Privacy Policy
Effective date: November 2, 2026
Last updated: November 2, 2026
This Privacy Policy explains how Haisen Innovations Limited ("Haisen," "we," "us," or "our") collects, uses, shares, and protects personal data when you visit haisenaudio.com (the "Website"), send us an inquiry, or otherwise contact us.
The Website is designed for business buyers, such as brands, retailers, studios, cable builders, and AV integrators. Most of the personal data we receive is business contact information shared by people acting on behalf of their company.
1. Who we are
Haisen Innovations Limited is the controller of the personal data described in this policy.
| Legal entity | Haisen Innovations Limited, a trading company incorporated in Hong Kong |
| Registered address | Rm 102, 1/F, The Cloud, 111 Tung Chau Street, Tai Kok Tsui, Kowloon, Hong Kong |
| Company registration number | Company No. 78420197 (Hong Kong Companies Registry) |
| Privacy contact | privacy@haisenaudio.com |
2. Personal data we collect
2.1 Data you give us
Inquiry, quote, sample, and reorder forms. When you send a request through our contact forms, we collect:
Contact details: your name, email address, company or brand name, and country or region (required); and, if you choose to provide them, your website or store link, phone or WhatsApp number, whether you prefer to be contacted on WhatsApp, and your role.
Request details: the products you are interested in, estimated quantities, timeline, customization options, target unit price or budget range (optional), project location (for project requests), and any notes you write.
Attachments: files you upload, such as logos, sketches, drawings, spec sheets, or bills of materials (BOMs). Please do not upload files that contain personal data that is not needed for your request.
Additional details: information you add on our thank-you page to complete an inquiry you already sent.
Emails, WhatsApp messages, and other correspondence. The content of messages you send us and our replies. If you contact us by email, WhatsApp, or at a trade show, our sales team may enter your details into our system manually. Contacting us on WhatsApp is optional; you can always reach us through our forms or by email instead (see Section 5.2).
2.2 Data we collect automatically
When you submit a form, we also record:
Page and product context: the page and button you used, and the product and options you were viewing.
Source information: the address of the page on which you submit the form (without any query string), any campaign parameters (such as
utm_sourceorutm_campaign) and ad click identifiers (such asgclid,msclkid, orfbclid) in that address, and the address of the page you came from as reported by your browser (which may be another page of the Website), without any query string or fragment. If you have accepted analytics cookies, we also record the first page of your visit (landing page). In that case, the page you came from is the external page, if any, that brought you to the landing page (again without any query string or fragment), and the campaign parameters and ad click identifiers are those in the links you followed during your visit.Technical information: site language, browser language, device type (for example, mobile or desktop), and the time taken to complete the form.
Location and network information: the country associated with your IP address. We do not store your full IP address with your inquiry. We store only a salted, one-way hash of it, which we use for spam prevention and rate limiting.
Analytics identifier: your Google Analytics client ID, only if you have accepted analytics cookies.
When you browse the Website, we and our providers also process:
Security data: Cloudflare processes your IP address and request data to deliver the Website and protect it from attacks and abuse. Cloudflare Turnstile checks whether form submissions come from a real person.
Cookieless usage statistics: Cloudflare Web Analytics measures page views and page performance without cookies.
Analytics data: Google Analytics 4 collects usage data only after you accept analytics cookies. See our Cookie Policy.
Server logs: our application logs mask email addresses, phone numbers, and names, and do not record raw IP addresses or form contents.
2.3 Data from other sources
Public business information: to assess and route inquiries, we check whether the website you entered is reachable and whether your email domain can receive email. We may also look at your company's public website or online store to prepare a relevant quote.
Existing customer records: if you have contacted us before, we link your new inquiry to your existing contact and company record (see Section 4).
Colleagues: someone at your company may give us your business contact details as part of a project.
We do not ask for, and ask you not to send us, special categories of personal data (such as health data or data about racial or ethnic origin).
3. How we use your data and our legal bases
If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on the legal bases below under Article 6(1) of the GDPR and UK GDPR.
