Privacy Policy
Last updated: 16 September 2026
This Privacy Policy explains how BUNSEN Health Technology Co., Ltd. (“we”, “us”) collects, uses and protects personal data when you visit bensenbio.com or blog.bensenbio.com (together, the “Sites”).
1. Who we are (data controller)
Bensheng (Tianjin) Health Technology Co., Ltd.
Tianjin, China
Contact: [email protected]
2. What we collect and why
| Data | Where it comes from | Why we use it | Legal basis |
|---|---|---|---|
| Name, company, e-mail, phone / WhatsApp, product of interest, message, page URL, language, IP address and the time you ticked the consent box | Enquiry form on bensenbio.com | To answer your enquiry and prepare quotations or samples | Steps prior to a contract / legitimate interests |
| E-mail address, language, confirmation time, IP address | Newsletter form | To send the updates you subscribed to | Consent (double opt-in; withdraw at any time) |
| IP address, browser and device type, pages viewed and timestamps | Server, CDN and security logs | To keep the Sites available, secure and free of abuse | Legitimate interests |
| Aggregated, cookie-less visit statistics | Cloudflare Web Analytics (bensenbio.com) and WP Statistics running on our own server (blog) | To understand which pages are useful | Legitimate interests (no profiling, no advertising) |
We do not collect payment data on these Sites and we do not knowingly collect data from children under 16.
3. What we never do
- We do not sell or rent your personal data.
- We do not use Google Analytics, Meta Pixel, advertising pixels or any other third-party tracking or cross-site profiling.
- We never send marketing e-mail to anyone who has not confirmed their subscription (double opt-in).
4. How long we keep it
- Enquiry-form records (including the recorded IP address and consent time): up to 24 months after our last contact, then deleted.
- Newsletter subscription: until you unsubscribe, plus a minimal suppression record so that we do not contact you again.
- System and e-mail delivery logs: 6 months.
- Server / CDN security logs and aggregated statistics: up to about 6 months.
- Cookie consent record: 12 months.
- Off-site backups (Google Drive): up to 3 weekly generations, rotated automatically.
5. Who processes data on our behalf
| Processor | Service | Location and transfer basis |
|---|---|---|
| Cloudflare, Inc. | CDN, security / firewall, cookie-less analytics | Global network; EU Standard Contractual Clauses and the EU-US Data Privacy Framework |
| Newfold Digital / Crazy Domains | Web hosting and e-mail | Australia; Standard Contractual Clauses |
| Automattic Inc. | Jetpack plug-in features on the blog | USA; Standard Contractual Clauses and the EU-US Data Privacy Framework |
| Google LLC | Google Drive — off-site, encrypted backup copies of our website files and database | USA; Standard Contractual Clauses and the EU-US Data Privacy Framework |
| Newsletter & GoSMTP (self-hosted on our own server) | Subscriber list and e-mail delivery | Data stays on our server — no third-party marketing platform is used |
6. Cookies and similar technologies
We use only strictly necessary cookies (site security, cookie-choice record, language, time-zone display and subscription links). We do not use analytics or advertising cookies. See our Cookie Policy for the full list and how to change your choice.
7. Sharing and disclosure
We share data only with the processors listed above, and only where legally required (for example a valid request from a competent authority). California residents: we do not “sell” or “share” personal information as defined by the CCPA/CPRA.
8. International transfers
Our hosting, CDN and plug-in providers may process data outside your country. Where required, we rely on Standard Contractual Clauses and/or the EU-US Data Privacy Framework as appropriate safeguards.
9. Your rights
You may request access, rectification, erasure, restriction or portability, object to processing, and withdraw consent at any time. Write to [email protected] — we reply within 30 days. You may also lodge a complaint with your local supervisory authority.
10. Security
HTTPS/TLS on all pages, DKIM-signed e-mail with SPF and DMARC, access control on the administration area and regular backups. No transmission over the internet can be guaranteed to be completely secure — please do not send sensitive information through the forms.
11. Children
The Sites are intended for business users and are not directed at children under 16.
12. Changes to this policy
We may update this policy; the date at the top shows the latest version. Material changes will be announced on the Sites.
Any question about this policy: [email protected]