Privacy policy

Privacy Policy

drinkware (drinkwarehq.com) Effective date: October 28, 2026 | Last updated: October 28, 2026 | Version: 1.2.3

This Privacy Policy explains how Yongkang Qianya Hardware Products Factory (永康市千雅五金制品厂), an individually owned business (individual industrial and commercial household, 个体工商户) registered in the People's Republic of China under unified social credit code 92330784MAKM1N1Q0Y, with its registered address at Room 3 (third from the east), 5th Floor, No. 73 Qianjin Road, Zhiying No. 7 Village, Zhiying Town, Yongkang, Jinhua, Zhejiang 321306, China ("we", "us", "our") collects, uses, shares and protects personal data when you visit drinkwarehq.com (the "Site"), submit an inquiry, place a wholesale order or otherwise do business with us.

We are a manufacturer and exporter of stainless-steel drinkware established in the People's Republic of China. The Site is intended for business buyers only. Most of the personal data we handle relates to individuals acting on behalf of businesses (for example buyers, procurement staff and logistics contacts).

1. Who we are and how to contact us


Controller	Yongkang Qianya Hardware Products Factory (永康市千雅五金制品厂)
Legal form	Individually owned business (individual industrial and commercial household, 个体工商户) registered in the People's Republic of China
Unified Social Credit Code	92330784MAKM1N1Q0Y
Registered address	Room 3 (third from the east), 5th Floor, No. 73 Qianjin Road, Zhiying No. 7 Village, Zhiying Town, Yongkang, Jinhua, Zhejiang 321306, China
Privacy contact	privacy@drinkwarehq.com
General contact	sales@drinkwarehq.com
Phone	+86 136 3423 3984

If you are located in the EEA or the UK, you can contact us directly using the details above.

2. Scope and applicable laws

This Policy is designed to meet the requirements of, to the extent each applies to us:

the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR");
the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025 ("UK GDPR");
the Swiss Federal Act on Data Protection of 25 September 2020 ("FADP"), to the extent it applies to us;
the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA");
Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA");
the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL");
the Saudi Personal Data Protection Law issued by Royal Decree No. M/19 and its Implementing Regulations ("Saudi PDPL");
Qatar Law No. 13 of 2016 on the Protection of Personal Data Privacy ("Qatar PDPPL");
the Oman Personal Data Protection Law issued by Royal Decree No. 6/2022, as amended, and its Executive Regulations ("Oman PDPL");
Bahrain Law No. 30 of 2018 with respect to Personal Data Protection ("Bahrain PDPL"), to the extent it applies to our processing;
the Malaysian Personal Data Protection Act 2010, as amended ("Malaysian PDPA"), to the extent it applies to our processing;
the Thai Personal Data Protection Act B.E. 2562 (2019) ("Thai PDPA");
the PRC Personal Information Protection Law ("PIPL"), which applies to our processing in China; and
the electronic marketing laws that apply to business emails, including the US CAN-SPAM Act, Canada's Anti-Spam Legislation ("CASL"), the EU ePrivacy rules as implemented in each EU member state, and the UK Privacy and Electronic Communications Regulations ("PECR").

Kuwait does not currently have a general personal data protection law. If you are located in Kuwait, we apply the protections described in this Policy and comply with any Kuwaiti law that applies to us.

Where these laws give you different rights, we will honor the rights that apply to you based on where you are located.

