Informação legal
Política de privacidade
Esta página está disponível em inglês e em alemão. Aplica-se a versão em inglês.
This policy explains what personal data this website collects, why, who receives it and how long it is kept, and what rights you have. It covers the whole website, partner accounts included.
Who is responsible
The controller responsible for this website under the EU General Data Protection Regulation (GDPR) is:
- Controller
- Yiwu Lexical Electrical Appliances Co., Ltd.
- Address
- 571 Chouzhou North Road
Futian Street, Yiwu
Zhejiang 322023, China - Phone
- +86 177 5805 4396
For anything about your personal data, write to contact@lexical.com.cn.
What we collect and why
Each feature collects what it needs to work and nothing more. Each part below says what is stored, why, and on which legal basis.
Visiting the website
When you open a page, your browser sends the technical data every request carries, such as your IP address, the time, the address of the page and your browser's identification. Our host, Vercel, processes these data to deliver the website and keep it secure, and keeps them in its logs for a limited time. We do not use them to find out who you are.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in delivering a secure website.
Partner accounts
When you create an account we store your name, your work email address, your mobile (WhatsApp) number and, if you give it, your company name, together with your password — kept only as a salted hash, never as the password itself. You can add a profile picture, which your browser reduces to a small square image before it is uploaded. We also record when the account was created, when its email address was confirmed, the language of the pages you last used the website in, and whether we have marked it as a verified customer, which shows the full barcodes on product pages and data sheets; when we do, we email you to say so, in that language. On your account page you can also add your country. If you apply there to be verified as a customer, we record when you applied and what we decided, and when; our export desk is emailed your name, company, country, WhatsApp number and email address, whether that address is confirmed, when the account was created and the language of the page you applied from. If you add a passkey to sign in with, we store its public key, the site address, browser and system it was added on, and when it was added and last used; its private key, and your fingerprint or face, never leave your device.
When you are signed in, the quote form, the agency application and the Canton Fair booking are filled in from your account. If your account has no mobile number or company yet, the first request that carries them adds them to it; a saved value is only changed on your account page.
When you create an account, our export desk is told by email and may contact you by phone, WhatsApp, WeChat or email to introduce itself and to offer help with what you are looking for. It keeps a short note of each contact with your account — how and when it happened, who on our team made it, how it went and, if we choose to, a screenshot of the call log or the chat — and only signed-in administrators can see it. Legal basis for this contact: Art. 6(1)(f) GDPR — our legitimate interest in following up a new business account; you can object at any time (Art. 21 GDPR) by writing to us, and we will stop. The note and any screenshot are deleted when the account is deleted.
Legal basis: Art. 6(1)(b) GDPR — providing the account you asked for.
Email confirmation and password reset
To confirm an email address or to reset a password, we email you a six-digit code. It is valid for ten minutes and works once; we store only a keyed hash of it, never the code itself. To prevent misuse we count, under a hash of the email address, how many codes were sent and how many wrong ones were tried; these counts are deleted after 24 hours at the latest.
Legal basis: Art. 6(1)(b) GDPR for the codes; Art. 6(1)(f) GDPR — protecting accounts from misuse — for the counting.
Quote requests and Canton Fair meeting requests
The quote form on the contact page, and the meeting request in the Canton Fair section, send us your name, your company and the kind of business it is, your email address, your mobile number and your country, and — depending on what you ask about — the destination port, the quantity, the product line or item, a date and languages for a showroom visit, your message, and any files or logo you attach. If you are signed in, the request is linked to your account. We store the request, email it to our export desk, and email you a confirmation that it has arrived.
Files you attach go from your browser straight to our file storage (Vercel Blob). They are kept at an address that is not published and is hard to guess; anyone who has that address can open the file.
Legal basis: Art. 6(1)(b) GDPR — steps taken at your request before a possible contract.
Canton Fair booth meetings
A signed-in partner can book a 30-minute meeting at our Canton Fair booth. We store the time, your name and account email address, your company, your WhatsApp number, the email address at which you would like an answer, the salesperson you have been in touch with if you name one, your note, and the language of the page you booked on. We email you whenever you book or change the time, and when we move or cancel the meeting; our export desk is emailed when you book, move or cancel it.