| Purpose | Personal data used | Legal basis |
|---|---|---|
| Respond to your inquiry, prepare quotes, arrange samples, and handle reorders | Contact details, request details, attachments, correspondence | Art. 6(1)(b) — steps taken at your request before entering into a contract, and performance of a contract |
| Follow up on quotes and samples; manage our business relationship with you and your company | Contact details, request details, correspondence, inquiry history | Art. 6(1)(f) — our legitimate interest in managing customer relationships and developing our B2B business |
| Prioritize and route inquiries (automated grading, Section 4); link repeat inquiries to the same contact and company; avoid duplicate records | Contact details, request details, country, website and email domain checks | Art. 6(1)(f) — our legitimate interest in responding efficiently and accurately |
| Measure campaign and channel performance (which pages and sources lead to inquiries) | Source information, page context | Art. 6(1)(f) — our legitimate interest in understanding which channels bring business inquiries (for the page on which you submit the form). Art. 6(1)(a) — your consent through our cookie banner (for the landing page kept in your browser during your visit) |
| Website analytics with Google Analytics 4 | Analytics cookies and usage data | Art. 6(1)(a) — your consent through our cookie banner |
| Cookieless performance statistics (Cloudflare Web Analytics) | Aggregated page-view and performance data | Art. 6(1)(f) — our legitimate interest in a fast, working website |
| Keep the Website and forms secure; prevent spam, fraud, and abuse; scan uploaded files for malware | IP address (processed transiently by Cloudflare), IP hash, country, Turnstile signals, form timing, attachments | Art. 6(1)(f) — our legitimate interest in protecting our systems and users |
| Comply with legal obligations, such as accounting and tax record-keeping for orders | Contact details, order records | Art. 6(1)(c) — legal obligation |
| Establish, exercise, or defend legal claims | Relevant records | Art. 6(1)(f) — our legitimate interest in protecting our legal rights |
3.1 Inquiries do not require your consent
We process inquiries because you asked us to respond, not on the basis of consent. That is why our forms show a short privacy notice instead of an "I agree" checkbox.
3.2 Legitimate interests
Where we rely on legitimate interests, we have balanced them against your rights. We limit the data we use, and you can object at any time (Section 8). You can ask us for more information about this balancing test.
3.3 If you do not provide data
Required form fields are needed to respond to your request. If you do not provide them, we may not be able to send a quote or sample. Optional fields are optional; leaving them blank does not stop us from replying.
3.4 Marketing emails
We do not currently send newsletters or other marketing emails. Sending an inquiry does not add you to a mailing list. If we start offering product updates by email, we will ask for your separate consent and update this policy first.
4. Automated inquiry grading
To reply to the most time-sensitive requests first, our system automatically gives each inquiry a score and a priority grade (A, B, or C). The score is based on signals such as:
whether you provided a website, and whether your email domain matches it;
whether you used a business email domain;
your country or region;
the quantity, timeline, and level of detail in your request (for example, whether you attached files);
whether you provided a phone or WhatsApp number, your role, or a target price.
Negative signals include an email domain that cannot receive email, test or nonsense entries, and messages that look like sales pitches from other suppliers. Submissions that look like spam may be held for human review instead of being processed automatically.
What grading does and does not do:
It only affects how quickly we reply and who on our team handles your request.
We reply to every genuine inquiry, whatever its grade. Small quantities and free email addresses do not lower your score.
Our team can review and change any grade, and every change is recorded.
Grading does not produce legal effects or similarly significant effects on you. It is therefore not automated decision-making within the meaning of Article 22 of the GDPR.
You can ask us how your inquiry was graded, ask a person to review it, or object to this processing (Section 8).
5. Who we share your data with
We do not sell your personal data. We share it only with the service providers and recipients below, and only as needed for the purposes in Section 3.
5.1 Service providers and email recipients
| Recipient | What they do for us | Role | Where data is processed |
|---|---|---|---|
| Cloudflare, Inc. | Website hosting and content delivery; our inquiry database (Cloudflare D1); private file storage for attachments (Cloudflare R2); malware scanning of uploads; Turnstile bot protection; Web Analytics; security and rate limiting; email routing for our @haisenaudio.com addresses (Cloudflare Email Routing forwards incoming messages and does not store them) | Processor | Cloudflare is a US company with a global network. Our primary database and attachment storage are located in Western Europe (location hint weur). Network traffic may be processed at Cloudflare data centers worldwide, including the United States |
| Resend | Sends our system emails from notify@haisenaudio.com (inquiry confirmations and internal notifications) and the replies our sales team sends from @haisenaudio.com addresses; records delivery events (delivered, bounced, complaint) | Processor | United States (AWS North Virginia, us-east-1) |
| Google (Gmail) | Email service for our sales inbox. Messages sent to our @haisenaudio.com sales addresses, including your replies to our emails, are delivered to this inbox. It also receives our internal inquiry notification emails, which contain only a short summary and a link to our admin system (see below) | Google's terms. Google provides Gmail under the Google Terms of Service and processes these emails as described in the Google Privacy Policy (policies.google.com/privacy) | United States and other countries where Google operates data centers |
| Google (Google Analytics 4) | Website analytics, only after you accept analytics cookies. Google Signals and ad personalization are turned off | Processor | United States and other countries where Google operates |
How we limit what reaches email inboxes. Our internal notification emails contain only a short summary of your request and a link to our secure admin system. They do not include your name, email address, phone number, company, message text, or attachments. We handle inquiries mainly in our admin system, which is protected by access controls and two-factor authentication. However, when you reply to our emails, or email one of our addresses directly, your message and anything in it, including attachments, is forwarded to the Gmail inbox described above. We do not forward inquiry-related emails to any other email service.