3. Personal data we collect

3.1 Information you give us

Source	Data
Inquiry / request-for-quote form	Company name; your first and last name; business email address; phone or messaging number (optional); country; job title (optional); product interest, quantities and message content; any files you send us with your request, by email or through a file-sharing link you provide (such as logos, artwork, drawings or reference images), which we download and store in our business email and file storage systems; your choices on the form (acknowledgement of this Policy and, where the form offers it, whether you agree to receive marketing emails), with the date and time. Our OEM and private-label quote forms have an optional "File link" field, where you can give us a link to a third-party file-sharing service (such as WeTransfer, Google Drive or Dropbox). If you give us a file-sharing link, the file-sharing service's own terms and privacy policy apply; we do not fetch or preview the link automatically when you submit the form. Our staff open the link manually to download the files so that we can respond to your inquiry. The marketing email box on our wholesale form is optional and unticked; if you do not tick it, we will not send you marketing emails on the basis of your form submission (Section 10.1 explains the limited other cases in which we may email business contacts), and you can unsubscribe from any marketing email at any time (see Section 10.2).
Wholesale account and orders	Company details (registered name, address, tax or registration numbers); names and contact details of your authorized contacts; delivery, consignee and notify-party details; order, quotation and proforma invoice ("PI") history; communications with us
Payments	Bank remittance details shown on payment slips (for example remitting bank, account name and reference). Advance payments and balance payments are made by bank wire transfer. We may also use third-party payment processors where stated in the quotation or PI; if you pay through a third-party payment processor, that processor handles your payment details under its own privacy notice, and we receive only the payment confirmation and related transaction details. We do not collect or store payment card numbers.
Business communications	Emails, messages, call notes, meeting records and samples requests

3.2 Information collected automatically

Category	Data
Campaign (UTM) parameters	When you arrive at the Site through a link containing UTM parameters, we may record `utm_source`, `utm_medium`, `utm_campaign`, `utm_term` and `utm_content`, together with the landing page and referring URL, and attach them to your inquiry when you submit the form. This tells us which campaign or channel led to the inquiry. If you visit the Site from the EEA (including the EU's outermost regions and the Åland Islands) or the UK, we store these parameters in your browser before you submit the form only if you have accepted marketing cookies through the cookie banner (see Section 7).
Device and usage data	IP address, browser type, device type, operating system, language, pages viewed, your interactions with the Site (such as viewing products or adding items to the cart), time and date of visits, and approximate location derived from IP address. Where you allow analytics cookies, this includes data collected through Shopify analytics and Google Analytics, including a pseudonymous online identifier stored in a cookie (see Section 7). Google states that it does not log or store the IP addresses of Google Analytics users in the EU, Switzerland or the UK
Cookies and similar technologies	See Section 7

3.3 Information from third parties

We may receive business contact information from trade shows, business directories, logistics providers, freight forwarders, or your colleagues who place orders on your company's behalf.

3.4 Business contact details from publicly available sources

To identify potential business customers, we may collect business contact details that you or your company have made publicly available, for example on your company's website or contact page, in public trade show exhibitor lists, in business directories, or in public import records. Where a professional networking platform is the source, we use only details that you have given us directly in a conversation on that platform; we do not copy or scrape data from those platforms.

The data we collect in this way is limited to your name, job title, business email address, company name, company website and country, together with a record of where and when we found it. We do not collect private email addresses, private phone numbers or any sensitive data for this purpose.

3.5 Sensitive data

We do not knowingly collect sensitive personal data (such as health data, biometric data or government ID numbers of individuals) through the Site. Please do not include such data in inquiry messages.

