1. Controller

The controller responsible for the processing of personal data on this Website within the meaning of Art. 4(7) GDPR is:

Xinneng Shipbuilding Co., Ltd.
Taiping Town Zuocheng City
Jining, Shandong, China
Phone: +86 537 7750888
E-mail: info@xinneng-shipbuilding.com

Authorised representatives: Zhang Qiang (Chairman & General Manager / CEO), Wu Zecheng (Vice General Manager), Qi Caizhen (Finance Director).

2. Contact for data protection matters

We have not appointed a Data Protection Officer, as we are not legally required to do so under Art. 37 GDPR. You can reach us on all questions relating to data protection and the exercise of your rights at any time using the contact details of the controller set out in Section 1.

3. General information on data processing

We process personal data only where this is permitted by law. We collect and use personal data of our users in particular where this is necessary to provide a functional website as well as our content and services, where you contact us, or where you have given your consent.

“Personal data” means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR), such as your name, e-mail address, telephone number or IP address.

4. Legal bases for processing

Where we obtain your consent for processing operations, Art. 6(1)(a) GDPR serves as the legal basis. Where processing is necessary for the performance of a contract or for taking steps prior to entering into a contract, Art. 6(1)(b) GDPR applies. Where processing is necessary to comply with a legal obligation, Art. 6(1)(c) GDPR applies. Where processing is necessary to protect our legitimate interests or those of a third party and your interests, fundamental rights and freedoms do not override those interests, Art. 6(1)(f) GDPR serves as the legal basis. Insofar as the storage of information on, or access to information already stored in, your terminal equipment is concerned, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG, formerly TTDSG) applies in addition.

5. Hosting and server log files

Our Website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (“Hetzner”), which processes personal data on our behalf as a processor pursuant to Art. 28 GDPR. The hosting servers are located in the European Union. Hetzner processes the data necessary to deliver and secure the Website (in particular access data and meta/communication data).

Each time the Website is accessed, our system automatically collects data and information from the accessing device’s computer system and stores it in so-called server log files. The following data may be collected:

• the IP address of the requesting device,
• the date and time of access,
• the name and URL of the file accessed,
• the website/URL from which access was made (referrer),
• the browser used and, where applicable, the operating system of your device as well as the name of your access provider.

The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR. Our legitimate interest lies in delivering the Website reliably, ensuring system security and stability, and enabling the technical administration of the network infrastructure. The log file data is stored separately from any other personal data and is generally deleted after 30 days, unless its retention is exceptionally required for a longer period in order to investigate a specific security incident, in which case it is deleted as soon as the incident has been conclusively resolved.

6. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this Website uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” prefix and the lock symbol in your browser’s address bar.

7. Cookies and consent

Our Website uses cookies and comparable technologies only to the extent necessary. Cookies are small text files that are stored on your device and do not cause any damage. The cookies we use are technically necessary to ensure the basic functions of the Website (for example a session identifier, a form anti-spam/security token or a load-balancing cookie). The legal basis for these is Art. 6(1)(f) GDPR and, in relation to the strictly necessary storage of, or access to, information on your terminal equipment, Section 25(2) no. 2 TDDDG (formerly TTDSG), under which no consent is required.

The Website does not currently use any non-essential or tracking cookies that would require your consent. The external map and video services described in Sections 10 and 11 are not loaded automatically; they are only loaded if you actively activate them, and the consent you give by activating them then serves as the legal basis for that loading (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). You can withdraw a consent given in this way at any time with effect for the future by not activating the respective content again and by deleting the cookies set in this context. You can also configure your browser to inform you about the setting of cookies, to allow cookies only in individual cases, to exclude the acceptance of cookies in certain cases or generally, and to enable the automatic deletion of cookies when the browser is closed.

8. Contacting us (contact form, e-mail and telephone)

You can contact us via the contact form provided on our Website, by e-mail or by telephone. If you use our contact form, the following data is processed: your name (mandatory), your e-mail address (mandatory), your telephone number (optional) and your message. In addition, for technical processing, spam prevention and to record the context of your enquiry, the following data is collected and stored together with your submission: the title and URL of the page from which the form was sent, the website from which you reached that page (referrer), the date and time of submission, and the IP address and browser/user agent of the device used.

