Privacy & Cookie Policy

Overview

This policy explains how Koala Yupoo (“we”, “us”) handles personal information collected throughkoalayupoo.com. It covers the sourcing enquiry form, WhatsApp conversations, email, analytics, and the small amount of data stored in your browser.

We keep data collection narrow: what is needed to answer a sourcing enquiry, assess a project, and keep a record of the commercial relationship. We do not sell personal information, build advertising profiles, or add your contact details to a marketing list without a separate opt-in.

This site is an informational and sourcing service. It is not a marketplace and does not process payments. Do not send card numbers, bank credentials, or government identity documents through the form.

Who is responsible

Koala Yupoo is the controller for the personal information described in this policy. The project is operated as an independent editorial and sourcing service; it is not a Yupoo, WWTop, or marketplace entity. You can reach the privacy contact through the contact form (mark the message “Privacy”) or byWhatsApp.

A formal contracting entity, registered address, and any appointed representative are stated in a written sourcing agreement. If you need those details before entering an agreement, ask through the contact form and we will confirm them in writing.

Data we collect

Information you submit

Enquiry details: request type, product category, quantity band, destination country, target timeline, current sourcing stage, and the message you write.
Contact details: name, company name (optional), email address, and an optional phone or messaging handle.
Project files and references: a tech pack, specification, screenshot, or WWTop/Yupoo product link that you choose to share. Files are optional and may contain personal information if you include it.
Consent records: the version of the consent statement you accepted, the time of submission, and the page you came from.

Information collected automatically

Technical request data: IP address, user agent, referrer, and request time. We store a salted hash of the IP address for abuse prevention rather than the raw address where the deployment supports it.
Source parameters: a ref parameter or utm_content value if you arrived from a partner link, so we can understand which page or source produced an enquiry.
Analytics data: if analytics is enabled for the deployment, aggregated page views, approximate location, device type, referrer, and interaction events such as quote-start clicks. Analytics is configured with IP anonymisation where the provider supports it.

WhatsApp and email

If you contact us through WhatsApp, the message is handled by WhatsApp under its own terms and privacy policy. We receive your profile name, phone number, and the content you send. Email correspondence is held by our email provider. We treat both as part of the enquiry record.

How we use data

Answer your enquiry and decide whether the project is within scope.
Assess feasibility using the category, quantity, destination, and files you provide.
Prepare a quote or next step and keep a record of what was proposed and agreed.
Protect the service against spam, automated abuse, and fraudulent enquiries.
Improve the site by understanding which guides and calls to action are useful, in aggregate.
Meet legal and accounting obligations if a sourcing engagement becomes a contract.

We do not use your enquiry to send unrelated promotional email. If we ever introduce a newsletter, it will require a separate affirmative opt-in and will include an unsubscribe route.

Legal bases

Where UK or EU data protection law applies, we rely on the following bases:

Contract or pre-contract steps — to respond to a request you make and prepare a sourcing proposal.
Legitimate interests — to operate and secure the site, prevent abuse, and improve our service, balanced against your rights.
Consent — for optional analytics where consent is required, and for any future marketing you explicitly request. You can withdraw consent at any time.
Legal obligation — to retain records where tax, accounting, or other law requires it.

Cookies and local storage

This site does not set advertising or cross-site tracking cookies. Depending on the deployment, the following may be present:

Storage that may be used on this site
Name / type	Purpose	Duration
`_ga`, `_ga_*` (cookies)	Google Analytics 4 measurement, if a GA4 ID is configured for the deployment.	Up to 2 years, depending on configuration.
`__cf_bm` (cookie)	Cloudflare bot management and security. Set by the hosting provider when applicable.	Up to 30 minutes.
`koala-checklist:*` (local storage)	Remembers which supplier-check boxes you ticked so the checklist survives a page reload.	Until you clear browser storage or reset the checklist.
`__cf_turnstile` (cookie, if present)	Cloudflare Turnstile challenge state when the form protection is enabled.	Set by Cloudflare according to its challenge policy.