4. Why we use personal data and our legal bases

Purpose	Data	Legal basis (GDPR / UK GDPR)
Responding to your inquiry and preparing quotations	Inquiry form data, communications	Our legitimate interests in responding to business inquiries (Art. 6(1)(f)); where you contact us on your own behalf as a sole trader, steps prior to entering into a contract (Art. 6(1)(b))
Setting up and managing wholesale accounts, orders, PIs, shipping documents and after-sales service	Account, order and contact data	Performance of a contract with you or, where the contract is with your company, our legitimate interests in performing that contract (Art. 6(1)(b) / (f))
Measuring which campaigns generate inquiries (UTM attribution)	UTM parameters, landing page, referrer	Legitimate interests in understanding the effectiveness of our marketing (Art. 6(1)(f)); storing or reading information on your device for this purpose is based on your consent where required by the ePrivacy Directive or PECR
Analytics and advertising cookies (including Google Analytics)	Cookie identifiers, device and usage data	Consent (Art. 6(1)(a)). You can withdraw your consent at any time (see Section 7)
Sending marketing emails about products, catalogs and trade shows	Name, business email, preferences	Consent (Art. 6(1)(a)), or where permitted by law for existing customers, our legitimate interests (Art. 6(1)(f)) subject to your right to opt out at any time
Business-to-business prospecting: identifying potential business customers and sending a limited number of introductory business emails (see Section 10.1)	Name, job title, business email, company, country, source of the data, our communications with you	Our legitimate interests in developing our business with relevant business buyers (Art. 6(1)(f)), only where the e-privacy law of your country allows such emails without prior consent; otherwise your consent (Art. 6(1)(a)). You can object at any time, free of charge
Recording consents, opt-outs and our compliance assessments	Consent and opt-out records, assessment records	Compliance with legal obligations (Art. 6(1)(c)) and legitimate interests in demonstrating compliance (Art. 6(1)(f))
Export control, sanctions screening and customer due diligence	Company and contact data	Compliance with legal obligations (Art. 6(1)(c)) and legitimate interests in avoiding dealings with sanctioned parties (Art. 6(1)(f))
Accounting, tax, customs and record-keeping	Order and payment data	Compliance with legal obligations (Art. 6(1)(c))
Product safety, traceability, complaints and recalls	Order, batch and contact data	Legal obligations and legitimate interests in product safety (Art. 6(1)(c) / (f))
Site security and fraud prevention	Device and usage data	Legitimate interests (Art. 6(1)(f))
Establishing, exercising or defending legal claims	Relevant records	Legitimate interests (Art. 6(1)(f))

Where we rely on legitimate interests, we have balanced our interests against your rights. You may ask us for more information about this balancing test.

Canada (PIPEDA and CASL). We collect, use and disclose personal information with your knowledge and consent, which may be express (for example the marketing checkbox) or implied where reasonable for business communications, and only for the purposes described in this Policy. We send commercial electronic messages to recipients in Canada only with consent. Where we have not obtained express consent, we rely on implied consent as permitted by CASL, for example where you have conspicuously published your business email address without stating that you do not wish to receive unsolicited commercial messages and our message is relevant to your business role, or where you have given us your business email address (for example on a business card) without such a statement, or where you made an inquiry to us within the previous six months.

GCC countries. If you are located in the United Arab Emirates, Saudi Arabia, Qatar, Kuwait, Bahrain or Oman, we process personal data only on a basis permitted by the law that applies to you:

United Arab Emirates: your consent, or another case permitted by the UAE PDPL, such as processing necessary to perform a contract or take steps you request before entering into a contract, compliance with legal obligations, or business contact details that you have made publicly available yourself.
Saudi Arabia: your consent, or another basis permitted by the Saudi PDPL, such as the performance of a contract, compliance with legal obligations or our legitimate interests. We send advertising or marketing material only with your prior consent, unless there has been a prior interaction between you and us as permitted by the Saudi PDPL Implementing Regulation.
Qatar: your consent, or processing necessary for a lawful purpose as permitted by the Qatar PDPPL. We send direct marketing by electronic communication only with your prior consent.
Oman: your explicit consent, or another case permitted by the Oman PDPL, such as the performance of a contract or compliance with legal obligations. We send advertising or marketing material only with your prior explicit consent.
Bahrain: where the Bahrain PDPL applies to us, your consent, the performance of a contract, compliance with legal obligations or our legitimate interests.
Kuwait: the bases described in this Policy.

Where consent is required, you may withdraw it at any time.

Malaysia and Thailand. If you are located in Malaysia or Thailand, we process personal data on the basis of your consent, the performance of a contract with you or your company, compliance with legal obligations, or our legitimate interests, as permitted by the Malaysian PDPA (where it applies to us) and the Thai PDPA. Where we rely on consent, you may withdraw it at any time.