Legal basis: Art. 6(1)(b) GDPR.
Exclusive agency applications
An application for an exclusive agency sends us the territory you apply for; your name, company, email address and phone number, and your WhatsApp and WeChat numbers; the cities you work in, your trades and sales channels, the languages you speak, how much of the country you cover, your after-sales service and the volume you expect; a place you mark on the map; photographs and films of your stores, or links to them; whether you have bought Lexical products before, with any proof you add; and your notes. We store the application and email it to our export desk. While you fill it in, the form shows how complete it is; the desk sees that figure too, but it decides nothing by itself.
Legal basis: Art. 6(1)(b) GDPR.
The map on the agency application
When you scroll to the map, your browser loads the map images from the OpenStreetMap Foundation's servers, which receive your IP address and the part of the map shown. When you search for an address, or place a pin, our server asks OpenStreetMap's Nominatim service for the position or the name of the place; it sends only the words you typed or the pin's coordinates, never your IP address.
Legal basis: Art. 6(1)(f) GDPR — a working map for marking your location.
Error reports
If a page fails in your browser, the error page sends us a short report: the error message and its reference, the address of the page (with the words you searched for, if it shows a search), the page's language and your browser's identification (user agent), with the time. If a form does not send — a quote request, an agency application, a Canton Fair booking or meeting request — your browser sends a report like it: which form, the answer it received, the address of the page without anything after its question mark, the page's language and your browser's identification. Neither contains a name, an email address or anything else you typed. We keep the last 200 reports, and the website's administrators are emailed an alert about each kind of error, at most once every six hours.
Legal basis: Art. 6(1)(f) GDPR — finding and fixing faults.
Searches on the website
When you use the site search or the search box of the product catalogue, we count the words you settle on — when you press Enter, pick a result or stop typing for a moment — not every letter you type. With them we keep how many results they found, the page's language, which of the two boxes it was, and the month and the time they were last searched. No IP address and no browser identification is kept with a search, and words that look like an email address or a phone number are not counted at all. If you are signed in to a partner account, the search is also counted under your account's email address, so that our export desk can see which lines a partner is looking for. We use these counts to improve our range and the search.
The search box also has an optional microphone button. If you press it, your browser listens and turns what you say into text. Some browsers do this on your device; others send the sound to an online speech service run by the browser’s maker, which is a matter between you, your browser and that maker. Lexical never receives or keeps the recording: only the words come into the search box, and they are treated like a search you typed, as described above.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in improving our range and our website's search.
The AI assistant
On the FAQ and Contact pages, when it is switched on, you can type a question into the “Ask our assistant” box. The question you type is sent from our servers to our AI provider, Anthropic (USA), together with the public text of this website, so that it can write an answer. Anthropic receives from us neither your name, your account, your email address nor your IP address, and we do not link a question to you. To stop the box being misused, we count questions with a random cookie and a keyed (hashed) form of your connection, which is not your IP address in readable form, and, if you are signed in, a keyed form of your account’s email address; these counters expire after 12 hours. The text of each question — only when it contains no email address, web address or phone number — is kept as anonymous text for 30 days, together with the language of the page and whether the assistant could answer it, so that we can see what visitors ask and add answers to the FAQ. The answer itself is not kept. Please do not type personal data into the box.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in answering visitors’ questions quickly and in improving our FAQ.
Unfinished forms
When you fill in our quote form or the sign-up form, the website counts, anonymously, which step you reached (for example “company details” or “the order”) and whether the form was sent. These counts carry no name, no email address, no account and no IP address, and nothing is stored in your browser for them; we use them to see where people give up and to make the forms shorter. Separately, the quote form has a link “Save and email me the link”. Only if you press it do we keep the answers you have typed so far, including your name, email address, company and phone number if you entered them, under a random code for 30 days, and email a link to the address you typed (or your account's address) that opens the form with your answers filled in. We send you that email and, if you have not finished by the next day, one reminder, and nothing more. Files and logos you have added are not kept. When you send the request, the saved copy is deleted.
