PRIVACY POLICY

The data controller responsible for your personal information is:

If you are located in the European Economic Area (EEA), WAY acts as the data controller for personal data collected through this website. For inquiries regarding your data rights, please contact our designated privacy contact at the email address above.

We collect personal data in the following categories, depending on how you interact with our website and services:

Information You Provide Directly

• Full name and job title
• Company name and business address
• Email address and telephone number
• Inquiry details, product specifications, and technical requirements
• Any attachments or files you submit (e.g., engineering drawings)

Information Collected Automatically

• IP address and approximate geographic location (country/region level)
• Browser type, version, and operating system
• Device type (desktop, mobile, tablet)
• Pages visited, time spent on pages, and navigation paths
• Referring website or search query that led you to our site
• Date and time of each visit

Information from Third Parties

• Analytics data from Google Analytics (aggregated and anonymized where possible)
• Business contact information from trade directories or exhibitions

When you submit an inquiry through our website contact form, RFQ (Request for Quotation) form, or catalogue download form, we collect the information you enter in those fields.

How Form Data Is Handled

• Form submissions are transmitted over encrypted HTTPS connections
• Data is stored in our secure CRM system and/or email infrastructure
• Form data is used solely to respond to your inquiry and manage the business relationship
• We do not sell or rent form submission data to third parties
• Submissions may be forwarded internally to our sales, engineering, or export teams as required to process your request

Retention of Form Submissions

Inquiry records are retained for 3 years from the date of last contact, or for the duration of any active business relationship, whichever is longer. After this period, records are securely deleted or anonymized.

Spam Protection

Our forms may use Google reCAPTCHA to prevent automated spam submissions. reCAPTCHA collects hardware and software information and sends that data to Google for analysis. Use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.

Our website uses cookies and similar tracking technologies to improve functionality, analyze traffic, and enhance your browsing experience. A cookie is a small text file stored on your device when you visit a website.

Types of Cookies We Use

Managing Your Cookie Preferences

When you first visit our website, a cookie consent banner will appear allowing you to accept or decline non-essential cookies. You can change your preferences at any time by clicking the "Cookie Settings" link in the footer.

You may also control cookies through your browser settings. Note that disabling cookies may affect website functionality. For more information, visit allaboutcookies.org.

Google Analytics

We use Google Analytics 4 (GA4) to understand how visitors interact with our website. Data collected is aggregated and does not personally identify individual users. You may opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

WAY uses personal data for the following specific and legitimate purposes:

• Responding to inquiries -- Processing your RFQ, product questions, or technical consultations
• Business relationship management -- Managing ongoing commercial relationships with customers, distributors, and partners
• Order processing and fulfillment -- Coordinating manufacturing, logistics, and export documentation
• Technical communication -- Sharing product specifications, engineering drawings, certifications, and quality reports
• Website improvement -- Analyzing traffic patterns to improve site performance and content relevance
• Legal compliance -- Meeting obligations under applicable trade, export, and data protection laws
• Security -- Detecting and preventing fraudulent or unauthorized activity

For individuals in the European Economic Area (EEA) and United Kingdom, we process personal data under the following legal bases as defined in GDPR Article 6:

• Legitimate Interests (Art. 6(1)(f)) -- Processing inquiry and contact data to manage business communications and commercial relationships
• Performance of a Contract (Art. 6(1)(b)) -- Processing data necessary to fulfill a purchase order, supply agreement, or service contract
• Consent (Art. 6(1)(a)) -- Processing analytics and non-essential cookies where you have given explicit consent via our cookie banner
• Legal Obligation (Art. 6(1)(c)) -- Retaining records required by Chinese export law, EU customs regulations, or other applicable legal obligations

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your data protection rights. You may request details of this assessment by contacting us.

WAY does not sell, rent, or trade personal data. We may share data with the following categories of recipients only as necessary:

Internal Recipients

• WAY sales and export teams handling your inquiry
• Engineering and quality teams processing technical requirements
• Management for key account oversight

Trusted Third-Party Service Providers

• IT and hosting providers -- Website hosting, email infrastructure, and CRM platforms under data processing agreements
• Google LLC -- Analytics (GA4) and spam protection (reCAPTCHA), subject to Google's privacy terms
• Logistics partners -- Freight forwarders and customs agents requiring shipment details for export orders

Legal Disclosure

We may disclose personal data if required by law, court order, or government authority, or to protect the legal rights, safety, or property of WAY, our employees, or others.

As a Chinese manufacturer serving global markets, your personal data may be transferred to and processed in the People's Republic of China, where WAY's operations are headquartered.

For transfers of personal data from the EEA or UK to China, we implement appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the European Commission where applicable
• Strict data minimization -- only data necessary for the business purpose is transferred
• Contractual commitments with service providers to maintain equivalent protection standards

You may request a copy of the safeguards we have in place for international transfers by contacting us at privacy@way-chassis.com.

We retain personal data only as long as necessary for the purpose it was collected, or as required by applicable law.

Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymized.

WAY implements appropriate technical and organizational security measures to protect personal data against unauthorized access, loss, destruction, or alteration. Our measures include:

• TLS/SSL encryption for all data transmitted between your browser and our website
• Access controls -- personal data is accessible only to authorized personnel on a need-to-know basis
• Regular security assessments of our hosting infrastructure and third-party services
• Employee training on data protection and confidentiality obligations
• Incident response procedures to detect, report, and investigate data breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33, and will inform affected individuals without undue delay where required.

Depending on your location, you may have the following rights regarding your personal data:

Rights Under GDPR (EEA / UK)

• Right of Access (Art. 15) -- Request a copy of the personal data we hold about you
• Right to Rectification (Art. 16) -- Request correction of inaccurate or incomplete data
• Right to Erasure (Art. 17) -- Request deletion of your data ("right to be forgotten") where applicable
• Right to Restriction (Art. 18) -- Request that we limit the processing of your data
• Right to Data Portability (Art. 20) -- Receive your data in a structured, machine-readable format
• Right to Object (Art. 21) -- Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent -- Where processing is based on consent, withdraw it at any time without affecting prior processing
• Right to Lodge a Complaint -- File a complaint with your national data protection authority (e.g., CNIL in France, ICO in the UK, BfDI in Germany)

How to Exercise Your Rights

To exercise any of the above rights, please contact us at privacy@way-chassis.com with the subject line "Data Rights Request." We will respond within 30 days. We may need to verify your identity before processing your request.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) may grant you additional rights:

• Right to Know -- Request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months
• Right to Delete -- Request deletion of personal information we have collected, subject to certain exceptions
• Right to Correct -- Request correction of inaccurate personal information
• Right to Opt-Out of Sale or Sharing -- WAY does not sell or share personal information for cross-context behavioral advertising
• Right to Non-Discrimination -- We will not discriminate against you for exercising any CCPA rights

To submit a CCPA request, contact us at privacy@way-chassis.com or use the contact details in Section 15. We will respond within 45 days.

Our website and services are directed exclusively at business professionals and are not intended for individuals under the age of 16. We do not knowingly collect personal data from children.

If you believe a child has provided personal information to us, please contact us immediately at privacy@way-chassis.com and we will take steps to delete such information promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post a notice on our website homepage for significant changes
• Where required by law, notify you directly by email

We encourage you to review this Privacy Policy periodically. Your continued use of our website after any changes constitutes acceptance of the updated policy.