Privacy Policy

1. Who we are

This policy explains how STARCO PACKAGING CO., LTD. (“Starco Packaging”, “we”, “us”), a cosmetic packaging manufacturer based in China, handles personal data when you visit starcopackaging.com, fill in one of our lead forms on Facebook or Instagram, or contact us by WhatsApp, email or phone. We are the data controller for this data.

Our business is business-to-business (B2B). Our website and forms are intended for professionals (brands, manufacturers and their staff), not for children.

2. What data we collect

Quotation requests through Meta lead forms (Facebook / Instagram ads): your name, work email, phone number, company name, your type of business (for example brand or OEM/ODM manufacturer), the product category and model you are interested in, and your estimated quantity. Meta may pre-fill some fields from your Meta profile; you can edit them before you submit.

WhatsApp messages: your WhatsApp phone number, your WhatsApp profile name, the content of the messages you send us (for example the model and quantity you ask about), and the date and time of the messages.

Email and phone: your email address or phone number, your name and signature details, and whatever you choose to tell us in your message or call.

Website technical data: our website has no contact form and no account system. When you load a page, our hosting provider Cloudflare processes technical data such as your IP address, browser type, the page requested and the time of the request, to deliver the page and protect the site against abuse. See section 9 for cookies.

We do not ask for sensitive data (such as health data). Please do not send it to us.

3. Where the data comes from

• Directly from you (forms, WhatsApp, email, phone).
• From Meta Platforms Ireland Ltd. when you submit a lead form in one of our ads on Facebook or Instagram.
• From our hosting provider (technical data when you visit the site).

4. Why we use the data and on what legal basis

• To answer your quotation or sample request and send you prices, catalogues, samples and product information you asked for. Legal basis (GDPR): steps taken at your request before entering into a contract (Art. 6(1)(b)), and your consent when you submit the form (Art. 6(1)(a)).
• To follow up on your request as a business contact (for example a reminder about a quote, or a relevant new model in the category you asked about). Legal basis: our legitimate interest in developing B2B relationships (Art. 6(1)(f)). You can object at any time, and we will stop.
• To manage the business relationship if you place an order (orders, production, delivery, invoices). Legal basis: performance of the contract (Art. 6(1)(b)) and our legal obligations, for example accounting (Art. 6(1)(c)).
• To keep the website working and secure. Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f)).
• To measure and improve our ads using the aggregated statistics Meta gives us, and to avoid showing ads again to people who have already contacted us. Legal basis: our legitimate interest (Art. 6(1)(f)).

We do not sell your personal data, and we do not use it for automated decision-making or profiling that produces legal or similarly significant effects on you.

5. Who receives the data

Your data is accessed by our own sales team. We also use the following service providers, which process data on our behalf or under their own terms:

• Meta Platforms (Facebook, Instagram, WhatsApp Business) – lead forms, ads and messaging. For the lead forms and ads, Meta also acts under its own privacy policy.
• YCloud – WhatsApp Business messaging service provider that we use to receive and record WhatsApp messages sent to our business number.
• Cloudflare, Inc. – website hosting, content delivery and security; also hosts the small database in which incoming WhatsApp messages are logged.
• Google (Gmail) – our business email service.

If you become a customer, we may share the data needed for the order with logistics and shipping companies. We may also disclose data where required by law or to defend our legal rights.

6. International transfers

We are located in China, so your data is processed in China. Our service providers may also process it in other countries, including the United States. These countries may not offer the same level of data protection as your country.

Where the GDPR applies, we transfer data to China because it is necessary to answer the request you send us and to take the pre-contractual steps you ask for (Art. 49(1)(b) GDPR), and we rely on the safeguards offered by our service providers, such as the European Commission’s Standard Contractual Clauses where they provide them. You can contact us to ask for more information about these safeguards.

7. How long we keep the data

• Quotation requests, WhatsApp conversations and emails with prospects who do not become customers: 24 months after our last contact with you, then deleted or anonymised.
• Customer data: for the duration of the business relationship, and afterwards as long as required by accounting, tax or other legal obligations.
• Website technical logs: kept by Cloudflare for a short period according to its own retention settings.

If you ask us to delete your data or object to follow-up, we will do so earlier, unless we must keep some data by law.

8. Your rights

Depending on the law that applies to you (including the GDPR for people in the European Union), you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to its processing, including follow-up messages;
• receive your data in a portable format;
• withdraw your consent at any time (this does not affect processing carried out before withdrawal).

To exercise these rights, email [email protected] or tell us on WhatsApp. We will reply within one month. We may ask you to confirm your identity.

If you are in France, you can also lodge a complaint with the CNIL (www.cnil.fr); in another EU country, with your local data protection authority.

9. Cookies and similar technologies

Our website does not use analytics, advertising or social-media tracking cookies or pixels (no Google Analytics, no Meta Pixel). Our pages do not set any cookies.

We store one item in your browser’s local storage, starcopackaging-lang, only to remember the language you choose. It contains no personal data and is not used for tracking. You can delete it by clearing your browser data.

Our hosting provider Cloudflare may process technical data (see section 2) and uses a script to protect our email address from spam bots. Links to Facebook and WhatsApp take you to those services, where their own privacy and cookie policies apply.

If we add analytics or advertising tools in the future, we will update this section and ask for your consent where the law requires it.

10. Security

We take reasonable technical and organisational measures to protect your data, such as limiting access to our sales team and using providers with secure (HTTPS) connections. No method of transmission over the internet is completely secure.

11. Changes to this policy

We may update this policy. The current version is always available on this page, with its effective date. This version is effective from 2026-10-27.

12. Contact

Questions about this policy or your data: [email protected] · WhatsApp / phone +86 190 1120 9527.