The data you provide is used solely to process and respond to your enquiry. If your enquiry relates to a contract or pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR. In all other cases, the legal basis is our legitimate interest in receiving and responding to your enquiry pursuant to Art. 6(1)(f) GDPR.

We delete the data arising in this context once storage is no longer necessary, or restrict processing where statutory retention obligations apply. Enquiries from users are deleted no later than when the respective conversation with the user has ended and there are no statutory retention obligations to the contrary; the conversation has ended when it can be inferred from the circumstances that the matter concerned has been conclusively clarified.

9. Web analytics

To statistically analyse the use of our Website and to improve our offering, we use privacy-friendly, cookieless web analytics. We do not create cross-site user profiles and do not use this data to identify individual visitors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the needs-based design and statistical analysis of our Website.

Umami. We use Umami, a privacy-focused, cookieless web analytics tool. Umami does not set cookies and does not store or access information on your terminal equipment beyond what is technically necessary. It collects only aggregated, non-personal usage data such as the pages visited, the referring website, the approximate region or country, and the type of device, browser and operating system used; it does not store full IP addresses. As no non-essential cookies are used and the data is aggregated and not attributed to an identifiable person, no separate consent is required.

Independent Analytics. In addition, we may use Independent Analytics, which runs exclusively on our own server infrastructure and shares no data with third parties. It works without cross-site tracking cookies and does not store full IP addresses; IP addresses are processed only transiently and in shortened or anonymised form to determine the approximate geographic origin of a visit. The aggregated statistical data is retained for a maximum of 24 months and is then deleted or further aggregated so that no reference to a visit remains.

10. Google Maps

On our contact page we offer a map provided by Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The map is not loaded automatically when you open the page. Instead, a placeholder is displayed and the map is loaded only after you actively click to activate it. By activating the map you consent to the loading of the Google Maps content; this consent is the legal basis pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG (formerly TTDSG). When you activate and view the map, Google may collect and process information about your use of the Website, including your IP address, and transmit it to a Google server, which may be located in the United States (see Section 15). The use of Google Maps serves to present our location in an appealing manner and to make it easy for you to find us. You can withdraw your consent at any time with effect for the future by not activating the map again. Further information can be found in Google’s privacy policy at policies.google.com/privacy.

11. YouTube

On our Website we offer a video from the YouTube platform. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The video is not loaded automatically; a preview image is displayed and a connection to YouTube’s servers is established only after you actively click to play the video. By activating the video you consent to the loading of the YouTube content; this consent is the legal basis pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG (formerly TTDSG). Once you activate the video, the YouTube server is informed which of our pages you have visited, YouTube may store cookies on your device or use comparable technologies, and information including your IP address may be transferred to servers operated by Google, which may be located in the United States (see Section 15). You can withdraw your consent at any time with effect for the future by not activating the video again. Further information on data processing by YouTube/Google can be found at policies.google.com/privacy.

12. Website security and backups

To protect our Website against attacks, malware and unauthorised access, we use security software that maintains its own access and event logs. These logs may contain IP addresses and request data and are processed for the purpose of detecting, preventing and analysing security incidents. Security logs are generally retained for 30 days and then deleted, unless they are required for longer to investigate a specific incident, in which case they are deleted once the incident has been conclusively resolved. We also create regular backups of the Website in order to be able to restore data in the event of a malfunction or data loss; backups are kept on a rotating basis for up to 30 days and are then automatically overwritten. The legal basis for this processing is Art. 6(1)(f) GDPR; our legitimate interest lies in the security, integrity and availability of our Website and the data stored on it.

13. E-mail delivery

To reliably deliver the transactional e-mails generated by your use of the Website (in particular the notification and confirmation e-mails resulting from a contact enquiry), we use a transactional e-mail delivery function. The provider of this delivery function acts as a processor on our behalf pursuant to Art. 28 GDPR. The data required for delivery (in particular the e-mail address and the content of the message) is processed solely for the technically reliable and secure dispatch of these e-mails. This processing follows the legal basis of the underlying contact handling described in Section 8 (Art. 6(1)(b) GDPR for enquiries relating to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR, our legitimate interest being the reliable and secure delivery of transactional e-mail).

