Privacy policy

Scope and responsible operator

This Privacy Policy applies to the Elosung website, buyer and supplier workspaces, promoter tools, AI-assisted features, applications, procurement lists, requests for quotation, quotations, orders and related business communications.

Elosung is the service and brand name. The legal contracting entity responsible for a specific transaction is identified in the applicable quotation, pro forma invoice, order confirmation or other commercial document. Digital operations are coordinated from Yiwu, Zhejiang, China, using the contact details on this page.

If a transaction document contains a more specific privacy notice for that transaction, the more specific notice applies to the extent of any conflict.

Information we collect

We collect only the information reasonably needed to operate a business sourcing and wholesale service. The exact data depends on how you use Elosung.

• Account and identity data, such as name, business email, account identifier, role, organization membership and sign-in status.
• Company and application data, such as legal company name, country, business type, website, contact details, expected purchasing activity and review information.
• Sourcing and transaction data, such as selected SKUs, quantities, destination, shipping preference, Incoterm request, buyer notes, quotations, order records, shipment facts and payment-record references.
• Supplier and promoter data, such as company profile, registration details, product categories, business documents, media, referral code, referral relationship and commission records.
• Communications and support data, including messages, files and information you submit when requesting assistance or responding to business outreach.
• Limited technical and usage data, such as locale, route, device class, country code, coarse traffic-source category, product interaction and performance measurements.
• AI input and context, such as the sourcing request you send to an AI-assisted search or drafting feature and the catalog or business facts needed to answer it.

Where information comes from

Most information comes directly from you, your organization or an authorized colleague. We also receive authentication data from our sign-in provider, technical information from hosting infrastructure, product and supplier records from participating suppliers, and transaction updates from staff or service providers involved in an order.

For relevant business outreach, administrators may record publicly available company and professional contact information from a company website, trade directory or other public business source. We use suppression records to avoid contacting a person or company that has objected.

How we use information

We use information to provide accounts and organization access, maintain procurement lists, review buyer and supplier applications, answer sourcing requests, prepare and administer quotations and orders, arrange operational follow-up, protect the service, prevent abuse, meet legal obligations and improve the usability of product discovery.

We may also use business contact information to send relevant one-to-one wholesale outreach. You can object at any time, and an objection may be retained as a suppression record so the request remains effective.

We do not sell personal information and do not use it for cross-context behavioural advertising.

Why processing is permitted

Where applicable law requires a legal basis, we rely on steps requested before a business contract, performance and administration of a contract, compliance with legal obligations, consent for optional measurement, and legitimate interests such as service security, fraud prevention, relevant B2B communication and improving a professional sourcing service.

When we rely on consent, you may withdraw it for future processing. When we rely on legitimate interests, we consider the purpose, necessity and impact on the individual. Mandatory local rules may provide additional or different grounds.

AI-assisted features

AI-assisted catalog search may send the words in a sourcing request to a configured model provider so the request can be converted into a bounded catalog search. Internal tools may also send selected product, quotation or outreach facts to generate a draft for human review.

Public AI answers are constrained by current catalog and workflow facts. AI output does not reserve stock, approve an account, accept an order, set a final price or make another decision with legal or similarly significant effect by itself.

Do not place passwords, payment credentials, government identification numbers, trade secrets or unrelated personal data in an AI prompt. A model provider may process submitted content as a service provider under its applicable data terms and configuration.

When information is shared

We disclose information only when needed for the service or required by law. Recipients may include authentication, hosting, database, email, file, performance-measurement and AI service providers; participating suppliers; freight or fulfilment providers; professional advisers; regulators; and a buyer's or supplier's authorized organization members.

A provider receives only the data needed for its role. Commercial transaction information may be shared with the parties needed to verify, quote, allocate, ship, document or resolve that transaction.

If the service or relevant business assets are reorganized or transferred, information may be reviewed or transferred subject to appropriate confidentiality and legal safeguards.

International processing

Elosung supports cross-border trade, so information may be processed in China and in other places where the relevant buyer, supplier or service provider operates. Data-protection rules may differ between these locations.

Where an applicable law requires a transfer mechanism, assessment, notice, separate consent or contractual protection, we will use the required measure for the relevant transfer.

How long information is kept

We keep information only for as long as needed for the purpose described, an active account or business relationship, dispute handling, security, and applicable tax, accounting, trade or legal requirements.

Current operational limits include 90 days for bounded conversion and AI-concierge event telemetry, 30 days for an RFQ draft saved in the browser, 30 days for promoter referral attribution, 180 days for the privacy-choice cookie and 12 months for the language-preference cookie. A browser procurement-list identity remains until it is replaced, removed or browser storage is cleared.

Applications, supplier evidence, quotations, orders, shipment records, payment records, audit records and related communications may need a longer period because they support a business transaction, legal duty or claim. When deletion is not yet permitted, access may be restricted instead.

Your choices and rights

Depending on your location and the circumstances, you may have rights to know or access personal information, correct it, request deletion, receive a portable copy, withdraw consent, object to or restrict processing, and complain to a competent authority. Some rights have legal exceptions, including records required for a transaction, security, tax, compliance or legal claims.

Use Cookie settings in the footer to allow or reject optional first-party measurement. We also respect an enabled Global Privacy Control or browser Do Not Track signal for that optional measurement.

To exercise a privacy right, email us from the address associated with the relevant record and describe the request. We may need proportionate information to verify identity, authority and scope before acting. We will not discriminate against you for making a valid request.

Security and intended users

We use access controls, scoped organization permissions, encrypted transport, protected credentials, bounded inputs, logging and other technical and organizational safeguards appropriate to the service. No online system can guarantee absolute security, so notify us promptly if you suspect unauthorized access.

Elosung is a business service intended for adults and authorized business representatives. It is not directed to children, and we do not knowingly solicit personal information from children.

Changes to this policy

We may update this policy when the service, providers, processing or applicable requirements change. The effective date at the top identifies the current version. If a change materially affects how existing information is used, we will provide additional notice where required.