Legal basis: Art. 6(1)(f) GDPR for the anonymous counts — our legitimate interest in improving our forms; Art. 6(1)(a) and (b) GDPR for the saved request — you ask us to keep it and to email you the link. You can ask us to delete a saved request at any time by writing to us, and it is deleted with your account.
“Tell me when it’s out” on the Coming soon page
If you press “Tell me when it’s out” on a line of the Coming soon page, we keep your email address — the one you type, or your account’s address if you are signed in — with the line you asked about, the language of the page and the time. When the line’s launch time has passed, we email that address once to say the line is out, with a link to it, and, if you were signed in, we add a notice to your account’s notifications. Our export desk is sent a copy of that email. We send nothing else to the address, and the email carries no prices.
Legal basis: Art. 6(1)(a) GDPR — you ask us for this one message. You can ask us to delete your address before then by writing to us.
Activity on the website
This website counts for itself which pages are opened and how they are used — with no outside service, no cookie and nothing stored in your browser. When a page opens, your browser sends this website the address of the page, its language and the kind of screen (desktop, tablet or phone). While the page is open, it also notes which of its sections were on screen for more than a second, and where on the page you clicked or tapped, as a position on the page. Our server adds the country your connection comes from, which our host, Vercel, works out from your IP address when the request arrives; the IP address itself is not stored with the counts — it stands for ten minutes only in the counter described under “Protection against misuse” below. The counts carry no name, no email address and no identifier. We use them to see which lines and pages interest buyers, and to improve our range and the website. The website also measures, in your browser, how quickly each page loaded and how quickly it responded when you clicked, tapped or typed; these figures are kept only as counts per kind of page and kind of screen, and are never linked to a person or a partner account. The website's administrators are not counted, and neither are search engines and other automated visitors.
When you open the website, your browser also tells it which website sent you, if any, and the word after “?from=” if the link you followed has one (for example a link on a printed card). We keep only the name of that website — not the address of the page you came from — and the word, as a count, once per visit. They carry no name, no email address and no identifier, and they are not linked to a person or a partner account.
If you are signed in to a partner account, the same is also kept under your account: the pages and products you opened, the sections you read, the country you visited from, and a list of the last 200 pages you looked at, with the time. Our export desk uses this history to see which lines interest you and to follow up on them. It is on unless you switch it off: on your account page, under Privacy, a single switch turns it off, and from that moment nothing more is added to it. What was kept until then stays until you delete it: “Delete history”, under the switch, deletes it 30 days after you confirm. Until that day you can keep it — on the account page, by switching the history back on, or when you next sign in, when we ask you. It is also deleted when your account is deleted.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in knowing which of our products and pages interest buyers, in improving our range and our website and, for partner accounts, in serving our business partners well. You may object at any time (Art. 21 GDPR); for your partner account, the switch on your account page stops the history at once, and “Delete history” deletes what was kept.
Feedback about the website
The Feedback link at the foot of every page lets you report a problem with the website or suggest an idea. We store what you write — a one-line summary, any details and, for a problem, how urgent it is for you — the screenshots you add, and your email address if you give one. With the report your browser sends the address of the page you were on (leaving out anything in it that could be a password, a code, an email address or a phone number), the page's language, the colour theme, the size of the browser window and the time; from your browser's identification we keep only its name, version and operating system. No IP address is stored with a report. If you are signed in, the report is linked to your partner account, with its email address, name and company. Screenshots go from your browser straight to our file storage (Vercel Blob), at an address that is not published. We use reports to find and fix faults and to improve the website. We do not promise an answer; if you gave your email address, we may write to you once to say that the problem has been solved or the idea put in place.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in finding and fixing faults and improving our website.
Notices to our administrators, and the email log
So that nothing you send us waits unseen, the administration pages show our administrators a short notice when a request, an application, a Feedback report, a request to be verified or a Canton Fair booking arrives: what kind it is, the time, your name, company and country as you gave them and a few lines of what you wrote, with a link to the request itself, which is kept as described above. They also list every email this website sends: which kind of email it is, when it was sent, and whether it went or, if not, the reason given, with the recipient’s address shortened to its first letter and its domain (for example a•••@example.com). Nothing else about you is added, and no IP address.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in answering what you send us promptly and in knowing that our emails arrive.
