1. Who we are and scope
This policy applies to business enquiries and sample requests submitted through the English and Chinese pages of matchaex.com, and direct business enquiries sent to the email shown on the site. The controller is 抹茶星茶业（杭州）有限公司, Unified Social Credit Code 91330110MA2HXJGP4M, registered at 浙江省杭州市余杭区径山镇漕桥村荷塘下77号.
Privacy questions and requests can be sent to matchaliu@outlook.com.
2. Information we collect
Depending on the form, we collect company, country or region, contact name, business email, optional telephone or WhatsApp and website, together with the product, market, volume, sample, testing, documentation, packaging and project information you choose to provide.
For a direct business email, we process the message, sender and contact details, and ordinary email metadata needed to receive and reply to it.
We also record the form type and language, consent and policy version, submission time, request ID and limited technical security information needed to prevent abuse and operate the service. The website does not accept attachments. Please do not submit identity documents, financial account information, health data or unrelated sensitive information.
3. Why we use it
We use the information only to review and respond to your request, conduct one-to-one follow-up relating to that project, discuss samples, quotations, documentation, packaging and commercial requirements, prevent abuse, troubleshoot and protect the service.
We do not sell enquiry information, disclose or share it with unrelated third parties, use it for advertising profiles, bulk marketing or unrelated commercial purposes, or synchronise it with unrelated business systems. Any future newsletter will require separate consent.
4. Storage, access and retention
Forms are submitted over HTTPS. A protected copy is stored in a dedicated enquiry database and a notification copy is delivered to the receiving mailbox. The internal database has one authorised administrator account; only that administrator may access the internal console, which is not made publicly accessible.
Only when needed to handle an enquiry or privacy-rights request, the sole authorised administrator may create a minimum-scope CSV export after re-authentication. The file is downloaded directly, is not retained on the server, and must not be synchronised to another system or shared with another person. It must be securely deleted when the task is completed and no later than the six-month expiry of the corresponding enquiry record.
Enquiry database records and enquiry email are retained for six months from submission, then permanently deleted from the active database and mailbox. Security logs and backups containing personal information are retained for no more than one month from creation. A deleted active record may remain in a rolling backup until that backup expires, for no longer than one additional month.
5. Service providers and international processing
We use infrastructure and service providers only where needed to run and protect the website and deliver enquiry notifications. This includes Alibaba Cloud hosting located in Singapore, Alibaba Cloud ESA edge security services, Google Gmail SMTP delivery, and the Microsoft Outlook receiving mailbox.
Because visitors, infrastructure and email services may be in different countries or regions, necessary information may be processed across borders to handle your request. We limit access and the information used for each service and apply account, encryption, retention and access controls appropriate to the risk.
6. Analytics, cookies and security
At launch we do not use Google Analytics, Microsoft Clarity, advertising scripts or marketing pixels. We do not set analytics or advertising cookies. The edge security service may use strictly necessary technical mechanisms to detect abuse and protect the site.
We use encrypted transmission, restricted access, separate credentials, encrypted enquiry storage, security logging and rolling backups. No method of transmission or storage can be guaranteed absolutely secure.
7. Your choices and rights
You may contact matchaliu@outlook.com to request access, correction or deletion, withdraw consent where applicable, or raise a privacy complaint. We may ask for information needed to verify your connection to the relevant record and ordinarily respond within 30 days.
This is a business-to-business website and is not intended for minors. If we learn that a minor has submitted personal information, we will delete it.
8. Changes
We may update this policy when the website or processing arrangements change. The current version and effective date will be shown on this page. Material changes will be presented before they apply to new form submissions.