Legal
Privacy notice
Last updated:
This notice explains what personal data Canton Hyland Hardware (Group) Co., Ltd. collects when you use cantonlock.com, why, and what rights you have. We sell door hardware to businesses. The site does not sell to consumers and has no user accounts.
1. Who is responsible
The controller is Canton Hyland Hardware (Group) Co., Ltd., No. 28 Lehe Road, Lianfeng Industry Park, Xiaolan Town, Zhongshan, Guangdong, China.
For any data-protection question or request, write to [email protected].
2. When you visit the site
Our web server and our content-delivery and security provider, Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), process the technical data every browser sends: IP address, date and time, the page requested, the referring page, browser and operating system. This is needed to deliver the pages, protect the site from automated attacks and investigate faults. Cloudflare may set a short-lived security cookie to tell people from bots, and it replaces email addresses in the page with a protected link so spam robots cannot collect them.
Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Logs are kept only as long as needed for these purposes.
Our typeface and our product videos are served from our own server. Opening a page does not contact Google Fonts, YouTube or Vimeo.
The site stores four small items in your browser. None of them identifies you:
- in session storage, the catalog page you came from, so the back link returns you to the same place. It is deleted when you close the tab;
- in local storage, when the promotions panel was last shown and its version, so it does not reappear too soon;
- in local storage, whether you closed the notice offering the page in your browser's language, so it is not offered again;
- in session storage, one word for how you first reached the site in this visit (for example chatgpt, google or direct), taken from the referring site or a utm_source link parameter. It is deleted when you close the tab and sent to us only with a product inquiry (section 3).
3. When you contact us or request something
The site has four forms. Each is delivered by Web3Forms (web3forms.com), a form service that forwards what you enter to our mailbox as an email. A hidden field filters out spam robots; no captcha service is used.
| Form | What we receive (* required) | Purpose |
|---|---|---|
| Product inquiry | name*, email*, company, country, product, model, application, quantity, message*; added automatically: how you first reached the site (for example chatgpt, google, direct) | to answer your inquiry and prepare a quotation; the source tells us which channels bring buyers |
| Document or price-list request | name*, email*, company*, country, message | to send the document you asked for |
| BAU 2027 meeting request | name*, email*, company, country, preferred day and time, products of interest, message | to arrange and follow up a meeting at the fair |
| Newsletter request | email*, name, company, country, topic of interest, consent* | to send occasional product, document and exhibition updates |
You can also write to us by email or WhatsApp. If you use the WhatsApp link, the conversation is processed by WhatsApp / Meta under their own terms.
Legal basis: for inquiries, document and meeting requests, steps taken at your request before a possible contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering business inquiries (Art. 6(1)(f) GDPR). For the newsletter, your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by replying "unsubscribe" or writing to the address in section 1.
We keep inquiries as long as needed to answer them and follow up, and business correspondence for as long as commercial and tax law require. Newsletter addresses are kept until you unsubscribe.
4. Analytics
To understand which pages and products buyers look at, and where the site is hard to use, every page loads the following services.
Google Analytics 4 and Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies and records the pages viewed, approximate location, device and browser, how far you scroll, how long you read, and clicks on product and contact links. When you send a product inquiry, the inquiry event carries the same one-word first-touch source. Google Analytics 4 does not store IP addresses. Google Tag Manager loads such tags and does not itself profile you. Data may be processed by Google LLC in the USA. More: policies.google.com/privacy
Microsoft Clarity, provided by Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records how visitors move, scroll and click on a page and produces heatmaps and session replays; text typed into form fields is masked. We label sessions with the type of page, whether the visitor skimmed or read, and the one-word first-touch source. Data may be processed by Microsoft Corporation in the USA. More: privacy.microsoft.com/privacystatement
Legal basis: our legitimate interest in improving the site for buyers (Art. 6(1)(f) GDPR). You can object at any time (section 8). You can also stop both services with your browser's tracking protection or a content blocker, or install Google's opt-out add-on (tools.google.com/dlpage/gaoptout).
5. Links to other sites
Our links to YouTube, Instagram, Facebook, Pinterest, Tumblr and our Alibaba storefront are plain links. Nothing is sent to those platforms until you click one; after that, their own privacy policies apply.
6. Who receives your data
Only the service providers named above, our web host and our email provider, each processing data for the purposes described here, and our own sales and technical staff. We do not sell personal data or pass it to other companies for their marketing.
7. International transfers
We are based in China, and your inquiry is read and answered there. Google, Microsoft and Cloudflare may process data in the USA; all three are certified under the EU-U.S. Data Privacy Framework.
8. Your rights
Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20), and to withdraw any consent at any time with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interest, you may object at any time on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.
To exercise any of these rights, write to [email protected]. You also have the right to complain to a data-protection supervisory authority, in particular in the EU member state where you live or work.
9. Other
You do not have to give us personal data, but without an email address we cannot answer an inquiry. We do not use automated decision-making with legal effect. The site is intended for businesses, not children. We update this notice when our processing changes; the date above shows the current version.