Privacy Policy
How XTALSTORE collects, uses and protects personal data when you browse our catalogue, request a quotation or place an order.
This policy explains what personal data we collect, why we collect it, who we share it with and what rights you have. It applies to xtalstore.com and to any quotation, order or support conversation that follows from it. It does not cover data we process on your behalf as a processor, for example where you send us a customer list to fulfil a drop-ship order.
1. Who is responsible for your data
XTALSTORE Frequency Products Ltd. is the data controller for the personal data described in this policy. Our registered details are:
- Registered name
- XTALSTORE Frequency Products Ltd.
- Registered office
- Unit 1203, Block B, Xinghe Technology Park, Bao’an District, Shenzhen 518101, China
- Company registration
- 91440300MA5F2K7X8Q (Shenzhen)
- VAT / tax ID
- CN 91440300MA5F2K7X8Q
- Telephone
- +86 755 8823 6600
- General enquiries
- sales@xtalstore.com
- Privacy & legal
- privacy@xtalstore.com
- EU representative
- XTALSTORE Europe B.V., Keizersgracht 241, 1016 EA Amsterdam, Netherlands
- UK representative
- XTALSTORE UK Ltd., 71-75 Shelton Street, London WC2H 9JQ, United Kingdom
We have not appointed a statutory data protection officer, because our processing does not meet the threshold for mandatory appointment. Privacy questions and requests are handled by our compliance team at privacy@xtalstore.com.
2. The data we collect
We collect only what we need to quote, ship and support the parts you buy from us.
Data you give us
- Identity and contact data: name, company, job title, work email, telephone, billing and delivery addresses.
- Account data: login credentials for the customer portal, saved addresses, order history and tax exemption certificates.
- Transaction data: part numbers, quantities, prices, purchase order references, payment status and shipping records.
- Communication data: quotation requests, RFQs, technical questions, complaints, RMA forms and the content of emails or web form messages.
- Compliance data: end-use declarations, export control screening results and, for credit accounts, company registration and trade references.
Data we collect automatically
- Technical data: IP address, browser type and version, device type, operating system, referring URL and pages viewed.
- Usage data: search terms entered in the part-number search, product pages visited and datasheet downloads.
- Cookie data: see our Cookie Policy for the full list, purposes and retention periods.
Data we do not collect
We do not store full card numbers. Card payments are processed by our payment provider, which returns only a token, the card brand and the last four digits. We never ask for passwords by email, and we do not buy contact lists from third-party brokers.
3. Why we use your data, and on what legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Responding to quotation requests and technical enquiries | Identity, contact, communication | Steps taken at your request before entering a contract (1)(b) |
| Processing orders, deliveries and invoices | Identity, contact, transaction | Performance of a contract (1)(b) |
| Managing warranty claims, returns and RMA | Identity, transaction, communication | Performance of a contract (1)(b) |
| Keeping accounting and tax records | Identity, transaction | Legal obligation (1)(c) |
| Export control and sanctions screening | Identity, company, destination, end use | Legal obligation (1)(c) |
| Fraud prevention and credit assessment | Identity, company, transaction, credit data | Legitimate interests (1)(f) |
| Improving the catalogue, search and site performance | Technical, usage | Legitimate interests (1)(f) |
| Sending product-change notices and technical bulletins | Identity, contact, order history | Legitimate interests (1)(f), or consent where required |
| Marketing emails about new product families | Identity, contact, consent record | Consent (1)(a) – opt-in only, withdrawable at any time |
Where we rely on legitimate interests we have carried out a balancing assessment and concluded that our interest in operating and improving a B2B component supply business does not override your rights. You may ask us for a summary of that assessment at any time.
4. Who we share data with
We do not sell personal data. We share it only with the parties needed to run our business, under written contracts that restrict them to acting on our instructions:
- Payment providers and acquiring banks, for card and bank transfer processing.
- Carriers and freight forwarders (DHL, FedEx, UPS, SF Express), for delivery and customs clearance.
- Our ERP, hosting and email infrastructure providers, including our content delivery and backup providers.
- Analytics providers, where you have consented to analytics cookies.
- Professional advisers: auditors, insurers, customs brokers and debt recovery agents.
- Authorities, where we are required by law to disclose, including customs, tax and export control authorities.
- A successor entity, in the event of a merger, acquisition or transfer of the business, subject to equivalent protection.
5. International transfers
Our principal systems are operated from the European Union and the United States, and our manufacturing and logistics teams are based in China. Where personal data leaves the European Economic Area or the United Kingdom, we rely on an adequacy decision or on the European Commission’s Standard Contractual Clauses, supplemented by a transfer impact assessment and, where appropriate, additional technical measures such as encryption in transit and at rest.
6. How long we keep data
| Record | Retention period |
|---|---|
| Quotation requests that do not become orders | 24 months from the last contact |
| Sales orders, invoices and shipping documents | 10 years, to meet tax and traceability obligations |
| Warranty and RMA records | 10 years from shipment, matching lot traceability |
| Customer account details | Duration of the account plus 24 months |
| Marketing consent records | Until consent is withdrawn, plus 3 years as proof |
| Website analytics data | 14 months, in aggregate form |
| Export control screening results | 5 years from the transaction |
7. Your rights
Subject to local law, you have the right to:
- Access the personal data we hold about you and receive a copy.
- Correct data that is inaccurate or incomplete.
- Erase data where we no longer have a lawful reason to keep it.
- Restrict or object to processing based on legitimate interests, including direct marketing.
- Receive your data in a portable, machine-readable format.
- Withdraw consent at any time, without affecting processing carried out before withdrawal.
- Lodge a complaint with your local supervisory authority.
To exercise any of these rights, email privacy@xtalstore.com from the address associated with your account, or write to us at the registered office above. We respond within one month; where a request is complex we may extend that period by two further months and will tell you if we do.
California residents
If you are a California resident, you have the right to know what personal information we collect, to request its deletion or correction, to opt out of its sale or sharing, and not to be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioural advertising. Requests may be made through the same channels described above; we will verify your identity before acting.
8. Cookies and tracking
We use strictly necessary cookies to run the shopping cart and checkout, and optional analytics and marketing cookies only where you have accepted them through our consent banner. You can change your choice at any time from the Cookie settings link in the footer. A full list of cookies, their purpose and their duration is set out in the Cookie Policy.
9. Security
We protect personal data with TLS encryption in transit, encryption at rest for our databases and backups, role-based access control, multi-factor authentication for administrative accounts, and logging of privileged access. Access to order and customer records is limited to staff who need it to fulfil an order or answer a query. If a personal data breach is likely to result in a risk to your rights, we will notify the relevant authority within 72 hours and inform affected individuals without undue delay where the risk is high.
10. Children
Our website and services are directed at businesses and engineering professionals. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
11. Changes to this policy
We review this policy at least once a year and whenever we change our systems or suppliers in a way that affects personal data. Material changes are announced on this page with a new effective date, and where the change affects an active customer relationship we will also notify the account contact by email.