Protection against misuse
Sign-in, sign-up, the forms and the activity counts described above count attempts, to stop automated misuse. The name of such a counter contains your IP address or a hash of an email address, and the counter deletes itself after ten minutes to 24 hours.
Legal basis: Art. 6(1)(f) GDPR — keeping the website and the accounts on it safe.
Instagram pictures
When the Instagram grid on our Social page is switched on, your browser loads its pictures from Instagram's servers (Meta), which receive your IP address.
Legal basis: Art. 6(1)(f) GDPR — showing our own Instagram posts on our website.
Email about new lines
The “New lines by email” box at the foot of every page does not store your address on this website. If we have connected it to a mailing-list service, pressing its button opens that service's page with your email address filled in, and that service's own privacy notice applies there.
Cookies and storage in your browser
We use no outside analytics service and no advertising, and nothing on this website follows you to other websites. The activity counts and the searches described above are made by this website itself; they use no cookie and store nothing in your browser. The website sets up to three cookies, each only when it is needed: two when you sign in, and one when you use the AI assistant:
lx_user— keeps you signed in to your partner account. It holds your account's ID and email address, is signed so that a changed cookie is refused, and expires after 30 days or when you sign out.lx_admin— keeps the website's administrators signed in to the administration pages; it expires after 12 hours.lx_ask— limits how often the AI assistant can be asked, to stop misuse. It holds a random number that identifies no one, is sent only to the assistant, is set when you first ask a question and expires after 12 hours.
Legal basis for the sign-in cookie: Art. 6(1)(b) GDPR.
The website also keeps a few settings in your browser. They stay there; the website reads them in your browser and does not send them to us. Kept until you clear them:
lx-theme— the colour theme you choselx-appearance-prefs— your default theme and your favourite themes, if you set themlx-products-view— how the product catalogue is shownlx-hints— which gesture hints you have already seen, so they are not shown againlx:docpack-moved— that you have already leafed through the document pack, so its hint is not shown againlx-voice— that you have read the note before the first voice search, and the language you chose to speak in for each language of the website, so that you are not asked againlx:quote-order— what you picked so far in the quote form (the kind of request, the products, the order size, the destination and your note, never your name or contact details), for seven days, so that you can pick up where you stopped; removed when the request is sent or when you press “Clear”
Deleted when you close the tab:
lx-visit— that a visit has begun, so a default theme you set applies once per visitlx-range-hint · lx-map-hint— that a hint has been shown during this visitlx-datasheets-picked— the products you ticked for bulk data sheetslx:agency-carry— what you typed in the quote form, handed to the agency application when you follow its link; removed as soon as it has been readlx:quote-draft— what you typed in the quote form (name, email address, company, mobile number), so that the sign-up form can offer it to you; it is filled in only if you press “Use them”, and removed when the request is sent, when you create an account or when you say “No thanks”lx:account-kept— a one-time note, after you sign in again, that your account will not be deletedlx-err:…— that an error on a page, or a form that did not send, has already been reported, so it is not sent twice
The administration pages keep a note of their own for administrators.
Who receives your data
These service providers run parts of the website for us; each receives personal data only as far as its service needs:
- Vercel Inc. (USA) — hosting. Vercel delivers the pages and runs the website's server functions in its Frankfurt region; its network may deliver pages from a location near you. Vercel Blob, part of the same service, stores the files you upload.
- Upstash — our database, which holds the accounts, requests, applications, bookings, error reports, search counts, activity counts, feedback reports and counters. It is stored in Frankfurt, Germany.
- Resend (USA) — delivers the emails this website sends.
- OpenStreetMap Foundation (United Kingdom) — the map on the agency application, as described above.
- Instagram (Meta) — the pictures in the Instagram grid, when it is switched on.
- Anthropic (USA) — the AI model behind the “Ask our assistant” box, when it is switched on: it receives the question you type and the website’s public text, as described above, and nothing that identifies you.
Our export desk in Yiwu, China, reads and answers requests, applications and meeting bookings, and looks after the partner accounts.
When product names are translated into our other languages by AI (Anthropic), only the product names are sent — never personal data.