China (PIPL). Because we are located in China, the PIPL applies to our processing. We process personal information to respond to your inquiries and to perform contracts with you or your company, and we may process business contact details that you or your company have made public, within a reasonable scope.

5. Who we share personal data with

We do not sell personal data and we do not share it for cross-context behavioral advertising unless you have consented to advertising cookies (see Section 9 for California).

We share personal data only with:

Shopify, which hosts the Site and provides our e-commerce platform. For the standard Shopify services, Shopify acts as our processor (service provider) under the Shopify Data Processing Addendum. For certain "Enhanced Services" (such as Shopify's fraud and network-level analytics features), Shopify may act as an independent controller; in that case Shopify's own Consumer Privacy Policy applies: https://www.shopify.com/legal/privacy/consumers. Shopify may process data in countries where it or its service providers operate, including Canada, the United States, Ireland and Singapore. We do not use Shopify Payments.
Google, which provides Google Analytics, to measure how the Site is used (see Section 7). Google processes this data on our behalf as our processor (service provider) under Google's data processing terms. We have turned off Google signals and Google's advertising features (including ads personalization), we do not link Google Analytics to Google Ads, and we have turned off the settings that allow Google to use Google Analytics data for Google's own products, services or advertising. Google Analytics is provided by Google LLC, which may process data in the United States and other countries where Google or its service providers operate. Google's Privacy Policy is available at https://policies.google.com/privacy, and information on how Google uses information from sites that use its services is available at https://policies.google.com/technologies/partner-sites.
Other service providers acting on our behalf, such as providers of business email, email forwarding, domain name (DNS) hosting and IT support. These providers are located in, or may process data in, the United States, China and other countries where they or their own service providers operate. They may only use personal data to provide their services to us, under their terms of service and, where offered, a data processing agreement.
WhatsApp (Meta). If you contact us through WhatsApp, for example using the WhatsApp button on the Site, WhatsApp, which is provided by Meta, processes your phone number, profile details and messages under its own terms and privacy policy (https://www.whatsapp.com/legal/privacy-policy). We receive and reply to your messages on our WhatsApp Business account in China, and we use them for our business communications with you as described in this Policy.
Logistics partners, including freight forwarders, carriers, customs brokers, inspection companies and testing laboratories, to the extent needed to ship goods, issue documents and carry out inspections.
Banks and payment service providers, to process payments and comply with anti-money-laundering rules.
Professional advisers, such as lawyers, auditors and insurers.
Authorities, where required by applicable law, including customs, tax, product-safety and law-enforcement authorities in China or in the destination country. We will assess the legal basis of any request from a public authority and disclose only what is required.
A successor business, in connection with a transfer or sale of our business or its assets, subject to equivalent protections.

6. International transfers

We are located in China. When you submit information through the Site, it is received and accessed by our personnel in China and stored on the systems of our service providers, including Shopify.

