The short version
- We are a B2B perfume manufacturer in Guangzhou, China. We are not a consumer brand and we do not sell products to consumers through this site.
- We collect the details you type into our inquiry form (name, email, phone/WhatsApp, and optionally your company and project description), plus limited technical data about the request itself.
- We use no advertising or analytics cookies, no Google Analytics, no marketing pixels and no third-party trackers. Web fonts are served from our own server. Our audience statistics are cookieless and keep only a daily-rotating salted hash of your IP address, never the address itself.
- We do not sell personal data and we do not share it for cross-context behavioral advertising — anywhere in the world.
- You can ask us for a copy of your data, correct it, or have it deleted by writing to sales@laeyo-parfum.com. We answer within 30 days.
1. Who we are
This website, customperfumeoem.com, is operated by the entity below. For the purposes of the EU/UK General Data Protection Regulation we are the controller of the personal data described in this notice; for the purposes of China’s Personal Information Protection Law (PIPL) we are the personal information handler.
- Legal entity
- Laiyue Biological Group Co., Ltd.
- Trading name
- LAÉYO PARFUM
- Registered address
- No. 18 Huahai Road, Huadu District, Guangzhou, Guangdong, China
- Business email
- sales@laeyo-parfum.com
- Telephone
- +86 20 8688 0000
- +86 138 0000 0000
Data protection contact
Write to sales@laeyo-parfum.com with the subject line “Privacy request”, or post to the address above marked for the attention of the Privacy Desk. This is the contact for all data protection matters.
We have not appointed a statutory Data Protection Officer, because our core activities do not consist of large-scale regular and systematic monitoring of individuals or large-scale processing of special categories of data (GDPR Article 37(1); PIPL Article 52). The Privacy Desk performs that function and is reachable at the address above.
EU and UK representation
We are established in the People’s Republic of China and have no establishment in the European Union, the European Economic Area or the United Kingdom. We have assessed our processing against Article 27(1) GDPR and Article 27(1) UK GDPR and consider that we fall within the derogation in Article 27(2): our processing of website and inquiry data is occasional rather than large-scale and systematic, it does not involve large-scale monitoring of individuals, and it does not involve large-scale processing of special category data. We have therefore not appointed an EU or UK representative.
If a supervisory authority or a data subject asks us to appoint one, or if our processing changes in a way that removes the derogation, we will appoint a representative and update this notice before continuing that processing. In the meantime we will answer any request we receive directly, in English, within the deadlines set out in section 10.
2. Scope of this notice
This notice covers:
- your use of this website and any page on it;
- inquiries, quotation requests, sample requests and other business correspondence you send us through the site, by email, or by WhatsApp;
- the personal data of your staff that we need in order to quote, produce, ship and invoice.
It does not cover:
- personal data processed by third-party sites we link to or embed — see section 14;
- data our customers process on their own systems, for which they are the controller;
- recruitment and employment data, which are handled under separate internal notices.
Where we have signed a supply agreement, a data processing agreement (GDPR Article 28) or an NDA with you, that contract governs the data it covers and prevails over this notice to the extent of any conflict. This notice does not create rights for any third party.
3. What we collect
We try to collect as little as possible. These are the categories we actually process:
| Category | What it includes | Where it comes from |
|---|---|---|
| Inquiry details | Your name, company or brand (optional), business email, phone/WhatsApp number, and your project description (optional). | You, via the inquiry form. |
| Correspondence | Emails, WhatsApp or WeChat messages, and any files you attach — briefs, artwork, specifications, target prices, certificates. | You, when you reply or follow up. |
| Submission metadata | IP address and browser user-agent recorded alongside a form submission, plus the page it was sent from. Kept as evidence of the request and to detect abuse. | Automatically, at the moment you submit. |
| Audience statistics | Page path, referring URL, device class (desktop/tablet/phone), browser user-agent, and a salted SHA-1 hash of your IP address that is recalculated with a new salt every day. Bot traffic is filtered out and not stored. | Automatically, on each page view. |
| Business contact data | Name, job title, company and business contact details of your staff, for account management. | You, or public business sources such as your company website or trade-fair listings. |
| Transaction data | Billing contact and address, delivery address, purchase orders, invoice and customs/export documentation. | You, once we trade. |
What we deliberately do not collect
- No payment card or bank credentials — this site takes no payments.
