Privacy Policy

CJK Sourcing operates cjksourcing.com as a B2B supplement sourcing intermediary based in Barcelona, Spain. For the purposes of data protection law, CJK Sourcing is the data controller responsible for your personal data.

Contact:enquiries@cjksourcing.comcjksourcing.com

We only collect personal data that you actively provide to us or that is generated through your use of this website:
Contact and enquiry data — name, business name, email address, phone number, and message content submitted through our contact form or by email
Communication data — any information you include in direct correspondence with us
Website usage data — IP address, browser type, pages visited, time spent on site, and referral source, collected via cookies and analytics tools
Business data — company details, sourcing requirements, and other commercial information shared during the course of a business relationship

We do not collect sensitive personal data. We do not knowingly collect data from individuals under the age of 16.

PurposeLegal Basis (GDPR)Responding to enquiries and contact form submissionsLegitimate interests / Pre-contractual stepsManaging and maintaining client relationshipsPerformance of a contractSending relevant business communicationsLegitimate interests (B2B) / Consent (where required)Improving website performance and user experienceLegitimate interestsComplying with legal and regulatory obligationsLegal obligationDefending or pursuing legal claimsLegitimate interests / Legal obligationWe do not use your personal data for automated decision-making or profiling.

We use cookies and similar tracking technologies to understand how visitors use our website. These may include:
Essential cookies — necessary for the website to function
Analytics cookies — tools such as Google Analytics to collect anonymised or pseudonymised usage data
Where required by EU law (ePrivacy Directive / GDPR), we will request your consent before placing non-essential cookies. You can withdraw consent or manage cookie preferences at any time through your browser settings or our cookie banner.
‍
For more information on how Google Analytics handles data, visitgoogle.com/policies/privacy.

We do not sell, rent, or trade your personal data. We may share it only with:
Service providers acting as data processors on our behalf — such as website hosting providers, email platforms, and analytics tools — who are contractually bound to handle your data securely and only for specified purposes
Legal or regulatory authorities where required or permitted by law
Professional advisors such as lawyers or accountants where necessary
Any third-party processors outside the EU/EEA are subject to appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure your data remains protected in line with GDPR requirements.

Data TypeRetention PeriodEnquiry and contact dataUp to 2 years from last contactClient relationship and contract dataDuration of contract plus 6 yearsAnalytics and website usage dataAs per third-party provider policy (typically 26 months for Google Analytics)Legal or compliance recordsAs required by applicable lawWhen data is no longer required, it is securely deleted or anonymised.

If you are located in the European Union or United Kingdom, you have the following rights under the GDPR and UK GDPR:
Right of access — request a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate or incomplete data
Right to erasure — request deletion of your data where there is no legitimate reason for us to retain it
Right to restriction — request that we limit how we use your data
Right to object — object to processing based on legitimate interests
Right to data portability — receive your data in a structured, machine-readable format
Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing
Right to lodge a complaint — you have the right to complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD) at aepd.es, or your local EU supervisory authority
To exercise any of these rights, contact us atenquiries@cjksourcing.com. We will respond within 30 days.

If you are a resident of California, you have the following rights under the California Consumer Privacy Act (CCPA):
Right to know — request disclosure of the categories and specific pieces of personal data we have collected about you, and how it is used and shared
Right to delete — request deletion of your personal data, subject to certain exceptions
Right to opt out of sale — we do not sell personal data. You therefore have no need to opt out, but this right is confirmed here for transparency
Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA rights
Categories of personal data collected:identifiers (name, email, IP address), commercial information (business and sourcing details), and internet activity (website usage data).
Purpose of collection:business communications, service delivery, and website improvement.
To exercise your CCPA rights, contact us atenquiries@cjksourcing.com. We will respond within 45 days, with an option to extend by a further 45 days where necessary.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These include secure server infrastructure, restricted access controls, and encrypted communications where applicable.
While we take data security seriously, no method of transmission over the internet is completely secure. We cannot guarantee absolute security but are committed to promptly addressing any suspected data breach in accordance with our legal obligations.

CJK Sourcing is based in Barcelona, Spain, within the EU. Where personal data is transferred outside the EU/EEA — for example, to service providers in the US or other countries — we ensure that appropriate safeguards are in place, such as:
European Commission-approved Standard Contractual Clauses (SCCs)
Adequacy decisions where applicable
For California residents, data may be transferred to and processed in Spain and other countries. By using this website, you acknowledge this transfer.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The latest version will always be available on this page with an updated effective date. We encourage you to review this page periodically.

CJK SourcingBarcelona, Spain cjksourcing.comenquiries@cjksourcing.com
For any data protection queries, requests to exercise your rights, or concerns about how we handle your data, please contact us at the above email address. We aim to respond to all requests within 30 days.