5.2 Other recipients
Our team: staff of Haisen Innovations Limited who need the data to handle your request. Our staff sign in to our admin system and handle inquiries from Hong Kong.
Our manufacturing partners in Guangdong, China: we share technical requirements, specifications, and artwork you provide so they can assess feasibility and produce samples or orders. We do not provide your personal data to our manufacturing partners.
Couriers and logistics providers: if we ship samples or goods to you, we share the delivery contact details needed for shipment with carriers such as DHL, FedEx, or UPS, or a courier or freight forwarder you nominate (including your own courier account).
WhatsApp: WhatsApp is an optional channel that you choose to use. We use the WhatsApp Business App. If you message us on WhatsApp, WhatsApp (Meta) processes those messages as an independent controller under its own terms and privacy policy, not on our behalf. Our team can read and reply to your messages in the app and may copy relevant details into our admin system to handle your request.
Professional advisers: lawyers, accountants, and auditors, under confidentiality duties.
Authorities: courts, regulators, or law enforcement, where required by law.
Business transfers: a buyer or successor if our business is reorganized, sold, or merged, subject to this policy.
6. International data transfers
Haisen Innovations Limited is based in Hong Kong, and our staff access our admin system and handle inquiries from Hong Kong. Our service providers operate in other countries, including the United States. These countries may not provide the same level of data protection as your home country, and the European Commission has not issued an adequacy decision for Hong Kong.
Where the GDPR or UK GDPR applies, we use the following safeguards:
| Destination / recipient | Safeguard |
|---|---|
| Hong Kong — Haisen Innovations Limited (staff handling inquiries in Hong Kong) | You send your inquiry directly to us, a company in Hong Kong. Where the GDPR or UK GDPR applies, it applies directly to how we handle your data, so we do not use a separate transfer mechanism for data you send us. Hong Kong does not have an EU or UK adequacy decision. We handle your data as described in this policy, and protect it with the measures in Section 11, wherever it is stored or accessed |
| United States — Cloudflare | Cloudflare's Data Processing Addendum, which forms part of our agreement with Cloudflare and incorporates the EU Standard Contractual Clauses and the UK Addendum. Cloudflare is also certified under the EU-U.S. Data Privacy Framework |
| United States — Resend | Resend's Data Processing Agreement (resend.com/legal/dpa). Resend is certified under the EU-U.S. Data Privacy Framework and the UK Extension |
| United States — Google (Google Analytics) | Google Ads Data Processing Terms accepted in our Google Analytics account, incorporating the Standard Contractual Clauses. Google LLC is certified under the EU-U.S. Data Privacy Framework |
| United States — Google (Gmail) | Gmail is provided by Google LLC. Google LLC states that it complies with the EU-U.S. Data Privacy Framework and the UK Extension (policies.google.com/privacy/frameworks), and we rely on this for emails that reach our sales inbox. To limit what reaches this inbox, our notification emails contain only a summary and a link (Section 5.1), and emails are deleted on the schedule in Section 7 |
You can request a copy of the safeguards we use by contacting privacy@haisenaudio.com. We may redact commercially sensitive terms.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Genuine inquiries, related attachments, and inquiry history | 36 months from our last contact with you (your most recent inquiry, or our most recent follow-up on your inquiries, whichever is later), then anonymized. All of your inquiries are anonymized together, and attachments are deleted at that point |
| Submissions automatically flagged as spam | Deleted after 30 days. All other submissions, including those we mark as invalid (such as tests or duplicates), are kept on the same schedule as genuine inquiries |
| Submissions held for spam review | Deleted after 30 days unless released as genuine |
| Incomplete file uploads (files uploaded without a submitted form) | Deleted after 2 days |
| Emails with you in our sales inbox (Gmail) | Deleted manually. At least every 6 months, we delete emails that are more than 36 months old, unless they form part of an order record (next row) |
| Customer and order records (if you place an order) | 7 years after the end of the financial year in which the order was completed, as required by Hong Kong tax and company record-keeping law (Inland Revenue Ordinance, Cap. 112, s. 51C; Companies Ordinance, Cap. 622, s. 377) |
| Google Analytics data | 14 months |
| Application logs (masked, no raw IP) | 7 days in live logs; up to 1 year in archived logs |
| Database backups | Up to 90 days. Data deleted from the live database is removed from backups as they expire |
If an email to you bounces or you mark it as spam, we keep a one-way fingerprint of your address (not the address itself) on a suppression list so that we do not email it again. We keep this fingerprint even after your other data is anonymized or deleted, because we need it to respect that outcome, and we treat it as personal data.
