Effective date: 21 October 2026
Last updated: 21 October 2026
This policy applies to the website https://lxcomposites.com/ (including its Chinese-language version at /zh_cn/) and to the online chat assistant operated on it. It explains, in plain terms, what personal data we collect, why we collect it, who we send it to, how long we keep it, and what you can ask us to do with it.
1. Who we are (data controller)
| Item | Detail |
|---|---|
| Legal entity | Danyang Lixing Carbon Products Co., Ltd. (丹阳理兴碳素制品有限公司) |
| Trading name | LX Composites |
| Unified Social Credit Code | 91321181MA1NTLQB0B |
| Registered address | Hi-Tech Innovation Park, South Third Ring Road, Yunyang Street, Danyang, Zhenjiang, Jiangsu, China 212300 |
| manager@lxcomposites.com | |
| Telephone | +86 151 8917 8400 |
For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), we are the data controller for the personal data described in this policy. We are established outside the European Union and, in relation to the UK GDPR, outside the United Kingdom.
2. What this policy covers
This policy covers:
- visitors who browse the website;
- visitors who submit an enquiry through our contact forms (Contact Form 7 / WPForms);
- visitors who use the LX chat assistant on the website;
- business contacts whose details we hold in order to answer an enquiry or maintain a commercial record.
It does not cover third-party websites we link to. Those sites have their own policies.
3. Personal data we collect
3.1 Data you give us directly
| Data | When | Required? |
|---|---|---|
| Name | Contact form or chat | Optional |
| Email address | Contact form or chat; required before we can hand a chat over to our sales team | Required for a reply |
| Company name | Contact form or chat | Optional |
| Telephone / WhatsApp number | Contact form or chat | Optional |
| Country / target market | Contact form or chat | Optional |
| The content of your message, including any technical specification, drawing or photograph you choose to send | Contact form or chat | As you choose |
You are never obliged to provide any of this. If you do not give us an email address, we simply cannot reply.
3.2 Data collected when you use the chat assistant
When you use the chat assistant, we record:
- the full content of your chat messages — including any technical detail, part description or specification you type;
- the page URL you are reading when you send a message, plus the page you first entered the site on and the referring page — so we know which product or page your question relates to;
- the language of the conversation (English or Chinese), detected from the page URL and adjustable per message;
- a timestamp for each message and for the session;
- your satisfaction rating (thumbs up / thumbs down) and any optional comment you leave afterwards;
- a shortened copy of your browser User-Agent string, stored truncated and never used to build a profile — it is used only to tell broad device classes apart and to spot abuse;
- a keyed hash of your IP address (HMAC-SHA256 with a key held on our server). We do not store your IP address itself. The hash exists solely to enforce rate limits and to block automated abuse;
- a random session identifier stored in your browser’s local storage under the key
lx_chat_session, so that your conversation survives a page refresh. This identifier expires after 7 days.
Two points worth stating plainly:
- We ask for your email address only when a conversation needs to be handed to a human, because that is the channel we will reply on.
- If you upload an image (for example a photograph of a part or a material), the image is attached to the resulting enquiry record. Please do not send images that contain people, serial numbers, addresses or any other information you do not want us to hold.
3.3 Data collected automatically
We use the following analytics and site-management tools. They set cookies or write to your browser’s local storage:
| Tool | Provider | What it does | What it stores |
|---|---|---|---|
| Google Analytics 4 (GA4) | Google Ireland Limited / Google LLC | Aggregate traffic statistics — pages viewed, session duration, approximate location derived from IP, referring site | Cookies (_ga, _ga_*) and related identifiers |
| Google Tag Manager (GTM) | Google Ireland Limited / Google LLC | Tag delivery — loads the analytics scripts above | Cookies as configured; no separate profile |
| Google Site Kit | Google Ireland Limited / Google LLC | Dashboard that connects Search Console and Analytics to our WordPress admin | Uses the GA4 cookies above |
| LiteSpeed Cache | LiteSpeed Technologies | Page caching; does not profile visitors | A functional cache cookie where required |
| TranslatePress | TranslatePress (Creoweb) | Remembers your preferred site language | A language-preference cookie / local storage entry |
| Cloudflare Turnstile | Cloudflare, Inc. | Distinguishes human visitors from automated bots — on the contact forms, and in the chat assistant when it is triggered (for example before a ticket is created, when an image is uploaded, or after a rate limit is hit) | A challenge token; may set a cookie |
You can block or delete cookies in your browser settings. Blocking analytics cookies will not stop you using the site; blocking functional cookies (language, cache, bot-check) may degrade parts of it.
