Privacy Policy

1. Introduction

XichenPep, operated by Nanjing Xichen Biotech Co., Ltd. ("we", "our", "us"), is committed to protecting the privacy of personal data belonging to our customers, suppliers, and visitors ("you", "your") who access this website (xichenpep.com). This Privacy Policy explains how we collect, use, store, and safeguard your personal information when you use our website and communicate with us regarding cosmetic peptide product inquiries and transactions.

We act as a data controller and process your personal data in accordance with applicable data protection legislation, including but not limited to the General Data Protection Regulation (GDPR), the Personal Information Protection Law of the People's Republic of China, and other relevant privacy laws applicable to the jurisdictions in which we operate.

2. Information We Collect

We may collect the following categories of personal data when you use our website or communicate with us:

• Identity & Contact Information: Name, email address, company name, country/region, and the details you provide in the inquiry form (such as product of interest, purity, quantity, and requirements) or in email correspondence.
• Business Communication Data: The content of communications exchanged between you and us via inquiry forms, email, or other communication channels, including details relating to product specifications, technical requirements, and commercial terms.
• Technical & Connection Data: When you access the Site, our hosting provider processes standard request metadata — such as IP address, browser user-agent, requested URL, and timestamp — to deliver the Site, protect it against abuse, and keep it available. We do not use analytics or behavioural profiling tools on the Site.

We do not knowingly collect special categories of personal data (e.g., health information, biometric data, or government identification numbers). Our services are strictly limited to B2B trade in cosmetic peptides, and we therefore do not solicit or process information relating to consumer health or medical conditions.

3. How We Use Your Information

We use the personal data we collect for the following purposes:

• Pre-contractual & Contractual Obligations: Responding to product inquiries, providing technical specifications, preparing quotations, processing orders, and any other steps necessary for the performance of a contract between you and us.
• Legitimate Business Interests: Maintaining and improving our website, analyzing usage trends, ensuring network security, preventing fraud, and managing customer relationships. We conduct such processing where our interests are not overridden by your data protection rights.
• Legal Obligations: Complying with applicable laws, regulations, court orders, or regulatory requirements, including those relating to export controls, chemical safety, and tax reporting.
• Consent (where applicable): Sending you marketing communications or product updates where you have given explicit consent. You may withdraw consent at any time.

4. Legal Basis for Processing (GDPR)

For individuals subject to the GDPR, we process your personal data on the following legal bases: (a) processing is necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract; (b) processing is necessary for compliance with a legal obligation to which we are subject; (c) processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms; (d) you have given consent to the processing of your data for one or more specific purposes.

5. Data Storage & Security

Your personal data is stored on infrastructure operated by our hosting provider, located in the United States. We rely on contractual safeguards such as the Standard Contractual Clauses (SCCs) to keep transfers of personal data outside the European Economic Area (EEA) lawful.

We implement appropriate organizational and technical security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include Transport Layer Security (TLS) encryption, access controls, and periodic security scans of our hosting configuration. However, the transmission of information via the internet is not completely secure, and we cannot guarantee the absolute security of data transmitted to our website; any transmission is at your own risk.

6. Third-Party Services & Data Sharing

We do not sell, rent, or trade your personal data to third parties. We share your information only in the following limited circumstances:

• Email Delivery Providers: We use a third-party email delivery service to send inquiry notifications. It receives only the minimum data necessary (your name, email address, and inquiry content) to deliver transactional emails.
• Hosting & Infrastructure Providers: Our website runs on a third-party hosting platform whose provider processes website traffic and form submission data as a data processor acting on our instructions.
• Legal Requirements: We may disclose your information if required to do so by law, court order, or governmental authority in response to a valid legal process.

7. Cookies & Analytics

Our website does not use tracking, advertising, or profiling cookies. The only cookies that may be set are strictly necessary ones issued by our hosting platform's security layer (for example, when the human-verification widget is displayed on the inquiry form), and they exist solely to keep the Site available and protected against abuse.

We do not use web analytics or behavioural tracking tools. Our hosting platform provides us with aggregate, non-identifying traffic statistics, which we use only to maintain and optimise the Site. The product list view mode you select (list / grid) is stored locally in your own browser (localStorage) and is not transmitted to us.

8. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, including to satisfy legal, accounting, or reporting requirements. In practice:

• Inquiry and correspondence records: kept while the business relationship is active, and for a reasonable period afterwards so we can answer follow-up questions about earlier inquiries. You may ask us to delete them at any time (see Section 9); we will do so unless we are required by law to keep them.
• Order, invoice, and tax-related records: kept for the period required by applicable tax and accounting law.
• Server access logs: retained for no more than 30 days, solely for security and troubleshooting.

9. Your Data Protection Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to Erasure ("Right to be Forgotten"): Request the deletion of your personal data in certain circumstances, such as where the data is no longer necessary for the purpose for which it was collected.
• Right to Restriction of Processing: Request the restriction of processing of your personal data in certain circumstances.
• Right to Data Portability: Receive your personal data in a structured, machine-readable format and transmit it to another controller where technically feasible.
• Right to Object: Object to processing of your personal data based on legitimate interests, on grounds relating to your particular situation.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us using the details provided in Section 13 below. We will respond within one month of receiving a verifiable request. This period may be extended by up to two further months where requests are particularly complex. You also have the right to lodge a complaint with a competent data protection supervisory authority.

10. International Data Transfers

Nanjing Xichen Biotech Co., Ltd. is headquartered in Nanjing, People's Republic of China, and uses cloud infrastructure located in the United States. Your personal data may therefore be transferred to and processed in countries outside your jurisdiction of residence. We safeguard such transfers through contractual measures such as the Standard Contractual Clauses (SCCs).

11. Children's Privacy

Our website is directed exclusively at a business-to-business (B2B) commercial audience and is not intended for minors. We do not knowingly collect personal data from minors, and we will delete such data if we become aware of it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices or changes in legal requirements. Any modifications will become effective upon posting of the revised policy on this page. We encourage you to review this page periodically. Material changes may be additionally communicated via a notice on our website or, where a business relationship exists, by email.