

10.4 Tenant closure

An authorized administrator must request tenant closure. Organization data then enters restricted archival handling under the purposes and criteria in Section 9. Administrators should complete necessary exports and member handover using available functions and lawful permissions before closure. If enterprise control is disputed, we may pause irreversible actions and request appropriate evidence of authority.

11. Your rights and how to make a request

Depending on applicable law and circumstances, you may have rights to notice and explanation; access or a copy; correction or completion; deletion; restriction; objection to legitimate-interest processing or direct marketing; withdrawal of consent; portability; account deletion; explanation of automated decisions; and complaint to an authority. We also address rights lawfully available to authorized agents or close relatives of deceased people.

Request routes:

1. First use available in-app profile, permission, or deletion functions.
2. For employee, customer, or transaction data whose purposes are determined by your Organization, you may first contact the administrator or its privacy lead.
3. You may also contact Wynie directly using Section 16. We will help identify the appropriate responsible party and will not deny reasonable assistance merely because the Organization also has responsibility.

To protect accounts, enterprise secrets, and other people’s information, we may verify identity, account control, or agent authority. We may lawfully limit or charge a reasonable fee for excessive, repetitive, or manifestly unfounded requests and will explain the main reason and available appeal route.

We respond within the time set by applicable law. Where Chinese law and current rules apply, requests are generally handled within 15 working days. Where the GDPR applies, we generally respond within one month, with a lawful extension and explanation for complex or numerous requests. Swiss and other requests are handled within the corresponding legal or reasonable period. You can withdraw device permissions in system settings. Consent withdrawal does not affect prior lawful processing.

12. Security and incident response

Considering the nature and risk of the information, we use reasonable technical and organizational measures such as transmission protection, appropriate storage encryption, access controls and role permissions, credential safeguards, logging and monitoring, network protection, backups, provider management, employee confidentiality, and incident response. Administrators should likewise apply least privilege, remove departing members promptly, and protect exported copies.

No system can guarantee absolute security. If a personal-information incident occurs, we take steps to contain, investigate, remediate, and reduce risk and, where applicable law requires, notify the competent authority and affected people of the nature, likely impact, measures, and available recommendations.

If you identify a suspicious sign-in, wrong recipient, public exposure, malicious file, or credential disclosure, end sessions or reset credentials in the account and contact support@b2bdirect.online promptly. Do not include unnecessary passwords, complete verification codes, or third-party sensitive information in the report.

13. Tracking, marketing, and automated decisions

As of the effective date, BD Seller has no third-party advertising, cross-app advertising tracking, third-party behavioral analytics, or third-party crash-reporting SDK. We do not sell personal information or share it for data-broker purposes. The application may use security logs and necessary service metrics for authentication, troubleshooting, and protection, not cross-company advertising profiles.

Rules or technical signals may identify abnormal sign-ins, abuse, or malicious content, but we do not rely solely on automated processing for a final decision that has legal or similarly significant effects on you. If we introduce such decisions, we will explain the logic and effects as required and provide human review, an opportunity to express your view, and a way to challenge the decision where applicable.

This static Policy page itself sets no cookies, uses no localStorage, and loads no external analytics, fonts, images, scripts, or advertising resources. A hosting provider may still generate standard server access logs for network security; those logs are handled under this Policy’s security purposes and retention standards.

14. Minors

BD Seller is a commercial service for organizations and professionals and is not designed for children. We do not market to children or knowingly ask them to create an enterprise account. A user must have the capacity required by local law and organizational authorization. Where law requires guardian consent, both guardian consent and authorization from the Organization are required.

If you believe a child provided personal information without appropriate authority or consent, contact us. We will verify and delete, restrict, or otherwise handle it under applicable law.

15. Policy updates

We may update this Policy as Service functions, providers, processing, or law changes. A new version will identify its version and effective date, and we will communicate material changes through an in-app message, the relevant web page, email, or another reasonable method. We will follow advance-notice, renewed-consent, or separate-consent requirements where applicable.

Where reasonably feasible, we will provide an opportunity to review and save a material update before it takes effect. Continued use does not replace consent expressly required by law. We preserve and provide historical versions where applicable law requires.

16. Contact us and complaints

To exercise a privacy right, ask about transfer safeguards, report a security concern, or complain, contact:

We encourage you to contact us first so we can resolve the issue promptly. You also have the right to complain to a personal-information or data-protection authority with jurisdiction where you live or over the processing, such as a competent Chinese cyberspace authority, the Swiss Federal Data Protection and Information Commissioner (FDPIC), or a data protection supervisory authority in a European Economic Area member state. This right does not depend on contacting us first.