- No government identifiers, biometric data, health data, or data revealing racial or ethnic origin, religion, political opinions, trade-union membership, genetic data or sexual orientation (the “special categories” in GDPR Article 9 and “sensitive personal information” in PIPL Article 28 and the CPRA).
- No precise geolocation, no address book or contact-list upload, no camera or microphone access.
- No account registration, no passwords, no newsletter list on the public site.
- No data from anyone we know to be a child — see section 12.
Please do not send us special category data or other people’s personal data unless we have asked for it. If you send us a colleague’s details, you are responsible for having a lawful basis to do so, and we will process them as described here.
4. Why we use it, and our legal bases
We use personal data only for the purposes below. The third column shows the legal basis we rely on, using the numbering of GDPR Article 6 (which applies in the EU and, through the UK GDPR, in the United Kingdom) and of PIPL Article 13.
| Purpose | Data used | Legal basis |
|---|---|---|
| Reading and answering your inquiry, asking clarifying questions, and preparing a quotation or sample proposal. | Inquiry details, correspondence | GDPR Art. 6(1)(b) — steps taken at your request before entering a contract. PIPL Art. 13(2) — necessary to conclude or perform a contract to which you are a party. |
| Delivering an order: specification confirmation, production, quality records, shipping, after-sales. | Business contact, transaction, correspondence | GDPR Art. 6(1)(b). PIPL Art. 13(2). |
| Invoicing, accounting, tax, customs and export records. | Transaction data | GDPR Art. 6(1)(c) — legal obligation. PIPL Art. 13(3) — statutory duty. |
| Keeping the site available and secure: firewall, rate limiting, blocking injection and scraping attempts, and keeping access logs. | Submission metadata, technical logs | GDPR Art. 6(1)(f) — legitimate interests (protecting our systems and visitors). PIPL Art. 13(3) with Cybersecurity Law Art. 21 (log retention) and Art. 13(7). |
| Understanding in aggregate which pages are read, so we can improve them. Cookieless; no individual profiles are built. | Audience statistics | GDPR Art. 6(1)(f) — legitimate interests, on the assessment that the data is pseudonymised, short-lived and not used for advertising. PIPL Art. 13(1) — consent, where PIPL requires it. |
| Sending you commercial information about our capabilities, only if you have asked for it. | Business contact | GDPR Art. 6(1)(a) — consent (and PECR/ePrivacy rules for electronic marketing). PIPL Art. 13(1) — consent. |
| Establishing, exercising or defending legal claims, and responding to lawful requests from authorities. | Any of the above | GDPR Art. 6(1)(f) and 6(1)(c). PIPL Art. 13(3) and 13(7). |
Our legitimate-interest assessment
Where we rely on legitimate interests, we have weighed our interest against your rights and expectations. We keep that weighing on file and will send you a summary on request. Two limits apply in practice: we do not use legitimate interests to send marketing email (that needs your consent), and we do not use it to build profiles of individuals across websites.
Do you have to give us the data?
No. Providing personal data is neither a statutory nor a contractual requirement, and no automated decision is taken on the basis of it. On the inquiry form, name, business email and phone/WhatsApp are required and company and project description are optional. If you leave out a required field we simply cannot send you a quotation — that is the only consequence. You are never obliged to give us more than the inquiry needs.
Withdrawing consent
Where we rely on consent, you may withdraw it at any time, free of charge, by writing to the address in section 16. Withdrawal does not affect the lawfulness of processing carried out before it, and it does not affect processing based on another legal basis — for example, we may still keep an invoice after you withdraw marketing consent.