Links to Google Maps, Amap, DiDi, WhatsApp, Instagram, Facebook, Google Calendar and our customer portal open those services only when you click them. Their own privacy notices apply there.
Transfers outside the European Union
Vercel, Resend and Anthropic are based in the United States, and the OpenStreetMap Foundation in the United Kingdom. Where the European Commission has decided that a country, or a US company certified under the EU–U.S. Data Privacy Framework, protects personal data adequately (Art. 45 GDPR), a transfer relies on that decision; otherwise it relies on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
We are a company in Yiwu, China. Our export desk there reads and answers what you send us; this is necessary to take the steps you ask for before a possible contract (Art. 49(1)(b) GDPR).
How long we keep data
- Accounts are kept until they are deleted. You can delete your account on your account page: it is scheduled for deletion 30 days later and you are signed out, and signing in again before that date keeps it. When the date has passed, the account, its profile, picture, WhatsApp number, company and country, its applications to be verified, any codes still waiting and its Canton Fair bookings are deleted, and your name, email address, phone numbers and company are erased from the requests you sent while signed in and, if you confirmed your email address, from every request and application sent from that address. If you ask us by email, we can delete an account at once.
- Requests and applications are kept as our business records for as long as they are needed for the enquiry, for a business relationship that follows from it and for our legal obligations. Our export desk also receives them by email.
- Own-brand designs you save in your account are kept until the account is deleted. A design you have not sent — a draft — is deleted 7 days after you last saved it (14 days if you are a verified customer).
- Canton Fair bookings are deleted when you cancel them or delete your account; otherwise they are kept with the records of the fair.
- Codes expire after ten minutes; the counters described above delete themselves after ten minutes to 24 hours.
- Error reports: we keep the last 200.
- Search counts are kept per calendar month and deleted 12 months after the end of that month. The link to a partner account is erased when the account is deleted.
- Questions to the AI assistant are not kept with your name. The counters that limit how often it can be used, and the cookie “lx_ask”, expire after 12 hours. The text of a question to the assistant, and whether it could be answered, is kept as anonymous text for 30 days; counts without any text are kept for about 13 months.
- A request you saved to finish later is deleted when you send it, when you delete your account, on request, and in any case 30 days after you last saved it. The anonymous step counts are kept for about 13 months.
- An address left for “Tell me when it’s out” is kept only until the line is out, and deleted when the email has been sent. If it could not be sent within a week of the launch, or the line is taken off the Coming soon page, the address is deleted without a message.
- Activity counts without a name are kept for about 13 months. A partner's activity history is kept while the partner's account is open. Switching it off stops it; what was kept is deleted 30 days after the partner asks for it to be deleted (unless they keep it before then), or when the account is deleted.
- Feedback reports are kept until we have dealt with them and delete them; their screenshots are deleted with them, and a screenshot whose report was never sent is deleted as well. When a partner account is deleted, its email address, name and company are erased from the reports sent with it, together with any email address given in them, and, if you confirmed your email address, that address is erased from every report it was given in.
- Notices to administrators are kept for up to 90 days, or longer when an administrator pins one; the email log for 30 days. When a partner account is deleted, the notices about it lose the words about the person and the email log loses the shortened address; for what was sent without signing in, this happens once the address has been confirmed.
- Server logs are kept by Vercel for a limited time under its own terms.
- Settings in your browser stay there until you clear them; the notes for a single visit go when you close the tab.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have wrong data corrected (Art. 16);
- have data erased (Art. 17);
- have processing restricted (Art. 18);
- receive the data you gave us in a common, machine-readable format (Art. 20);
- object to processing based on our legitimate interests (Art. 21);
- withdraw a consent at any time (Art. 7(3)) — we ask for no consent today, so there is none to withdraw.
You can change most account details on your account page, and delete the account there. For everything else, write to contact@lexical.com.cn.
You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work or where you think your rights were infringed (Art. 77 GDPR).
You do not have to give us personal data. Without a way to reach you, however, we cannot answer a request, and without the account details we cannot open an account.
We make no decisions about you based solely on automated processing (Art. 22 GDPR).
Changes to this policy
We update this policy when the website or the law changes. The date at the foot of this page says when it was last updated.