Terms of website use & privacy notice

1. Website operator

This website is operated under the Kssmi name by Shenzhen Kssmi Technology Co., Ltd., with its registered address at 905, Bldg. 1, Baiwangda Health Tech Park, Yuanshan St., Longgang Dist., Shenzhen, Guangdong, China, Postcode: 518000.

2. Acceptance of these terms

By accessing or using this website, you agree to these terms of website use. If you do not agree, you should stop using the website. These terms do not replace any separately agreed quotation, order terms or manufacturing contract.

3. Informational purpose; no binding offer

Website content is provided for general information about Kssmi’s manufacturing capabilities, products and services. Unless expressly stated in a signed written agreement, website content does not constitute a binding offer, quotation, warranty or commitment to supply.

Product images, colours, specifications, materials, minimum order quantities, sample arrangements, lead times, production capacity and availability may change. Final requirements and commercial terms must be confirmed in writing for each project.

4. Permitted use

You may use the website for lawful business and informational purposes. You must not:

• interfere with the security, availability or proper operation of the website;
• attempt to gain unauthorised access to systems or data;
• submit unlawful, fraudulent, harmful or misleading content;
• use automated means to extract content in a way that unreasonably burdens the website; or
• use Kssmi content or intellectual property in violation of applicable law or written permission.

5. Intellectual property

Unless otherwise stated, the website design, text, images, graphics, product presentations, trade names, logos and other original content are owned by or licensed to Kssmi and are protected by applicable intellectual-property laws. No licence is granted except the limited right to view and use the website for its intended purpose.

Third-party names, marks and materials remain the property of their respective owners.

6. Information submitted by users

You are responsible for ensuring that information you submit is accurate, lawful and that you have authority to provide it. Do not submit confidential design files, special-category personal data or third-party personal data unless it is necessary for the inquiry and you are authorised to do so.

Ownership and permitted use of project designs, samples, tooling, specifications and other commercial materials should be governed by the applicable quotation, non-disclosure agreement or manufacturing contract.

7. Third-party services and links

The website may link to third-party websites or communication services, including WhatsApp, email clients and social platforms. Those services are operated under their own terms and privacy practices. A link does not mean that Kssmi controls or accepts responsibility for the third party’s service.

8. Availability and accuracy

We aim to keep the website available and accurate but do not guarantee uninterrupted access or that every item of content will always be complete, current or error-free. We may update, suspend or withdraw website content where reasonably necessary.

9. Liability

Nothing in these terms excludes or limits liability that cannot lawfully be excluded. To the fullest extent permitted by applicable law, Kssmi is not liable for indirect, incidental, special or consequential loss arising solely from use of, or inability to use, this informational website. Kssmi’s liability relating to a quotation, order, sample, product or manufacturing project is governed by the applicable written commercial agreement.

10. Governing law and disputes

These terms of website use are governed by the laws of the People’s Republic of China, without regard to conflict-of-law principles. Subject to any mandatory rights that cannot lawfully be excluded and any different dispute provision in a written commercial agreement, disputes arising from or relating to these website terms shall be submitted to the competent courts at the registered location of the website operator in Shenzhen, Guangdong, People’s Republic of China.

11. Changes to these terms

We may update these terms to reflect changes in the website, business practices or applicable law. The version and last-updated date shown on this page will identify the current text. Material changes should not be applied retroactively where doing so would be unlawful.

1. Scope of this privacy notice

This privacy notice applies to personal data processed through the Kssmi website and related website-originated communications, including product inquiries, quote requests, email links and WhatsApp links.

It does not replace the privacy notice of a third-party platform that a user chooses to open. For example, WhatsApp, a mail provider or a social network may process data independently under its own notice.

2. Data controller

The controller responsible for the processing described in this notice is:

Shenzhen Kssmi Technology Co., Ltd.
905, Bldg. 1, Baiwangda Health Tech Park, Yuanshan St., Longgang Dist., Shenzhen, Guangdong, China
Postcode: 518000
Privacy contact: privacy [at] kssmi [dot] com

3. EU representative

EU representative under Article 27 GDPR:
Kssmi Eyewear
Montagnola, Via Nicola Spedalieri, 7
00142 Roma RM, Italy
Privacy contact: privacy [at] kssmi [dot] com

4. Children

The website is designed for business users and is not directed to children. If we learn that a child has provided personal data without appropriate authorisation, we will take reasonable steps to delete it.

5. Automated decisions

Kssmi does not make decisions that produce legal or similarly significant effects solely through automated processing of website visitor data. Consent-based analytics may calculate interaction or engagement measurements for website performance and attribution, but those measurements are not used to make such decisions about an individual.

We process different data for different purposes and apply the legal basis appropriate to each activity.