5. Cookies and similar technologies
This site sets two cookies, both strictly necessary. Neither is used to identify you for advertising, and neither is shared with advertisers.
| Name | Set by | Purpose | Attributes | Lifetime |
|---|---|---|---|---|
LAEYOSESS |
Us (PHP session) | Holds a random session identifier so the server can show you the right form state — the success or error message after a submission — and protect the form against cross-site request forgery. It contains no personal data. | First-party; HttpOnly; Secure; SameSite=Lax |
Session — deleted when you close the browser. |
_d_id |
Our hosting provider’s web application firewall | Distinguishes requests so that the firewall can detect and block attacks such as SQL injection and malicious bots. We do not read or use its contents. | First-party; HttpOnly; Secure; SameSite=Strict |
Session; re-issued as needed by the firewall. |
Why there is no cookie banner. Under the EU ePrivacy Directive and the UK PECR, consent is not required for cookies that are strictly necessary to provide a service you have requested or to keep the service secure. Both cookies above fall in that category, so we display a notice instead of a consent wall. If we ever add analytics, advertising or social-media cookies, we will ask for your consent first, before any such cookie is set.
What we do not use. No Google Analytics, no Google Tag Manager, no Meta/Facebook pixel, no LinkedIn Insight Tag, no Hotjar, Clarity or other session recorders, no advertising or retargeting cookies, no cross-site identifiers, no fingerprinting, no local storage tracking. Our fonts, stylesheets and scripts are served from our own domain — there is no CDN and no third-party font request, so viewing a page does not disclose your IP address to anyone else.
How to control cookies. Every major browser lets you block or delete cookies in its settings; the “Help” menu of your browser explains how. Blocking LAEYOSESS does not stop you reading the site, but it will stop the form from showing submission feedback correctly and it will stop our staff from signing in to the administration area. Blocking _d_id may cause the firewall to challenge or reject your requests.
6. Who we share data with
We do not sell personal data. We do not rent it, and we do not share it for cross-context behavioral advertising as defined by the CPRA — not with advertisers, data brokers, or “people search” services. We have not done so in the preceding 12 months.
We disclose personal data only to the following categories of recipients, and only as far as each needs it:
| Recipient | Why | Location |
|---|---|---|
| Hosting and database provider | Runs the website, stores form submissions and statistics; edge firewall. | Hong Kong SAR |
| Business email provider | Receives and stores inquiry notifications and correspondence. | Varies; may be outside your country |
| Freight forwarders, couriers and customs brokers | Only when you order: delivery and export clearance need a consignee name, address and phone number. | Origin, transit and destination countries |
| Banks and payment service providers | Only when you order: receiving payment and complying with anti-money-laundering rules. | China and the receiving bank’s jurisdiction |
| Professional advisers | Lawyers, auditors and insurers, where necessary for a specific matter, under confidentiality duties. | China or elsewhere |
| Authorities and courts | Where we are legally required to disclose, or to establish or defend a legal claim. | As required by law |
| A successor entity | If our business or a relevant part of it is sold or reorganized, subject to the recipient honoring this notice. | Any |
Service providers acting as our processors are bound by written contracts that require confidentiality, security, processing only on our instructions, and deletion or return of data at the end of the engagement (GDPR Article 28). Our own staff access inquiry data on a need-to-know basis, limited by role; access is logged in the administration system.
We may also publish aggregated, non-identifying statistics — for example “visitors from 40+ countries”. Aggregated figures contain no personal data.
7. International transfers
We are based in mainland China, our servers and database are hosted in Hong Kong SAR, and some of the recipients in section 6 are elsewhere. Personal data therefore crosses borders. Where that happens we rely on the following safeguards.
From the EU/EEA and the UK
- Standard Contractual Clauses — Commission Implementing Decision (EU) 2021/914, Module 2 (controller to processor), for transfers to our processors.
- UK International Data Transfer Addendum to those clauses, for transfers subject to the UK GDPR.
- A transfer risk assessment for each destination, considering local law and the practical likelihood of access by public authorities, together with the supplementary measures we apply: minimization, encryption in transit, access control, and prompt deletion on request.
You may request a copy of the applicable clauses (with commercial terms redacted) using the contact details in section 16.