Data you provide directly to us. We do business with business customers in a number of countries. When you provide personal data directly to us, for example through the Site or in the course of our business relationship with you or your company, we collect it ourselves and it is processed in China. Where the applicable law treats this as a transfer of data, we rely on a basis permitted by that law, such as the transfer being necessary to respond to your inquiry or to perform a contract with you or your company. Wherever the data is processed, we apply the protections described in this Policy and, where the GDPR, the UK GDPR or another data protection law applies to our processing, the protections required by that law.
Data we pass to service providers outside the EEA, the UK and Switzerland. Where we share personal data that is subject to the GDPR, the UK GDPR or the FADP with service providers located in other countries (for example the United States), we use an adequacy decision where one applies (including, for US providers, certification under the EU-US Data Privacy Framework, the UK Extension or the Swiss-US Data Privacy Framework; for example, Google LLC, which provides Google Analytics, is certified under all three), or the European Commission's Standard Contractual Clauses and, for UK data, the IDTA or the UK Addendum, and, for Swiss data, the Standard Contractual Clauses with the adaptations required under the FADP.
Data transferred to us by organizations in the EEA or the UK. Where personal data is transferred to us in China by an organization in the EEA or the UK (for example a service provider), and no adequacy decision applies, we rely on the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, for UK transfers, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with supplementary measures where appropriate.
Assessment of Chinese law. We have assessed the laws of China that may apply to personal data we hold, including laws that allow public authorities to request access. We apply technical and organizational measures such as access controls, encryption in transit and limiting data to what is necessary.
Canada. Personal information may be processed outside Canada, including in China, and may be accessible to courts, law-enforcement and national security authorities of those jurisdictions.
GCC countries. Where the law of a GCC country requires it, we transfer personal data outside that country only where the law permits, including where the transfer is necessary to perform a contract with you or your company, and subject to appropriate safeguards.
Malaysia and Thailand. Where Malaysian or Thai law requires it, we transfer personal data outside those countries only where the law permits, including where the transfer is necessary to perform a contract with you or your company, or where appropriate safeguards are in place.

You may request a copy of the relevant safeguards by contacting privacy@drinkwarehq.com. Commercially sensitive terms may be redacted.

7. Cookies and similar technologies

We use cookies, pixels, local storage and similar technologies ("cookies").

Category	Purpose	Provider and main cookies (lifetime)	Consent required?
Strictly necessary	Run the Site and its security, remember your cookie choices, keep you signed in to your wholesale account, keep the cart working	Shopify and us, for example `_shopify_essential` (1 year), `cart` (2 weeks) and `localization` (1 year)	No
Analytics (Shopify)	Understand how visitors use the Site, using the analytics built into the Shopify platform	Shopify, for example `_shopify_analytics` (1 year)	Yes in the EEA and the UK; elsewhere, where required by law
Analytics (Google Analytics)	Count visits and understand how visitors find and use the Site (for example, which pages and products are viewed), using Google Analytics 4, which we connect through a Shopify custom pixel	Google: `_ga` (13 months), used to distinguish users; `_ga_<container-id>` (13 months), used to persist session state. These lifetimes are renewed each time you visit the Site and may be shorter in some browsers	Yes in the EEA and the UK; elsewhere, where required by law
Marketing / attribution	Measure campaigns and store UTM parameters across pages before you submit an inquiry. We do not currently use third-party advertising pixels, Google Ads or other Google advertising features on the Site	Shopify, for example `_shopify_marketing` (1 year), and our own storage of UTM parameters in your browser	Yes in the EEA and the UK; elsewhere, where required by law