Activity	Data that may be processed	Purpose	Legal basis
Product or project inquiry	Name, business email, inquiry details, product, source page, language, IP address, country, user agent, delivery status and inquiry ID	Respond to the request, prepare a quotation, maintain an inquiry record and protect the form from abuse	Steps requested before entering into a contract; legitimate interests in B2B correspondence, record keeping and service security; and legal obligations where applicable.
WhatsApp or email-link opening	Selected channel, server time, page path, link placement, product SKU where relevant, site language and an “intent” status	Operate and troubleshoot contact entry points and understand which contact channel a visitor deliberately selected	Legitimate interests in operating, measuring and troubleshooting user-requested contact entry points, balanced against the limited nature of the event data.
Consent-based visitor journey	Visitor and session identifiers, pages, timestamps, referrer, campaign parameters, country/city, browser/device information, interaction and engagement data	Website analytics, attribution, performance measurement and service improvement	Consent.
Advertising and measurement	Consent state, identifiers, page and conversion events and campaign information handled by configured advertising or analytics providers	Measure advertising effectiveness and, where enabled, support advertising features	Consent.
Security and abuse prevention	IP address or a hashed representation, request time, user agent, security-verification data and technical errors	Rate limiting, spam prevention, incident investigation and service security	Legitimate interests and, where applicable, compliance with legal obligations.
Direct business communications	Email address, phone/account identifier, message content, attachments and later correspondence	Communicate about quotations, samples, manufacturing projects and business relationships	Steps before contract, contract performance and/or legitimate interests depending on the context.

Sources of data

We may obtain data:

• directly from the person completing a form or sending a message;
• automatically from the browser or network connection, subject to the applicable consent and legal requirements;
• from the page and product context associated with a contact action;
• from a company representative, colleague, distributor or other business contact; and
• from service providers used to deliver, secure or measure the website.

Where personal data is obtained from another source, we provide any additional information required by applicable law within the applicable time.

Data minimisation

Users should provide only the information reasonably needed for their business request. The inquiry form should not be used to submit sensitive personal data, government identifiers, payment-card data or unnecessary information about another person.

Kssmi separates a minimal contact-event function from the consent-based visitor-journey analytics function. They serve different purposes and must not be described as one system with one legal basis.

1. Contact events

When a visitor deliberately selects a WhatsApp or email link, the website may record a minimal event showing that the contact entry point was opened. Without analytics consent, this event is designed to contain only:

• the selected channel;
• an open_intent event type;
• server time;
• the relevant on-site page path;
• link placement;
• product SKU where relevant;
• site language; and
• an intent status.

Without analytics consent, this record must not create or read a VJT visitor/session identifier and must not contain a reconstructed browsing journey, full referrer URL, campaign parameters, IP address, user agent or geolocation. Separate short-lived security processing may occur for rate limiting.

An open_intent record means only that the website contact link was triggered. It does not prove that a device successfully opened WhatsApp or an email client, that the visitor sent a message, or that Kssmi received one.

For an inquiry form, a submission_success event means that the website’s configured sending process reported success. It does not prove that a recipient read or replied to the email.

2. Visitor journey tracking (VJT)

With analytics consent, VJT may use a first-party visitor identifier and a short-lived session identifier to associate page visits and contact events with one consented journey. Depending on the active configuration, journey data may include:

• page URLs and titles;
• visit and interaction times;
• referrer and campaign parameters;
• browser, device, screen, language and time-zone information;
• IP-derived country or city;
• scroll and engagement measurements; and
• inquiry or contact-event attribution.

The analytics journey must remain disabled until the visitor grants analytics consent. If consent is withdrawn, subsequent analytics collection must stop and VJT identifiers stored in the browser must be removed in accordance with the implemented withdrawal process.

3. Advertising and third-party analytics

Google Analytics, Google Ads, Google Tag Manager or comparable measurement technology operates according to the visitor’s selected consent categories and the site’s active configuration. Analytics and advertising storage remain denied until the corresponding consent is granted.

4. Cookies and browser storage

The principal browser-storage items used by the website are listed below. Third-party identifiers may vary by provider, browser, consent choice and active configuration.

Name	Provider	Purpose	Category	Duration	Storage type
cookie-consent	Kssmi	Remember the visitor’s necessary, analytics and advertising choices	Necessary	Until the choice is changed or browser storage is cleared	Local storage
vjt_visitor_id	Kssmi	Associate consented visits with a visitor journey	Analytics	Cookie: up to approximately 365 days; local storage: until consent is withdrawn or browser storage is cleared	Cookie and local storage
vjt_session_id	Kssmi	Associate consented page events within a session	Analytics	Approximately 30 minutes	Cookie
Google or other configured third-party identifiers	Relevant provider	Consent-based analytics, measurement or advertising	Analytics or advertising	Varies by provider and configuration; see the relevant provider’s information	Cookie or similar technology

The cookie inventory, consent banner and live implementation must agree. Renaming a tracker or moving an identifier from a cookie to local storage does not by itself make the technology consent-exempt.

5. Changing consent choices

Visitors must be able to reopen Cookie Settings and change or withdraw analytics and advertising consent as easily as it was given. Withdrawal does not affect processing that was lawful before withdrawal.

We may disclose personal data only where reasonably necessary for the purposes described in this notice, where required by law, or in connection with the establishment, exercise or defence of legal claims.

