Privacy Policy

1. Who We Are

CJK Sourcing operates cjksourcing.com as a B2B supplement sourcing intermediary based in Barcelona, Spain. For the purposes of data protection law, CJK Sourcing is the data controller responsible for your personal data.

Contact: enquiries@cjksourcing.com

2. What Data We Collect

We only collect personal data that you actively provide to us or that is generated through your use of this website:

• Contact and enquiry data — name, business name, email address, phone number, and message content submitted through our contact form or by email
• Communication data — any information you include in direct correspondence with us
• Website usage data — IP address, browser type, pages visited, time spent on site, and referral source, collected via cookies and analytics tools
• Business data — company details, sourcing requirements, and other commercial information shared during the course of a business relationshipWe do not collect sensitive personal data.

We do not knowingly collect data from individuals under the age of 16.

3. How We Use Your Data

• Purpose Legal Basis (GDPR)
• Responding to enquiries and contact form submissions
• Legitimate interests / Pre-contractual steps
• Managing and maintaining client relationships.
• Performance of a contract
• Sending relevant business communications
• Legitimate interests (B2B) / Consent (where required)
• Improving website performance and user experienceLegitimate interests
• Complying with legal and regulatory obligations
• Legal obligation
• Defending or pursuing legal claimsLegitimate interests / Legal obligation

We do not use your personal data for automated decision-making or profiling.

4. Cookies & Analytics

We use cookies and similar tracking technologies to understand how visitors use our website. These may include:

• Essential cookies — necessary for the website to function
• Analytics cookies — tools such as Google Analytics to collect anonymised or pseudonymised usage data

Where required by EU law (ePrivacy Directive / GDPR), we will request your consent before placing non-essential cookies. You can withdraw consent or manage cookie preferences at any time through your browser settings or our cookie banner.

For more information on how Google Analytics handles data, visit google.com/policies/privacy.

5. Who We Share Your Data With

We do not sell, rent, or trade your personal data. We may share it only with:

• Service providers acting as data processors on our behalf — such as website hosting providers, email platforms, and analytics tools — who are contractually bound to handle your data securely and only for specified purposes
• Legal or regulatory authorities where required or permitted by law
• Professional advisors such as lawyers or accountants where necessary

Any third-party processors outside the EU/EEA are subject to appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure your data remains protected in line with GDPR requirements.

6. How Long We Keep Your Data

Data Type — Retention Period

Enquiry and contact data — Up to 2 years from last contact

Client relationship and contract data — Duration of contract plus 6 years

Analytics and website usage data — As per third-party provider policy (typically 26 months for Google Analytics)

Legal or compliance records — As required by applicable law

When data is no longer required, it is securely deleted or anonymised.

7. Your Rights Under GDPR (EU & UK Users)

If you are located in the European Union or United Kingdom, you have the following rights under the GDPR and UK GDPR:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete dataRight to erasure — request deletion of your data where there is no legitimate reason for us to retain it
• Right to restriction — request that we limit how we use your data
• Right to object — object to processing based on legitimate interests
• Right to data portability — receive your data in a structured, machine-readable format
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing
• Right to lodge a complaint — you have the right to complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD) at aepd.es, or your local EU supervisory authority

To exercise any of these rights, contact us at enquiries@cjksourcing.com. We will respond within 30 days.

8. Your Rights Under CCPA (California Residents)

If you are a resident of California, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to know — request disclosure of the categories and specific pieces of personal data we have collected about you, and how it is used and shared
• Right to delete — request deletion of your personal data, subject to certain exceptions
• Right to opt out of sale — we do not sell personal data. You therefore have no need to opt out, but this right is confirmed here for transparency
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA rights

Categories of personal data collected:identifiers (name, email, IP address), commercial information (business and sourcing details), and internet activity (website usage data).

Purpose of collection:business communications, service delivery, and website improvement.To exercise your CCPA rights, contact us at enquiries@cjksourcing.com. We will respond within 45 days, with an option to extend by a further 45 days where necessary.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These include secure server infrastructure, restricted access controls, and encrypted communications where applicable.

While we take data security seriously, no method of transmission over the internet is completely secure. We cannot guarantee absolute security but are committed to promptly addressing any suspected data breach in accordance with our legal obligations.

10. International Data Transfers

CJK Sourcing is based in Barcelona, Spain, within the EU. Where personal data is transferred outside the EU/EEA — for example, to service providers in the US or other countries — we ensure that appropriate safeguards are in place, such as:

• European Commission-approved Standard Contractual Clauses (SCCs)
• Adequacy decisions where applicable

For California residents, data may be transferred to and processed in Spain and other countries. By using this website, you acknowledge this transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The latest version will always be available on this page with an updated effective date. We encourage you to review this page periodically.

12. Contact & Data Controller Details

CJK Sourcing

Barcelona, Spain

cjksourcing.com

enquiries@cjksourcing.com

For any data protection queries, requests to exercise your rights, or concerns about how we handle your data, please contact us at the above email address. We aim to respond to all requests within 30 days.