1. Who is responsible and how to contact us
SurgeGarlic is the business name of the operator of surgegarlic.com, who decides and is responsible for how website and inquiry information is used. Our business contact is based in Hangzhou, Zhejiang, China, with sourcing connections to Jinxiang, Shandong.
Email privacy questions or requests to info@surgegarlic.com, using the subject “Privacy request”. This policy covers visitors, inquirers and business contacts in our sourcing and trade activities.
2. Information we handle
- Inquiry details: company, contact name, email, country or market, product, quantity and specification; optional port, trade terms, timeframe, document requirements and notes; and quotation or sample preference.
- Related records: language, product, inquiry reference, submission and acknowledgement time, status, internal notes, correspondence and notification delivery status. The public form accepts text, not document uploads or payment card details.
- Business and supplier contacts: details from you, your organisation or relevant business sources, including job title, phone, email, WeChat or WhatsApp, quotes and communications. Authorised staff can store supplier documents in the restricted administration area, not through a public upload service.
- Technical information: hosting may process IP address, browser or user agent, requested address, referrer, time and security events. The application uses an IP-derived identifier to limit abuse and keeps session, error and administration records. This identifier is not fully anonymous.
Required fields enable submission and assessment. Optional fields can be left blank; email is an alternative. Do not include passwords, identity documents, bank details, sensitive personal information or confidential recipes in an initial inquiry. Only provide another person's details when entitled to do so.
3. Purposes and applicable grounds
We use information to respond, clarify requirements, prepare quotations, discuss samples and handle business communication and agreed transactions. We also protect forms and accounts, investigate misuse, keep backups and meet applicable legal obligations.
Where the GDPR or similar legal-basis rules apply, the basis depends on the purpose and relationship:
- Your personal pre-contract request or contract: necessary steps at your request or contractual necessity.
- Company-representative communication, sourcing records and security: legitimate interests in responding to requests, maintaining business relationships and preventing misuse, balanced against your interests and rights.
- Legally required records: the relevant legal obligation.
- Separate uses requiring consent: specific, withdrawable consent for that use.
Acknowledgement is not advertising consent. Inquiries are not automatically subscribed to marketing. We do not use automated profiling for decisions with legal or similarly significant effects. Security checks may restrict access; email us if you cannot submit an inquiry.
4. Cookies, browser storage and security checks
The cookie panel has three sections: Consent for your choice, Details for the registered storage items and their purposes and durations, and About for an explanation of cookies, browser storage and these controls. You can choose “Accept all”, “Necessary only” or review and save your settings.
Our application currently registers two necessary storage items, both provided by SurgeGarlic:
- surge_session: a first-party session cookie for form security, submission confirmation and administrator sign-in. Normally lasts for the browser session, subject to browser settings.
- surge-cookie-preferences: localStorage remembers your saved cookie choice, preference version, timing and category settings on this browser. A choice is valid for 180 days after saving; after expiry, the website asks again on your next visit. The browser entry may remain until it is replaced or cleared. It contains no inquiry and is not used for advertising tracking.
The optional Preferences, Analytics and Marketing categories each currently contain 0 items and are not in use. The record that remembers your cookie choice is part of the necessary controls, not an optional Preferences service. Website language comes from the page address; we do not set a separate language cookie or browser-storage preference. No Google Analytics, advertising pixels or marketing cookies are installed by the application.
Necessary functions remain active and cannot be switched off in this panel. All three optional categories stay off for every choice, including “Accept all”. Closing the notice does not enable optional services. A choice does not authorise future optional tracking; new purposes will need appropriate information and a fresh choice where required.
SiteGround provides hosting security and may show a CAPTCHA or other verification before the application loads, processing IP address and browser information separately from the inquiry form. That hosting layer may also use additional security cookies or browser checks. The two application records above are not a complete inventory of hosting-layer technologies. These controls do not switch off the host's security checks; names and lifetimes of any host-set cookies depend on its actual implementation.
Reopen Settings from the footer at any time to review or change your choice. You can also clear cookies and site storage through your browser. Blocking the session cookie can prevent submission or sign-in. Hosting access and security logs may still exist regardless of your choice.
5. Who may receive information
Authorised staff and technical support may access information as needed. SiteGround provides hosting, storage and security. Namecheap Private Email handles inquiry notifications to our business mailbox and other business correspondence.
Sharing with suppliers, laboratories, carriers or professional advisers for a sample or transaction is limited to what is needed, with further notice or permission where required. We may disclose information under a valid legal obligation. We do not sell inquiry information or share it for targeted advertising.
External links, including messaging and source credits, lead to services with their own privacy practices.
6. Processing in other countries
Business communication is handled from China. Hosting and email providers may process information in other countries. This can involve cross-border transfers, including access from China when you are elsewhere. Locations depend on the services in use.
Email us for information about relevant locations, recipients and safeguards. Transfer requirements depend on applicable law and the specific transfer. Website use or policy acknowledgement is not consent to unrestricted overseas use.
7. How long information is kept
Retention depends on active inquiries and relationships, quotation and transaction records, accounting or legal requirements, and unresolved complaints, security incidents or disputes. Information should be deleted or de-identified when no longer needed, subject to applicable obligations.
We do not promise automatic deletion after a fixed number of months. Deletion requests also need to consider mailboxes, exports and restricted backups. Removing an active record does not immediately remove every backup; retained copies are limited to necessary recovery and record-keeping purposes. Ask about your particular record.
8. Protection of information
We use HTTPS, authenticated administration and restricted storage for business records and supplier attachments, with backups for recovery. Access should be limited to the task. No transmission or storage is guaranteed completely secure; contact us about suspected exposure or misuse.
9. Your choices and requests
Depending on applicable law and circumstances, you may request access or a copy, correction, deletion, restriction or portability. You may withdraw consent where relied upon, without affecting earlier lawful processing.
You may object to legitimate-interest processing, including business contact or security, on grounds relating to your situation. You may object to direct marketing at any time.
Email info@surgegarlic.com from your inquiry address if possible, with the reference if available. We may request proportionate identity and record details; do not send identity documents unless needed and requested. We will respond within applicable legal deadlines and explain any lawful limits.
Where applicable, you may complain to a data protection authority, including the UK Information Commissioner's Office at ico.org.uk or your relevant EEA authority. You need not contact us first.
10. Children
This business sourcing website is for adults, not directed at children. We do not knowingly seek children's information. Contact us if you believe a child has provided it, so we can address it.
11. Updates
Effective date: 31 October 2026.
We may update this policy as services or practices change. The current version appears here. Material changes will be highlighted where appropriate, with separate notice or consent where legally required.