Cookie banner. If you visit the Site from the European Economic Area (EEA) or the UK, you will see a cookie banner and can choose to accept or decline non-essential (personalization, analytics and marketing) cookies, or set your preferences. For this purpose, the EEA means the EU member states, including the EU's outermost regions (such as Guadeloupe, French Guiana, Martinique, Mayotte, Réunion and Saint-Martin) and the Åland Islands, together with Iceland, Liechtenstein and Norway. In those places we set non-essential cookies, and load Google Analytics, only after you accept the relevant cookies. Strictly necessary cookies are always used, because the Site cannot work without them.
Spam protection on our forms. Our contact forms use hCaptcha to protect against spam and abuse. It loads only when you start using a form and may set a short-lived security cookie (__cf_bm, about 30 minutes). We use it because it is strictly necessary to keep our forms secure, so it does not require your consent.
Google Analytics. Google Analytics collects a pseudonymous identifier stored in the _ga cookie, information about your browser and device, the pages you view and your interactions with the Site, and your approximate location. This includes shopping events such as adding products to your cart, starting checkout and placing an order (order number, value and products), but not your name, email address, phone number or postal address. Google states that it does not log or store the IP addresses of users in the EU, Switzerland or the UK; it uses them only to derive approximate location and then discards them. We have turned off Google signals and Google's advertising features (including ads personalization), we do not link Google Analytics to Google Ads, and we have turned off the settings that allow Google to use Google Analytics data for Google's own products, services or advertising. Google processes this data on our behalf as our service provider (see Section 5). We keep user-level and event-level data in Google Analytics for 2 months (see Section 8). You can find out how Google uses information from sites that use its services at https://policies.google.com/technologies/partner-sites, and you can prevent Google Analytics from running in your browser with Google's opt-out browser add-on (https://tools.google.com/dlpage/gaoptout).
Google Consent Mode. The Google tag on the Site is loaded only through our cookie consent tool. If you visit the Site from the EEA or the UK, it is not loaded unless you accept analytics cookies. We also configure Google Consent Mode so that advertising-related storage and signals are always set to ‘denied’.
Managing cookies in your browser. Wherever you are located, you can block or delete cookies through your browser settings, and most browsers let you refuse cookies from particular websites or delete cookies when you close the browser. If you block strictly necessary cookies, parts of the Site (such as the cart or your account) may not work.
Changing your choices. Where the cookie banner is shown to you, you can change your choices at any time via the Cookie Settings link in the Site footer, or through your browser settings. If you withdraw your consent, we stop using the cookies concerned from that point; cookies already set may remain in your browser until they expire or you delete them.
Visitors from Switzerland and other countries. If you visit the Site from a country where we do not show the cookie banner, including Switzerland, analytics cookies (including Google Analytics) and marketing cookies (including our storage of UTM parameters) are set when you visit. You can refuse them at any time via the Cookie Settings link in the Site footer (untick Analytics and Marketing), through your browser settings, or, for Google Analytics, with Google's opt-out browser add-on (https://tools.google.com/dlpage/gaoptout). If you refuse, we stop using the cookies concerned from that point.
Shopify platform data. Even if you have not accepted analytics and marketing cookies, or have refused them, Shopify, our e-commerce platform, still processes limited technical information to operate and secure the Site, such as the address of the page you are viewing (which may include campaign parameters in the link), and marks this information to show that you have not allowed tracking.
Emails. We have switched off open tracking in our marketing emails, so they do not contain a tracking pixel and we do not record whether you opened an email. Our email service provider may still record when a link in one of our marketing emails is clicked, together with delivery and other engagement data (such as bounces and unsubscribes); we use this only to see how a campaign performed, and it may show which recipients clicked. You can unsubscribe at any time using the link in each email or as described in Section 10.2.
Global Privacy Control (GPC). Where applicable, we treat a GPC signal as a valid request to opt out of the "sale" or "sharing" of personal information.
More information. You can ask us for a list of the cookies we use, their providers and lifetimes using the contact details in Section 1.

8. How long we keep personal data

Data	Retention period
Inquiries that do not lead to an order	12 months after our last communication, then deleted or anonymized. If we have sent you a quotation, 3 years after the quotation expired or after our last communication about it, whichever is later, then deleted or anonymized
Customer account, order, PI, shipping and invoice records	For the duration of the business relationship, and afterwards for as long as required by applicable accounting, tax, customs and export record-keeping laws, or as long as needed to establish or defend legal claims
Product traceability and safety records (batch, consignee)	At least 10 years after the product was supplied, in line with product-safety documentation requirements
Business prospects who have not replied to our introductory emails	12 months after our last email, then deleted or anonymized
Marketing consent records	While you remain subscribed, and for up to 5 years after you withdraw consent or after our last marketing email, so that we can demonstrate that we had your consent
Records of our legitimate-interests assessments and of the source of business contact details	For up to 3 years after our last email to you, to demonstrate compliance
Suppression list	After you unsubscribe, object or ask us to delete your data, we keep a minimal record (a hashed version of your email address, the date and the channel) for as long as needed so that we do not contact you again. We use it only for this purpose
Sanctions and export control screening records	For prospects and inquiries, together with the prospect or inquiry record (see above). For customers (businesses that have placed at least one confirmed order), 5 years after the last transaction. After these periods, we keep only a minimal company-level record of the screening result (such as the company's legal name, registration number, the lists checked, the date and the result), which contains no personal data about individuals: for prospects and inquiries, for 3 years after our last communication (or, where we sent a quotation, after it expired or after our last communication about it, whichever is later); for customers, for 10 years after the last transaction. We do not keep this record where the business name identifies an individual (for example a sole trader)
Security and server logs	Generally no longer than 12 months, unless needed for longer to investigate a security incident. Logs kept by Shopify as part of its platform are retained in accordance with Shopify's policies
Cookies	For the lifetimes stated in Section 7 or in our cookie list, which is available on request (see Section 7). The Google Analytics cookies (`_ga` and `_ga_<container-id>`) last up to 13 months from your last visit unless you delete them earlier. We have set Google Analytics to delete user-level and event-level data automatically after 2 months; aggregated reports that do not identify you may be kept for longer