From mainland China
Under PIPL Article 38, a cross-border transfer requires one of the mechanisms the law provides — a security assessment organized by the Cyberspace Administration of China (CAC), a CAC-filed standard contract, a certification, or another condition recognized by law or administrative regulation. Where PIPL applies to a transfer, we use the mechanism that applies to our situation and complete any required filing before the transfer begins.
PIPL Article 39 additionally requires that we tell you the recipient’s name and contact details, the purpose and method of processing, the categories of data, the retention period, and how to exercise your rights, and that we obtain your separate consent to the transfer. Where that applies, we ask for it separately — for example in a dedicated confirmation step — and we do not carry out the transfer until you have agreed. You may refuse or withdraw that consent without affecting our ability to answer a general inquiry that involves no transfer.
We note that the inquiry form does not use a consent checkbox. That is deliberate: an inquiry from a business contact is processed because it is necessary to take steps at your request before a contract, not because you ticked a box. Where a distinct consent is legally required — a cross-border transfer of personal information collected in mainland China, or marketing email — we obtain it separately and specifically, never bundled with the submission of a form.
8. How long we keep data
We keep personal data only as long as we need it for the purpose we collected it, or as long as the law requires. These are the periods we apply in practice:
| Data | Retention period | Why |
|---|---|---|
| Inquiries that did not lead to an order (form submissions and the email thread) | 36 months from the last contact, then deleted or anonymized | Business follow-up and the limitation period for pre-contractual claims |
| Customer, order, specification and artwork records | 10 years from the end of the calendar year of the last transaction | Product liability, quality traceability, and the ordinary limitation periods |
| Invoices, tax, accounting, customs and export records | 10 years | PRC accounting and tax-archive rules, and equivalent record-keeping duties in destination markets |
| Pseudonymous audience statistics | 14 months, then aggregated or deleted | Seasonal comparison, without building long-term profiles |
| Server, firewall and access logs containing IP addresses | 6 months, then overwritten | Cybersecurity Law Article 21 requires at least six months; security investigations rarely need more |
| Backups | Rolling, maximum 90 days | Disaster recovery; old backups are overwritten on a cycle |
| Marketing consent and opt-out records | Until withdrawal, plus 3 years | Proof that we respected your choice |
When a period ends we delete the data or irreversibly anonymize it, so that it can no longer be linked to you. If we must keep data beyond these periods because of a legal hold, a dispute or an authority’s request, we keep only what is needed and restrict access to it.
9. How we protect data
- Encryption in transit. The site is served over HTTPS only, with TLS 1.2 or better, and HTTP Strict Transport Security is enabled. Cookies carrying a session identifier are marked
HttpOnly,SecureandSameSite. - Edge protection. A web application firewall filters injection and bot traffic before it reaches the application, and the administration area is rate-limited against password guessing.
- Minimization and pseudonymization. IP addresses in statistics are salted and hashed with a salt that changes daily, so the hash cannot be reversed and cannot link one day’s visit to the next.
- Access control. Administrative accounts are individual, password-protected, and limited by role. Access to inquiry data is granted on a need-to-know basis.
- Backups. Data is backed up on a rolling cycle and restores are tested. Backups inherit the same access controls.
- People. Staff who handle customer data are bound by confidentiality obligations and receive guidance on handling requests and incidents.
- Vendors. Processors are selected with security in mind and bound by written data protection terms.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority without undue delay and, where the law requires it, within 72 hours of becoming aware (GDPR Article 33); we will tell you directly if the breach is likely to result in a high risk to you (Article 34), and we will notify the CAC and affected individuals as required by PIPL Article 57. We will also tell you what we know, what we have done, and what we recommend you do.
Please help us: use a business email address rather than a personal one, and do not send us identity documents, payment credentials or other sensitive material that an inquiry does not need.
