Your data stays yours.
We are a buyer-side quality practice, and the same discipline applies to the personal data you share with us: collected only where needed, used only for your enquiry, never sold.
The data controller at a glance
One legal entity runs this website and answers for the data it collects — no subsidiaries, no data brokers in between.
Steve Sourcing (Guangzhou) Limited, trading as Steve LightVerified, is the controller for personal data collected through this website. If anything in this policy is unclear, write to info@stevelightverified.com — the engineer who would run your project reads your message first.
Three channels, nothing hidden
There is no tracking infrastructure on this site, so the data we hold is data you deliberately sent us — plus the technical logs every web server keeps.
Contact form enquiries
When you write to us through the contact form, we receive what you typed: typically your name, work email, company, country and a description of your products, suppliers or quality issue.
Email and WhatsApp correspondence
Enquiries and project communication you send by email or WhatsApp are kept in our mailbox and, for active engagements, in the project archive.
Technical access logs
Like virtually every website, our hosting provider records technical access data (IP address, time, requested page) to keep the site available and secure. We do not use it for profiling.
Why we process it — and on what grounds
For clients and buyers in the EU, we map every processing purpose to a legal basis under the GDPR.
Hard rules, not preferences
These are structural commitments — the same independence rules that govern our sourcing work also govern your data.
Kept no longer than necessary
Short retention is a design principle, not an afterthought — our own deliverables are built with defined archive periods, and so is your data.
Enquiries that do not become projects are deleted within 12 months. Engagement records follow the retention periods agreed in the respective service agreement — our Order Archive Packs, for example, are kept for 24 months by design. Technical access logs are kept no longer than 90 days by the hosting provider.
Recipients are limited to our own engineers and, where an engagement requires it, the laboratories or logistics partners you approved in writing. We never transfer data to third parties for their own marketing.
Your rights under the GDPR
A short email to info@stevelightverified.com is enough. We answer within 24 hours on working days — the same response standard we promise for enquiries.
Access and information
You can ask what personal data we hold about you and receive a copy.
Rectification and erasure
You can have incorrect data corrected, and deleted where no legal obligation requires us to keep it.
Restriction and portability
You can request restricted processing, or a portable copy of the data you provided to us.
Objection
You can object at any time to processing based on legitimate interests.
Complaint
You can lodge a complaint with a data-protection supervisory authority, for example in your EU member state.
Talk to the person, not the privacy desk
No forms, no ticket system: data-protection questions reach the same engineers who handle the projects.
This policy is written to GDPR standards because most of our clients are based in the EU. It is reviewed whenever our data processing changes.
LAST REVIEWED: SEPTEMBER 2026 · STEVE SOURCING (GUANGZHOU) LIMITED