We may keep personal data for longer than the periods above where this is necessary for actual or reasonably anticipated legal proceedings, or for a regulatory investigation or request. In that case we keep only the data relevant to the matter, use it only for that purpose, and delete or anonymize it within 30 days after the matter is closed or at the end of the period above, whichever is later.

9. Your rights

9.1 EEA, UK and Switzerland

If you are in the EEA or the UK, you have the right to:

access your personal data;
rectify inaccurate data;
erase your data;
restrict processing;
data portability;
object to processing based on legitimate interests, and to object at any time to direct marketing;
withdraw consent at any time, without affecting processing that took place before you withdrew;
complain to us (see "Complaints to us" below); and
lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work, or, in the UK, with the Information Commission (which continues to be known as the ICO, ico.org.uk).

Switzerland. If you are in Switzerland, you have the rights given to you by the FADP, in particular the rights to access your personal data, to have inaccurate data corrected, to object to processing and ask for your data to be deleted, to receive your data in a portable format, and to withdraw consent at any time. You may also contact the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch).

Complaints to us. If you think we have not complied with data protection law in relation to your personal data, you may complain to us by emailing privacy@drinkwarehq.com with the subject line "Data Protection Complaint" or by post to the address in Section 14. If you are in the UK, this is a legal right. We will acknowledge your complaint within 30 days of receiving it, look into it without undue delay, keep you informed of our progress, and tell you the outcome. Complaining to us does not affect your right to complain to a supervisory authority at any time. We would appreciate the chance to address your concerns first.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

9.2 California (CCPA)

If the CCPA applies to us, California residents, including business contacts, have the right to:

know what personal information we collect, use and disclose, and access it;
delete it;
correct it;
opt out of the sale or sharing of personal information; and
not be discriminated against for exercising these rights.

We do not sell personal information. We use Google Analytics as a service provider. We have turned off Google signals and Google's advertising features (including ads personalization), we do not link Google Analytics to Google Ads, and we have turned off the settings that allow Google to use Google Analytics data for Google's own products, services or advertising. We therefore do not use Google Analytics for cross-context behavioral advertising. If we use advertising cookies in the future that may be considered "sharing", you can opt out by sending a Global Privacy Control (GPC) signal from your browser, or by using our opt-out page at https://drinkwarehq.com/pages/data-sharing-opt-out. We do not use or disclose sensitive personal information for purposes that require a right to limit. The categories of personal information we collect are described in Section 3, the sources in Section 3, the purposes in Section 4, the recipients in Section 5, and retention in Section 8. In the preceding 12 months, we have disclosed identifiers, commercial information, and internet or network activity to service providers (including Shopify and Google) and logistics partners for the business purposes described in Section 4.

You may use an authorized agent to submit a request. We will verify your identity, and your agent's authority, before responding.

