XRHEA Box (“XRHEA”, “we”, “us”, “our”) designs and manufactures custom packaging. We respect your privacy and are committed to protecting personal data we process when you visit our websites, contact us, or work with us as a customer or supplier.
XRHEA Box (Shanghai Xianrong Packaging Co., Ltd.)
Address: No. 175, Hufa Road, Fengxian District, Shanghai, China
Phone: +86-13166225389
Email: [email protected]
This Policy covers data handled by XRHEA. If we collect data on behalf of a brand customer as a processor, that brand’s privacy policy will apply.
This Policy applies to:
our websites, landing pages, and online forms;
email/phone/WhatsApp/WeChat inquiries and live chat;
quotes, samples, orders, logistics coordination, and after-sales service;
B2B marketing (newsletters, case studies, events);
job applications and supplier onboarding.
Third-party sites we link to have their own policies.
Information you provide
Identity & contact: name, company, title, email, phone, address, country/region.
Project details: product specs, dielines, sizes, materials, artwork, photos, notes.
Commercial data: quotes, POs, invoices, payment info handled by payment providers.
Communications: emails, chat transcripts, meeting notes, support tickets.
Recruitment/supplier data: CVs, certifications, compliance documents.
Information we collect automatically
Device & usage: IP address, browser, device type, pages viewed, time on page, referring URLs.
Cookies/SDKs: session IDs, analytics and preference cookies (see §6).
Sensitive data
We do not intentionally collect sensitive personal information. Do not send health, biometric, or payment card numbers via email/chat.
Provide and improve our sites and services.
Prepare quotes, samples, contracts, production and delivery.
Customer service and technical support.
Account management, invoicing, and fraud prevention.
Quality, compliance and audits (e.g., ISO, FSC, RoHS/EPR documentation).
Marketing with consent or as permitted by law (you can opt out anytime).
Recruitment and supplier management.
Legal obligations and enforcement.
Legal bases (EEA/UK/CH): performance of a contract; legitimate interests (e.g., B2B marketing, site security, service improvement); consent (where required); compliance with legal obligations; vital/overriding public interests when applicable.
We share data only as needed with:
Service providers (hosting, security, analytics, email/SMS tools, CRM, customer support, printing/fulfilment, logistics and customs brokers, payment processors).
Business partners involved in your project (e.g., certified labs for testing, regional carriers).
Corporate transactions (merger, acquisition, financing) subject to safeguards.
Legal & safety obligations (courts, authorities) where required.
We do not sell personal information.
We use cookies and similar tools to run the site, remember preferences, and measure performance.
Types:
Essential (security, load balancing) — always on.
Analytics (site performance, error diagnostics).
Marketing (only if enabled).
You can manage preferences via our cookie banner and your browser settings. Blocking some cookies may affect site features.
We operate globally. Where law requires, we use approved safeguards (e.g., EU Standard Contractual Clauses) for transfers from the EEA/UK/Switzerland to countries without an adequacy decision. Copies of relevant safeguards are available on request.
We keep personal data only as long as necessary for the purposes above:
website analytics: typically 26 months;
quotes/orders/support: project duration + statutory limitation period;
marketing: until you opt out or your data becomes inactive;
recruitment: usually up to 12 months unless local law requires otherwise.
We then delete or irreversibly anonymize data.
We apply administrative, technical, and physical measures (access controls, encryption in transit, restricted systems, training, vendor due diligence). No method is 100% secure; please use unique passwords and avoid sending card data by email.
EEA/UK/Switzerland (GDPR): access, rectification, erasure, restriction, portability, object, and withdrawal of consent. You may lodge a complaint with your local data authority.
California (CCPA/CPRA): right to know, correct, delete, and to opt out of “sale/share” of personal information; right to non-discrimination. We do not sell/share personal information in the CCPA sense, nor use sensitive personal information for additional purposes.
China Mainland (PIPL): rights to access/copy, correction, deletion, explanation, and to withdraw consent, subject to exceptions.
To exercise rights: email [email protected] or call +86-13166225389. We may request information to verify your identity. Authorized agents may submit requests with proof of authorization.
Our services target business users. We do not knowingly collect data from children under the age required by local law (e.g., 13/16). If you believe a child has provided data, contact us to remove it.
Our site may include links or plugins for third-party services (e.g., messaging apps, social media). Their processing is governed by their own policies.
We may update this Policy from time to time. The “Last updated” date shows the latest version. Material changes will be highlighted on the site.
Data Controller: XRHEA Box (Shanghai Xianrong Packaging Co., Ltd.)
Address: No. 175, Hufa Road, Fengxian District, Shanghai, China
Phone: +86-13166225389
Email: [email protected]
For faster handling in your request, please state: your name/company, region, the right you wish to exercise, and relevant details (e.g., email used on our site).
If you are in California and wish to opt out of any future “sale/share” or cross-context behavioral advertising should we introduce it, you may email [email protected] (or use the cookie banner’s “Do Not Sell/Share” link when available). Currently, we do not sell/share personal information.
This policy is designed for global B2B use and aligns with common practices among leading packaging manufacturers. Implementing the cookie banner, consent logs, and request workflows is recommended to operationalize the commitments above.