14. Recipients and processors

Within our organisation, only those persons and departments receive your personal data that need it to fulfil the purposes described above. We also use carefully selected service providers (processors) who support us in particular in the following categories: web hosting, transactional e-mail delivery, website security and backups, and the technical operation of the Website. These service providers process personal data exclusively on our documented instructions and on the basis of a data processing agreement pursuant to Art. 28 GDPR. In addition, the providers of the external content described in Sections 10 and 11 (Google) act as recipients where you activate that content. A transfer of data to other third parties takes place only where we are legally obliged to do so, where it is necessary for the performance of a contract, or where you have given your consent.

15. International data transfers

The controller is established in the People’s Republic of China, a third country for which the European Commission has not issued an adequacy decision under Art. 45 GDPR. Although our Website is hosted within the European Union, the personal data you submit to us — for example via the contact form, by e-mail or by telephone — is transferred to and processed in China, where it is accessible to the controller and its staff. This is the baseline situation for the personal data we handle and not merely a hypothetical possibility.

For this transfer of contact and enquiry data to China, we rely on Art. 49(1)(b) GDPR where the transfer is necessary to deal with a (pre-)contractual enquiry you have made, and otherwise on Art. 49(1)(a) GDPR where you have expressly consented to us handling your enquiry from China after having been informed of the risks. China does not provide a level of data protection equivalent to that of the EU, and we cannot rule out that public authorities in China may obtain access to the transferred data. Where we put in place separate appropriate safeguards within the meaning of Art. 46 GDPR (such as Standard Contractual Clauses concluded with our processors) for specific data flows, we will apply them.

The external services described in Sections 10 and 11 (Google Maps and YouTube), if you activate them, may transfer data to Google in the United States. For these transfers we rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework of 10 July 2023 (Art. 45 GDPR) where the recipient is certified under that framework, supplemented, where applicable, by the European Commission’s Standard Contractual Clauses (Art. 46 GDPR), and on your explicit consent given by activating the content pursuant to Art. 49(1)(a) GDPR.

You can request information about, and a copy of, the safeguards in place from us using the contact details in Section 1.

16. Storage period and erasure

We process and store your personal data only for as long as is necessary to achieve the purpose of storage, or for as long as provided for by statutory retention periods. The specific retention periods and criteria for the individual processing activities are stated in the relevant sections above (in particular Sections 5, 8, 9 and 12). After the purpose ceases to apply or upon expiry of any applicable statutory retention period, the corresponding data is routinely erased or its processing is restricted in accordance with the statutory provisions.

17. Your rights as a data subject

You have the following rights with regard to the personal data concerning you. To exercise your rights, you can contact us at any time using the contact details set out in Section 1. We will respond to any request to exercise these rights without undue delay and in any event within one month of receipt; this period may be extended by a further two months where necessary, taking into account the complexity and number of requests, in which case we will inform you within the first month.

• Right of access (Art. 15 GDPR): you have the right to obtain confirmation as to whether we process personal data concerning you and, if so, to receive a copy of that data and further information.
• Right to rectification (Art. 16 GDPR): you have the right to obtain the correction of inaccurate personal data and the completion of incomplete personal data.
• Right to erasure (Art. 17 GDPR): you have the right to obtain the erasure of your personal data where one of the grounds set out in the GDPR applies and no statutory retention obligation prevents erasure.
• Right to restriction of processing (Art. 18 GDPR): you have the right to obtain the restriction of processing under the conditions set out in the GDPR.
• Right to data portability (Art. 20 GDPR): you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller, where the processing is based on consent or a contract and is carried out by automated means.
• Right to withdraw consent (Art. 7(3) GDPR): where processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of processing carried out on the basis of the consent until withdrawal is not affected.
• Right to lodge a complaint (Art. 77 GDPR): you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR. As the controller is established outside the EU, the one-stop-shop mechanism does not apply, and you may contact the supervisory authority competent for your habitual residence, place of work or the place of the alleged infringement.

18. Right to object (Art. 21 GDPR)

Where we process your personal data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation, to this processing. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

19. Obligation to provide data

You are not under any statutory or contractual obligation to provide us with personal data. However, certain functions of our Website — in particular the use of our contact form — require you to provide the data marked as mandatory. If you do not provide this data, you will not be able to use the relevant function or we will not be able to respond to your enquiry.

20. Automated decision-making and profiling

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

21. Children

Our Website is directed at businesses and adults. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us so that we can delete the data.

22. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy so that it always complies with current legal requirements or in order to reflect changes to our services in the Privacy Policy, for example when introducing new services. The version current at the time of your visit applies.