Privacy Policy

The data controller and legal supplier of all products sold via YiwuPortal is YIWU ARIVON TRADE CO., LTD, our consolidated trade entity registered in Yiwu, Zhejiang, China. This entity operates as "data controller" under GDPR Art 4(7) and the equivalent role under Turkish KVKK and Chinese PIPL.

Data Protection Officer (DPO): dpo@yiwuportal.com

Account data: name, email, phone, company details, tax ID, payment methods.

Transactional data: order history, RFQ records, proforma + invoices, shipping addresses, payment receipts.

Communication data: WhatsApp messages, email correspondence, voice call records (with transcription on request).

Usage data: session logs, IP address, browser + device info, pages visited.

Preference data: language, currency, notification preferences, consent records.

Performance of contract (GDPR Art 6/1-b): account management, order processing, payment, shipping, customer service.

Legal obligation (GDPR Art 6/1-c): 10-year invoice retention under tax + commercial laws.

Explicit consent (GDPR Art 6/1-a): WhatsApp / email marketing, non-essential cookies, voice recording + transcription for AI training.

Legitimate interest (GDPR Art 6/1-f): platform security, fraud prevention, service improvement, AI customer service automation.

While the account is active + 12 months after closure (to respond to legal requests).

Order, invoice, payment records: 10 years (tax + commercial law obligation).

WhatsApp + voice records: 24 months (then automatic anonymization).

Cookies: session cookies expire on browser close; persistent cookies live a maximum of 12 months.

Marketing consent: 36 months unless renewed.

Cloud infrastructure providers (AWS, Cloudflare) — bound by Data Processing Agreements (DPAs).

Payment processors (Stripe, Iyzico, bank transfer providers).

Communications: SMTP provider (email), Evolution API (WhatsApp), Vapi (voice calls).

AI providers: Anthropic (Claude), OpenAI — calls flagged sensitive=true follow zero-training policies.

Logistics + customs partners: only the minimum data required for shipment.

Legal authorities: when required by court order or statutory obligation.

AWS regions may include EU and US. EU → US transfers rely on Standard Contractual Clauses (SCCs) plus supplementary measures.

Our China operations (Yiwu office) hold Chinese-region data only; EU/Turkey data does not flow into Chinese infrastructure.

Per GDPR Art 44-49, transfers to countries without adequacy decisions require explicit consent.

YiwuPortal uses an AI sales assistant (Anthropic Claude) to answer customer queries. The assistant provides product, pricing, and shipping information automatically.

AI-generated outputs (e.g. quote drafts, MOQ suggestions) do not produce legal effects. All binding offers are reviewed by our team.

We do NOT perform "solely automated decision-making" within the meaning of GDPR Art 22; human oversight is always present, and customers can request a human agent at any time.

Strictly necessary: session, language preference, cart — no consent required.

Analytics: visit statistics, page performance — explicit consent.

Marketing: ad tracking, retargeting — explicit consent.

Update preferences any time at /[locale]/cookie-preferences.

TLS 1.2+ encrypted transport, bcrypt password hashing, JWT-based session management.

Role-based DB access; every operation written to audit_logs.

Regular penetration testing + OWASP Top 10 controls. Security report: security@yiwuportal.com