Privacy Policy

This Privacy Policy explains how All-in Pack Co., Ltd.("All-in Pack", "we", "us", or "our") collects, uses, discloses, and protects the personal information of business contacts, distributors, website visitors, and newsletter subscribers when you interact with our website www.allinpacks.com (the "Site") or otherwise engage with our products and services.

We are committed to compliance with global data-protection laws including the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and China's Personal Information Protection Law (PIPL).

The data controller responsible for your personal information is:

We collect the following categories of information:

a) Information you provide directly

• Contact details: Name, company name, job title, business email, phone number, country.
• Inquiry content: Product interest, industry, message content, technical requirements, RFQ specifications.
• Distributor application data: Company registration, market territory, annual purchase volume, references.
• Newsletter subscription: Email address and subscription preferences.

b) Information collected automatically

• Usage data: Pages visited, referring URL, time on site, click patterns.
• Device data: IP address (truncated for EU visitors), browser type, operating system, device type.
• Cookies: See Section 10.

We do not intentionally collect special-category data (health, biometric, political opinion, etc.). Please do not include such information in inquiries.

We process your personal data for the following purposes:

• Respond to inquiries submitted via the contact form, WhatsApp, or email.
• Process and fulfill orders, including shipping, customs documentation, and after-sales support.
• Manage distributor relationships, including territory agreements and pricing.
• Send transactional emails such as order confirmations and inquiry acknowledgments.
• Send marketing communications (newsletter, trade-show invites) — only with your consent, and you can unsubscribe at any time.
• Improve our website and product offerings using anonymized analytics.
• Comply with legal obligations, including export control, tax records, and anti-fraud requirements.

For visitors in the EU, UK, and EEA, we rely on the following lawful bases under Article 6 GDPR:

We share personal data only with:

• Service providers who help us operate our business — including hosting (Lovable Cloud / Supabase, EU and US regions), email delivery (Mailgun), analytics, and payment processors. All are bound by data-processing agreements.
• Logistics partners (DHL, FedEx, freight forwarders) for shipping and customs clearance.
• Authorized distributors in your region, where you have requested local support.
• Government authorities when legally required (export control, tax, court orders).
• Professional advisors (lawyers, auditors) under confidentiality.

We do not sell your personal information for monetary or other valuable consideration, as defined under CCPA, CPRA, or any other law.

As a Chinese exporter serving customers in 60+ countries, your information is necessarily transferred across borders. Specifically:

• Data submitted via our website is processed on Lovable Cloud infrastructure (EU and US regions).
• Customer data may be stored on our servers in China.
• Email is delivered via providers in the United States and Europe.

For transfers from the EU/UK to China, we rely on EU Standard Contractual Clauses (SCCs) and supplementary safeguards including encryption in transit (TLS 1.3) and at rest (AES-256). For transfers from China outbound, we comply with PIPL Articles 38–42 standard contracts where applicable.

We retain personal data only as long as necessary:

• Inquiry records: 3 years from last contact.
• Customer order data: 10 years (Chinese accounting law) or as required by your jurisdiction.
• Newsletter subscriptions: Until you unsubscribe, then 30 days for opt-out audit.
• Distributor agreements: Term of agreement + 7 years.
• Website analytics: 14 months (anonymized).

Depending on your location, you have the following rights:

EU / UK / EEA (GDPR)

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure / "right to be forgotten" (Art. 17)
• Right to restrict processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent at any time
• Right to lodge a complaint with your supervisory authority

California (CCPA / CPRA)

• Right to know what personal information we collect, use, and disclose
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of "sale" or "sharing" (we do neither)
• Right to non-discrimination for exercising your rights

China (PIPL)

• Right to know and decide on processing of your personal information
• Right to access, copy, correct, and delete your information
• Right to withdraw consent
• Right to request explanation of processing rules

To exercise any of these rights, email sales@allinpacks.com. We will respond within 30 days (or shorter where required by law).

We use a minimal set of cookies and similar technologies. See our separate Cookie Policy for full details.

• Essential cookies: Required for site functionality (session, security).
• Analytics cookies: Anonymized usage statistics. Used only with consent in EU/UK.
• No advertising cookies. We do not run retargeting or third-party ads.

We implement industry-standard technical and organizational measures:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access controls and audit logging
• Regular security reviews and dependency scans
• Employee confidentiality agreements and security training

In the event of a personal data breach affecting your rights, we will notify you and the relevant supervisory authority within 72 hours where required.

Our website and services are intended for B2B professional use only. We do not knowingly collect personal information from anyone under 18 (or under 14 for users in China). If you believe a minor has provided us with information, please contact us immediately.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. For material changes, we will notify newsletter subscribers by email and post a notice on the homepage at least 30 days before the change takes effect.

For any questions, concerns, or to exercise your privacy rights, please contact us:

EU residents may also contact their local Data Protection Authority. UK residents may contact the ICO. California residents have additional rights described above.