We may keep data longer if the law requires it or if we need it to establish, exercise, or defend a legal claim.
8. Your rights
8.1 Rights under the GDPR and UK GDPR
Depending on where you are, you have the right to:
Access the personal data we hold about you and receive a copy.
Correct inaccurate or incomplete data.
Delete your data, where there is no longer a valid reason to keep it.
Restrict our use of your data in certain circumstances.
Object to processing based on our legitimate interests, including follow-up and inquiry grading. You can always object to direct marketing, and we will stop.
Data portability: receive data you provided to us in a structured, machine-readable format, where processing is based on contract or consent.
Withdraw consent at any time, for example by changing your choices through the Cookie settings link in the footer. Withdrawal does not affect processing that happened before.
Request human review of your inquiry grade (Section 4).
Complain to a data protection supervisory authority, in particular in the country where you live or work, or where an alleged infringement took place. In the UK, this is the Information Commissioner's Office (ICO). We would appreciate the chance to address your concern first: you can send a complaint to privacy@haisenaudio.com, and we will acknowledge it within 30 days.
8.2 Hong Kong
Under the Personal Data (Privacy) Ordinance (Cap. 486), you may request access to and correction of your personal data. Please send your request to our privacy contact at privacy@haisenaudio.com, or by post to the address in Section 15. We will comply with data access and correction requests within 40 days of receiving them. We do not charge a fee for data access requests. We do not use your personal data for direct marketing without your consent (Part 6A of the Ordinance). You may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong.
8.3 How to exercise your rights
Email privacy@haisenaudio.com and tell us which right you want to exercise. We may ask you to confirm your identity, usually by replying from the email address you used with us. We respond within one month. If your request is complex, we may extend this by up to two more months and will tell you why.
We do not charge for requests unless they are clearly unfounded or excessive, as permitted by law.
9. Notice for California residents
Based on our size and business activities, we do not believe that the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), currently applies to us. We still want California residents to know how we handle their personal information:
What we collect and why: see Sections 2 and 3. We disclose personal information only to the recipients described in Section 5.
No sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising. We do not knowingly sell or share personal information of consumers under 16.
Sensitive personal information. We do not collect sensitive personal information as defined by the CCPA.
Retention: see Section 7.
Requests. You can ask us what personal information we hold about you, and ask us to correct or delete it. You can make requests by email to privacy@haisenaudio.com. We will not discriminate against you for making a request.
Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a rejection of analytics cookies, and Google Analytics does not load in that browser.
10. Children
The Website is intended for business users. It is not directed to children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, contact privacy@haisenaudio.com and we will delete it.
11. How we protect your data
We use technical and organizational measures appropriate to the risk, including:
encryption in transit (HTTPS) for the Website and our admin system;
an admin system protected by Cloudflare Access and two-factor authentication, with role-based access and audit logs;
private, non-public storage for attachments, with time-limited download links and malware scanning;
storing a hash instead of your full IP address, and masking personal data in logs;
internal notification emails that contain only a summary and a link, not your contact details;
regular backups and tested recovery procedures.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Protect yourself from payment fraud. We will never ask you to pay to a new bank account by email. Before making a payment, always confirm our bank details with us by phone or WhatsApp, using a number you already know or the number on our Website, not one given in the same email.
12. Cookies
We use strictly necessary cookies and similar technologies to run and secure the Website. We use analytics cookies only with your consent. For details and to change your choices, see our Cookie Policy or use the Cookie settings link in the footer of every page.
13. Links to other websites
The Website may link to third-party websites and services, such as WhatsApp or social media platforms. Their privacy practices are governed by their own policies.
14. Changes to this policy
We may update this policy when our services, providers, or legal requirements change. We will post the updated version on this page and change the "Last updated" date. If changes are significant, we will take reasonable steps to let you know, for example by a notice on the Website.
15. Contact us
For any questions about this policy or your personal data:
Email: privacy@haisenaudio.com
Post: Haisen Innovations Limited, Rm 102, 1/F, The Cloud, 111 Tung Chau Street, Tai Kok Tsui, Kowloon, Hong Kong