10. Your rights
You have the rights set out below, whichever country you are in. We extend them to everyone who contacts us, including where a particular law would not strictly require it.
| Right | What it means | Legal source |
|---|---|---|
| Access | A copy of the personal data we hold about you, and information about how we use it. | GDPR Art. 15; UK GDPR; PIPL Art. 45; CCPA §1798.100/110 |
| Rectification | Correction of inaccurate data and completion of incomplete data. | GDPR Art. 16; PIPL Art. 46; CCPA §1798.106 |
| Erasure | Deletion of data we no longer need, or where you withdraw consent and no other basis applies. | GDPR Art. 17; PIPL Art. 47; CCPA §1798.105 |
| Restriction | Suspension of processing while an accuracy or lawfulness question is resolved. | GDPR Art. 18 |
| Objection | Objection to processing based on our legitimate interests, including any direct marketing at any time. | GDPR Art. 21; UK PECR |
| Portability | Receipt of the data you gave us in a structured, machine-readable format. | GDPR Art. 20; PIPL Art. 45 |
| Withdraw consent | Withdrawal at any time, without affecting processing already carried out. | GDPR Art. 7(3); PIPL Art. 15 |
| Opt out of sale or sharing | We do not sell or share personal information, so there is nothing to opt out of — but you may still tell us to record your preference. | CCPA §1798.120; CPRA |
| Limit use of sensitive data | We do not collect sensitive personal information, so this right has no practical application here. | CPRA §1798.121 |
| Non-discrimination | We will not deny you service, charge a different price, or provide a different level of service because you exercised a right. | CCPA §1798.125; GDPR Art. 7(3) |
| Complain | Lodge a complaint with a supervisory authority or, in China, with the CAC. | GDPR Art. 77; PIPL Art. 50; CCPA |
| Explanation of automated decisions | We make none — see section 11 — but you may ask for an explanation of any decision we take about you. | GDPR Art. 22; PIPL Art. 24 |
How to exercise them
Email sales@laeyo-parfum.com with the subject “Privacy request”, or write to the postal address in section 1. To protect you, we may ask for enough information to confirm that the request comes from you — typically that you can reply from the email address you originally used. We will not ask for identity documents unless there is a genuine doubt and no less intrusive way to resolve it.
There is no charge in normal circumstances. We answer within 30 days of verifying your request. If a request is complex we may extend that period, and we will tell you why before the first 30 days expire (GDPR Article 12(3) allows up to three months; the CPRA allows 45 days plus a 45-day extension). You may use an authorized agent to act for you; we will ask for written permission, or a power of attorney where the law requires it.
If we cannot do what you ask — for example, because we must keep an invoice for tax purposes — we will explain the reason and tell you how to challenge the decision.
Where to complain
| If you are in | Authority | Notes |
|---|---|---|
| France | CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 · cnil.fr | Under the Loi Informatique et Libertés (Loi n° 78-17), you may also set instructions — directives — about what happens to your data after your death (Article 85). |
| United Kingdom | ICO — Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · ico.org.uk | Under the UK GDPR and the Data Protection Act 2018. |
| Any other EU/EEA state | Your national supervisory authority | You may complain where you live, where you work, or where the alleged infringement took place. |
| Mainland China | Cyberspace Administration of China — report line 12377 · 12377.cn | Under PIPL Article 50 you may also sue before a people’s court. |
| California | California Privacy Protection Agency · cppa.ca.gov, or the Attorney General · oag.ca.gov | We would appreciate the chance to resolve your concern first. |
| Elsewhere | Your local data protection or consumer authority | We apply the same standards to everyone. |
US state privacy rights
If you are a consumer in California — or in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana or another state with a comprehensive privacy law — the rights in the table above apply to you. For the past 12 months, our practice is as follows:
| Item | Our position |
|---|---|
| Categories of personal information collected | Identifiers; business contact information; internet or network activity (page views and device type); commercial information (inquiry and order details); professional information (employer and role). |
| Sources | You; public business sources; automatic collection from your browser. |
| Purposes | Answering inquiries; performing contracts; security; aggregate measurement; legal compliance. |
| Categories of third parties | Hosting, email, logistics, banking, professional advisers and authorities — as listed in section 6. |
| Sale or sharing for cross-context behavioral advertising | None. Not in the past 12 months, and we have no plans to do so. |
| Sensitive personal information | Not collected, and not used to infer characteristics. |
| Knowingly collected from consumers under 16 | No. |
| Financial incentives for data | None. |
| Retention | As set out in section 8; we do not keep identifiers longer than needed for the stated purpose. |
We do not meet the CCPA’s revenue or volume thresholds for a “business” in most years, but we apply these rules anyway as a matter of practice. Because we do not sell or share personal information, we also do not offer a financial incentive, price difference or service level tied to your data choices.