Local storage is used only for interface preferences such as checklist progress. It is not sent to us automatically. You can clear it through your browser settings.

If analytics is enabled and your jurisdiction requires prior consent, the deployment should be configured to obtain consent before loading the measurement script. You can also block or delete cookies in your browser; the site’s content remains readable.

We share data only where it is needed to operate the service or answer your request:

Cloudflare — hosting, content delivery, security, Pages Functions, D1 database, R2 attachment storage, and optionally Turnstile.
Email and notification providers — an email service may process the enquiry notification and any reply. The provider is configured by the site operator for the deployment.
Analytics providers — Google Analytics 4 or Cloudflare Web Analytics, if enabled. These receive technical and interaction data, not the content of your enquiry.
Suppliers in a live project — if you ask us to approach a factory, we may share the minimum specification needed to obtain a quotation. We do not send your contact details, files, or commercial terms to a factory without telling you.
Professional advisers and authorities — where required by law, to enforce our terms, or to protect rights and safety.

We do not sell personal information. We do not share enquiry data with a Yupoo seller, a catalogue operator such as WWTop, or an advertising network.

If you click a link to WWTop, Yupoo, WhatsApp, or another third-party site, that site may receive your IP address, referrer, and its own cookie or device data. Those sites are not controlled by us and their privacy policies apply. A partner link may include a ref or utm_content parameter so the destination can see that a visit came from this site; it does not send your enquiry form contents to that destination.

Retention

Enquiries that do not become a project: up to 24 months from the last contact, then deleted or anonymised.
Uploaded files: up to 12 months after the enquiry is closed, unless a live project requires them longer.
Live project records: retained for the duration of the engagement and for any period required by contract, tax, or accounting law.
Analytics: aggregated data follows the provider’s configured retention period (typically 14 months for GA4).
Security logs: short-lived, unless needed to investigate abuse.

Retention periods may be extended where a legal claim, dispute, or regulatory obligation requires it. When data is no longer needed, we delete it or reduce it to a form that cannot identify you.

International transfers

Our hosting and database providers operate globally. Your enquiry may be processed in a country other than your own, including the United States, the European Union, and the Asia-Pacific region. Where required, transfers rely on appropriate safeguards such as standard contractual clauses or an adequacy decision. The specific providers and regions depend on the deployment configured by the site operator.

Security

The site is served over HTTPS. Form submissions are validated, rate-limited, and optionally protected by a Turnstile challenge. Uploaded files are size- and type-limited. Database access is restricted to the application.

No system is perfectly secure. Do not send sensitive identity documents, bank credentials, or payment card details through the form. If you believe a message or file is compromised, contact us and stop using the affected channel.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal information, to object to processing based on legitimate interests, and to withdraw consent. You may also have the right to complain to a local data protection authority.

To exercise a right, use the contact form and put “Privacy request” in the message. We may need to verify that the request relates to you before acting. We will respond without undue delay and, where the right applies, within one month; complex requests may be extended by a further two months with notice. Exercising your rights is free, although we may charge a reasonable fee for manifestly unfounded or excessive requests.

If you are in the European Economic Area or the United Kingdom, you can contact your national supervisory authority. We would appreciate the chance to resolve the issue first.

Children

This site is a business sourcing service and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has submitted information, contact us and we will delete it.

Changes

We may update this policy when the service, providers, or legal requirements change. The effective date at the top of the page will change. Material changes that affect existing enquiries will be communicated through the contact details we hold, where practical.

Contact

For privacy questions, use the contact form and put “Privacy” in the message, or send aWhatsApp message. Because this is an independent, small operation, the fastest route is the form or WhatsApp. A formal contracting entity and postal address, if required for a sourcing agreement, are stated in that agreement; see Who is responsible.

This policy describes the current configuration of koalayupoo.com. Third-party services enabled by the site operator are governed by their own terms and privacy policies.