9.3 Canada (PIPEDA)

You may request access to, and correction of, your personal information, and you may withdraw consent subject to legal or contractual restrictions. You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

9.4 GCC countries (UAE, Saudi Arabia, Qatar, Kuwait, Bahrain and Oman)

Subject to the law that applies to you (including the UAE PDPL, the Saudi PDPL, the Qatar PDPPL, the Oman PDPL and, where it applies to us, the Bahrain PDPL), you may have the right to:

be informed about the processing of your data;
access a copy of it;
request correction, completion or updating;
request deletion of data no longer needed;
withdraw consent; and
object to or restrict certain processing, including, free of charge, processing for direct marketing.

You may also complain to the competent data protection authority in your country where one exists, for example the Saudi Data & AI Authority (SDAIA) in Saudi Arabia or the Personal Data Protection Authority in Bahrain.

9.5 Malaysia and Thailand

Subject to the Malaysian PDPA (where it applies to us) and the Thai PDPA, you may have the right to access and obtain a copy of your personal data, to correct it, to request data portability where technically feasible, to object to or restrict processing, to request erasure, to withdraw consent and to ask us to stop using your data for direct marketing. You may also complain to the Personal Data Protection Commissioner in Malaysia or the Personal Data Protection Committee in Thailand.

9.6 How to exercise your rights

Email privacy@drinkwarehq.com with the subject line "Privacy Request". We will respond within the time required by applicable law: generally one month under the GDPR and UK GDPR (extendable where permitted), 45 days under the CCPA, and 30 days under PIPEDA. We may need to verify your identity before acting on a request.

10. Marketing emails

10.1 When we send marketing emails

We send marketing emails:

where you have opted in (for example by ticking the separate marketing box on our inquiry form);
where the law permits us to contact existing business customers about similar products; and
where the law of your country allows it, a limited number of introductory business emails.

The marketing box on our inquiry form is optional and not pre-ticked. Submitting an inquiry does not require you to agree to marketing, and we do not add people who submit an inquiry without ticking the marketing box to our introductory email sequences.

In Thailand, we send marketing emails only with your consent or where another lawful basis under the Thai PDPA applies; in Malaysia, you may ask us at any time to stop sending you direct marketing.

We do not send unsolicited marketing emails to individuals in the European Economic Area or the United Kingdom.

If we send you an introductory business email, our first email tells you who we are, how we obtained your contact details, and where to find this Policy. You can object at any time, free of charge, and we will not contact you again.

10.2 Your choices and our commitments

Every marketing email tells you how to unsubscribe, by a link or by replying or emailing us. You can also unsubscribe by emailing sales@drinkwarehq.com. Unsubscribing is free. We process unsubscribe requests promptly, and in any event within the periods required by law (for example 10 business days under the US CAN-SPAM Act and CASL, and shorter periods where local law requires).
Our marketing emails identify us as the sender, state that they are marketing, and include our postal address and an email address at which you can contact us.
Service messages about your inquiries, orders or shipments are not marketing, and you will continue to receive them after unsubscribing.
We do not buy email lists from unknown sources, and we do not use automated tools to harvest email addresses from websites or professional networking platforms.

11. Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss or alteration, including:

role-based access;
encryption in transit (HTTPS);
strong authentication on administrative accounts; and
contractual obligations on service providers.

No method of transmission or storage is completely secure. Where the law requires it, we will notify the relevant authorities and affected individuals of a personal data breach.

12. Children

The Site is intended for business buyers and is not directed at children. We do not knowingly collect personal data from anyone under 16.

13. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top shows when it was last changed. If we make material changes, we will notify you by email or by a notice on the Site where appropriate.

14. Contact

Yongkang Qianya Hardware Products Factory (永康市千雅五金制品厂) Room 3 (third from the east), 5th Floor, No. 73 Qianjin Road, Zhiying No. 7 Village, Zhiying Town, Yongkang, Jinhua, Zhejiang 321306, China Email: privacy@drinkwarehq.com
Phone: +86 136 3423 3984