11. Automated decisions and profiling
We do not use automated processing — including profiling — to make decisions that produce legal effects or similarly significantly affect you. Decisions about quotations, samples and orders are taken by people.
Our audience statistics are aggregate measurements of page views. They are not used to infer your interests, to score you, or to select what you see. We do not build advertising audiences, and we do not combine your data with data from other sites.
12. Children
This is a business-to-business site for companies that develop and sell fragrance. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. We do not knowingly collect the personal information of consumers under 16 (CCPA/CPRA) or personal information of children under 14, which PIPL treats as sensitive and requires separate parental consent for.
If you believe a child has sent us personal data, write to sales@laeyo-parfum.com and we will delete it promptly.
13. Do Not Track and Global Privacy Control
We honour the Global Privacy Control (GPC) signal as an opt-out of sale and sharing. Since we do not sell or share personal information, a GPC signal changes nothing in practice — but we record and respect it, and we do not attempt to detect or circumvent it.
Browsers also send a Do Not Track (DNT) header. There is still no agreed standard for how a site must respond, and we do not vary our processing based on DNT. The reason is simple: we do not track you across other websites in the first place, so there is nothing for DNT to switch off.
14. Third-party links and embeds
Map on the contact page. We embed a map from OpenStreetMap using an iframe with loading="lazy", which means it is only requested once you scroll near it. When it loads, your browser connects to OpenStreetMap’s servers and they receive your IP address, your browser’s user-agent and the page you came from. We do not control that connection and receive no data from it. Their handling is described in the OpenStreetMap Foundation’s privacy policy. If you prefer not to make that connection, simply do not scroll to the map — the address is printed as text next to it.
Social and messaging links. Our footer links to LinkedIn, Instagram and Facebook, and our contact details include a WhatsApp link (wa.me). These are ordinary links: nothing is loaded and no cookie is set until you click. Once you follow one, you are on that company’s site or app and their privacy policy applies, not ours.
Other sites. Articles and product pages may link to industry bodies, certificate registers or suppliers. We are not responsible for the privacy practices of any site we do not operate, and we encourage you to read the notice of any site that asks you for information.
15. Changes to this notice
We review this notice at least once a year, and whenever we change what we do with personal data — a new form, a new processor, a new market. The current version, its effective date and its next review date are recorded in section 17.
If we make a material change — a new purpose, a new category of recipient, a longer retention period — we will announce it on this page with a new version number and effective date, and where the change affects an existing relationship and the law requires it, we will tell you by email before the change takes effect. We will not apply a new purpose to data we already hold without a lawful basis for doing so, and we will not retrospectively reduce your rights.
Earlier versions are available on request.
16. How to contact us and complain
For any question about this notice, or to exercise a right:
- Email: sales@laeyo-parfum.com — subject “Privacy request”
- Post: Privacy Desk, Laiyue Biological Group Co., Ltd., No. 18 Huahai Road, Huadu District, Guangzhou, Guangdong, China
- Phone: +86 20 8688 0000, Mon – Sat, 09:00 – 18:00 (GMT+8)
We answer in English. If you write in another language we will do our best to reply in it, but the English text of this notice is the authoritative version.
If you are unhappy with our answer, you may complain to the authority listed in section 10. We would rather fix the problem directly first, so please tell us before you escalate.
17. Document control
This notice is maintained by the Privacy Desk and reviewed by management. It is published in English and applies to every visitor and correspondent, wherever they are.
This notice describes our own practices in plain language. It is not legal advice to you, and it does not replace the terms of any signed agreement between us.