4. Why we process your data, and on what legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Answering an enquiry, sending a quotation or arranging samples | Name, email, company, phone, message content, technical details | Art. 6(1)(b) — steps taken at your request before entering into a contract; and Art. 6(1)(f) — our legitimate interest in responding to business enquiries |
| Providing technical support on a material or part you have bought or are evaluating | Message content, images, source page, technical details | Art. 6(1)(b) and Art. 6(1)(f) |
| Operating the chat assistant and improving the accuracy of its answers | Chat content, satisfaction ratings, source page, language, timestamp | Art. 6(1)(f) — our legitimate interest in running a support channel that answers accurately |
| Measuring website performance and improving content | Analytics data, hashed User-Agent | Art. 6(1)(f); where required by law, Art. 6(1)(a) — your consent, given through the cookie controls in your browser |
| Keeping a commercial record of enquiries and orders | Name, email, company, enquiry content, ticket number | Art. 6(1)(b) and Art. 6(1)(c) — compliance with accounting, tax and customs record-keeping obligations |
| Preventing abuse, spam and automated attacks on the site | IP-derived data, hashed User-Agent, Turnstile token | Art. 6(1)(f) |
Where we rely on consent, you may withdraw it at any time (see section 7). Where we rely on legitimate interests, you may object (see section 7).
5. Artificial-intelligence processing and international transfers — please read
Our chat assistant is powered by a third-party artificial-intelligence service. This section explains exactly how that works.
5.1 Who processes your conversation
To understand your question and generate a reply, the content of your chat messages is transmitted to DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.), an AI service provider located in the People’s Republic of China. DeepSeek acts as our processor: it processes your messages on our instructions and for no purpose of its own.
5.2 There is a cross-border transfer
Because DeepSeek is located in China, your chat content is transferred to, and processed in, a country outside the European Economic Area, outside the United Kingdom and outside Switzerland. China is not covered by an European Commission adequacy decision. We therefore treat this as a restricted transfer and rely on:
- the necessity of the transfer for the performance of a contract or for steps taken at your request (GDPR Art. 49(1)(b)) where you have asked us a technical or commercial question; and
- the data-minimisation measures described in 5.3, which we apply to every message before it leaves our server.
5.3 What we strip out before sending anything to the AI provider
This is the part that matters in practice. Before any message is sent to DeepSeek, our system automatically replaces:
- email addresses →
[EMAIL] - telephone and WhatsApp numbers →
[PHONE] - company names →
[COMPANY]
So the AI provider receives the technical question — “what is the areal weight range of your 3K twill?” — without your contact details attached to it. Your email, phone and company name are stored in our own database and are used only to let our sales team reply to you.
In addition:
- your raw browser User-Agent is never transmitted — only a hash stored on our side;
- message content is never written to our server error logs, so logs do not become a second, uncontrolled copy of your conversation;
- images you upload are only sent to the image-recognition model when you choose to upload one.
5.4 What the AI is not allowed to do with your data
Our instructions to the AI provider forbid using your conversation to train its models for other customers, and forbid any use beyond generating a reply to you. We also run automated output checks: replies that contain pricing, lead times, minimum order quantities or certifications we do not hold are blocked before they reach you.
5.5 Being explicit at handover
When a conversation is handed to a human, the assistant will tell you first: “I’m going to pass this conversation and your email address to our sales team so they can reply.” Nothing is sent internally without that notice.
5.6 Analytics providers
Google Analytics 4, Google Tag Manager and Google Site Kit involve transfers of analytics data to Google in the United States. Those transfers rely on the EU–US Data Privacy Framework and on Google’s standard contractual clauses, as offered by Google.
5.7 Contact forms
Contact form submissions are stored on our own server and are sent to us by email. They are not sent to any AI service unless you submit the same question through the chat assistant.