Service providers and recipients

We may use the following categories of recipients and service providers where reasonably necessary to operate, protect, communicate through and measure the website:

Recipient or service category	Role or function	Data that may be involved
Cloud hosting and infrastructure providers	Website and server hosting, storage, backups and system availability	Technical request data, server logs and stored website records
Content-delivery and security providers	Content delivery, proxy services, security checks and abuse prevention	IP address, request metadata, security signals and technical logs
Analytics and advertising providers	Consent-based measurement, attribution and advertising functions	Consent state, identifiers, page events and campaign information
Communication-platform providers	Communication services deliberately selected by the user	Account identifiers, message content and related communication metadata
Media-delivery providers	Delivery and performance of website video or other media	IP address, device/browser information and media-request data
Approximate-location service providers	Country-level or regional lookup used for inquiry routing or security	IP address and derived approximate location
Email, backup, monitoring and maintenance providers	Business communications, resilience, troubleshooting and system operation	Inquiry data, correspondence, technical logs and backup copies where applicable

We may also share relevant information with professional advisers, regulators, law-enforcement bodies or parties to a corporate transaction where an appropriate legal basis and safeguards exist.

International transfers

Kssmi is established in China. Information submitted directly through the website or a communication channel selected by the user may therefore be processed in China. Some service providers may also process information in countries outside the person’s country or the European Economic Area.

Where Chapter V of the GDPR applies to a transfer by a controller or processor, the transfer must use a lawful mechanism appropriate to the circumstances, such as an adequacy decision, applicable European Commission standard contractual clauses, or another safeguard or derogation permitted by law. Supplementary technical and organisational measures are applied where appropriate. A person may contact privacy [at] kssmi [dot] com to request information about safeguards relevant to their data, subject to lawful confidentiality restrictions.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legitimate business, security, accounting and legal requirements.

Retention schedule

The following periods and criteria apply to the website systems described in this notice:

Data	Retention period or criterion
Consent-based VJT database journey	Normally 90 days, subject to the configured retention setting and automated cleanup
WhatsApp/email contact-event intent	Normally 90 days
Server-confirmed inquiry outcome	Normally 730 days
VJT visitor identifier in browser storage	Cookie up to approximately 365 days; local-storage copy until analytics consent is withdrawn or browser storage is cleared
Inquiry delivery log	Capped at the most recent 1,000 delivery records
Rate-limit and security counters	For the active security window and subsequent technical cleanup
Email mailbox and business correspondence	For the duration of the inquiry or business relationship and thereafter as needed for contracts, accounting, disputes and legal obligations
Server logs and backups	According to security investigation and backup-rotation needs, then deleted or overwritten when no longer necessary

Data may be retained longer where reasonably necessary for a legal obligation, dispute, fraud investigation or legal claim. It may be deleted or anonymised earlier where it is no longer needed.

Security

We use technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Measures may include access controls, protected administrative interfaces, transport encryption, rate limiting, security verification, restricted server storage and system maintenance.

No transmission or storage method is completely secure, and we cannot guarantee absolute security.

If a security incident affects personal data, Kssmi assesses it and provides any notification required by applicable law.

Your data-protection rights

Depending on the applicable law and circumstances, you may have rights to:

• receive information about the processing of your personal data;
• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive and transmit certain data in a portable format;
• withdraw consent at any time for future processing based on consent; and
• receive safeguards relating to qualifying automated decisions, where applicable.

These rights are subject to legal conditions and exceptions. We may request information reasonably necessary to verify identity and protect personal data from unauthorised disclosure.

Exercising your rights

Send a request to privacy [at] kssmi [dot] com and describe the right you wish to exercise. Kssmi will respond within the time required by applicable law. We may ask for information reasonably needed to verify identity, clarify the request or protect another person’s rights.

Complaints

If you are in the European Economic Area, you may lodge a complaint with a competent data-protection supervisory authority, including the authority in the country where you live, work or believe an infringement occurred. We encourage you to contact us first so that we can try to address the concern, but doing so does not remove your right to complain to an authority.

Consent settings

You can use the website’s persistent Cookie Settings control to review, change or withdraw analytics and advertising choices. The control and this notice must use consistent category names and must remain available after a visitor accepts or rejects optional processing.

Changes to this notice

We may update this notice when our website, processing activities, suppliers or legal obligations change. The version and last-updated date at the top of the page identify the current notice. Where required, we will provide additional notice or request new consent for a material change.

Contact

Data controller: Shenzhen Kssmi Technology Co., Ltd.
Privacy contact: privacy [at] kssmi [dot] com
Postal address: 905, Bldg. 1, Baiwangda Health Tech Park, Yuanshan St., Longgang Dist., Shenzhen, Guangdong, China, Postcode: 518000
EU representative: Kssmi Eyewear, Montagnola, Via Nicola Spedalieri, 7, 00142 Roma RM, Italy
EU representative privacy contact: privacy [at] kssmi [dot] com