6. How long we keep your data
| Data | Retention |
|---|---|
| Chat sessions | 24 months from the last activity, then deleted by a scheduled daily task. Exception: if a session produced an enquiry ticket, the session row is not deleted — it is only marked closed, because it is the context of a business record |
| Chat messages | 24 months from the message date, then deleted. Exception: messages attached to an enquiry ticket are never deleted — they are the evidence of what was asked and answered, and we need them for warranty, traceability, customs and accounting purposes |
| Chat satisfaction ratings (thumbs up / down and comments) | 24 months. Ratings are also counted in aggregate for statistics |
| Enquiry / ticket records (name, email, company, phone, enquiry content, structured specification, any attached image) | Retained permanently as commercial correspondence. Deleted on request where no legal, tax, customs or contractual reason to keep them applies (see section 7) |
| Contact form submissions | Kept as commercial correspondence on the same basis as ticket records |
| Analytics data (GA4) | Held by Google under the retention period configured in our analytics property 【待替换：填写 GA4 后台「数据设置 → 数据保留」中实际选择的用户与事件数据保留期，默认通常为 14 个月】; we do not extend it |
| Uploaded chat images | Deleted together with the message they belong to, except where that message is attached to a ticket — in which case the image is kept as part of the commercial record |
| Server / security logs | Rotated on the host’s standard cycle; they deliberately exclude chat content |
The deletion job runs once a day and deletes in batches, so a record due for deletion may survive until the next run. It never deletes anything attached to a ticket.
7. Your rights
Subject to the conditions and exceptions in the GDPR (or, for UK visitors, the UK GDPR), you have the right to:
| Right | What it means |
|---|---|
| Access | Obtain confirmation that we hold data about you and a copy of it |
| Rectification | Have inaccurate data corrected and incomplete data completed |
| Erasure (“right to be forgotten”) | Have your data deleted where we have no overriding legal or contractual ground to keep it |
| Restriction | Have us pause processing while a dispute about accuracy or grounds is resolved |
| Portability | Receive the data you provided to us in a structured, machine-readable format |
| Objection | Object to processing based on our legitimate interests, including analytics |
| Withdraw consent | Withdraw any consent you have given, at any time, without affecting the lawfulness of processing before withdrawal |
| Not be subject to solely automated decisions | Our chat assistant may answer automatically, but it makes no decision that produces a legal effect or otherwise significantly affects you. Any commercial decision — quotation, sample approval, claim settlement — is made by a person |
How to exercise any of these rights: email manager@lxcomposites.com with the subject line “Data request” and tell us which right you are exercising and which conversation or enquiry it relates to (a ticket number or the approximate date is enough). We reply within one month. We may need to verify your identity before acting, and we will never charge you for a request.
Deletion requests are executed by a named person in our team, not by an automated process, and we confirm to you when it is done.
If you are in the EEA or the UK and you are not satisfied with how we handle your request, you may lodge a complaint with your national data protection authority (for example the authority in your country of residence or work). We would rather you contacted us first — most things are fixable in one email.
8. Who we share your data with
We share personal data only with:
- DeepSeek — AI processing of chat content, as described in section 5;
- Google — analytics, as described in section 3.3;
- Cloudflare — bot protection and content delivery;
- our email provider (Zoho) — delivery of enquiry notifications to our own mailbox;
- our hosting provider — storage of the website and its database;
- freight forwarders, customs brokers and testing laboratories — only the contact details and specification necessary to ship your order or produce the documents you have asked for;
- professional advisers, auditors or authorities — where we are legally required to disclose.
We do not sell your personal data. We do not share it with advertising networks, and we do not use it for behavioural advertising. We have never sold personal data and we have no intention of doing so.
9. Security
We apply the following measures, proportionate to the size of our business:
- the website is served over HTTPS;
- administrative access to the chat database is limited to authorised staff with individual credentials;
- message content is excluded from error logs;
- User-Agent strings are stored truncated, never in full, and are never used to build a profile;
- IP addresses are never stored in plain text — only a keyed hash, used for rate limiting;
- personal data is minimised before it reaches the AI provider (section 5.3);
- retention is enforced by an automated daily deletion job.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the competent authority as required by law.
10. Children
Our website and chat assistant are aimed at business and professional audiences. We do not knowingly collect personal data from children. If you believe a child has submitted personal data to us, contact manager@lxcomposites.com and we will delete it.
11. Changes to this policy
We may update this policy when our processing changes — for example if we change AI provider, add a tool, or change a retention period. The current version is always the one published at this page, with the effective date at the top. Material changes will be reflected in a new “Last updated” date; where the change is substantial we will say so in the text above the date.
12. Contact
| Purpose | Channel |
|---|---|
| Privacy questions, data requests, deletion requests | manager@lxcomposites.com |
| Postal correspondence | Danyang Lixing Carbon Products Co., Ltd., Hi-Tech Innovation Park, South Third Ring Road, Yunyang Street, Danyang, Zhenjiang, Jiangsu, China 212300 |
| Telephone | +86 151 8917 8400 |
| +86 191 0511 8197 |
This policy is written to describe what our systems actually do. If you find something in it that does not match your experience of the site, please tell us — we would rather correct the document than leave it inaccurate.