Version: 1.1
Version date: 14 October 2026
Effective date: 14 October 2026
Introduction
Thank you for visiting the GUROBOT website. This Privacy Policy explains how Shenzhen GUROBOT Technology Co., Ltd. ("GUROBOT", "we", "us") collects, uses, shares, transfers and safeguards personal information when you visit our website, including our Home, Xiaogu Cloud Platform, Products, Business Cooperation and About pages, and when you submit a business enquiry through the Business Cooperation page.
Please read this policy before you use our website and, in particular, before you submit the enquiry form.
Scope. This policy applies to our website. It does not apply to the smart devices, the Xiaogu Cloud services or any consumer-facing application operated by our business customers. Where our customers sell or operate those products, our customers are generally the controller (or the personal information handler equivalent) of the end-user data and we act only as a processor on their documented instructions under a data processing agreement (see the Children's Privacy section below).
Language. This policy is issued in Chinese and English. In the event of any inconsistency between the two versions, the
1. Who we are
For the purposes of the EU and UK General Data Protection Regulation (GDPR / UK GDPR), we are the controller of the personal data collected through this website.
| Legal entity | Shenzhen GUROBOT Technology Co., Ltd. (深圳市云希谷科技有限公司) |
| Registered / postal address | 34F, Haofang Tianji Plaza, No. 11008 Beihuan Avenue, Nanshan District, Shenzhen, Guangdong Province, People's Republic of China |
| Business enquiries | BD@gurobot.com / +86 137 5119 5479 |
| Privacy enquiries | BD@gurobot.com |
Data protection officer. We have not appointed a data protection officer. If we do so, we will update this policy and publish their contact details. In the meantime, privacy enquiries can be sent to the address above.
2. Information we collect
We follow the principles of lawfulness, fairness, transparency and data minimisation and collect only what is necessary for the purposes described below.
2.1 Information you give us — Business Cooperation enquiry form
When you complete and submit the enquiry form on our Business Cooperation page, we collect the following fields:
| Field | Description | Required? |
|---|---|---|
contact_name | Your name or preferred form of address | Required |
phone | Telephone number | Required |
work_email | Work email address | Required |
company_name | Company name | Required |
cooperation_type | Cooperation model (e.g. OEM / ODM / solution licensing) | Required |
target_product | Product model(s) of interest | Optional |
est_volume | Estimated annual volume | Optional |
project_notes | Free-text description of your project | Optional |
page | The page path from which the form was submitted | Recorded automatically |
lang | The language version you were browsing | Recorded automatically |
submitted_at | Date and time of submission | Recorded automatically |
IP | Your IP address at the time of submission | Recorded automatically |
Please do not include information in the free-text fields that is irrelevant to your business enquiry, and in particular do not include government identifiers, bank or payment account details, health or biometric data, religious beliefs, precise location data, or personal information about anyone other than yourself. If such information is genuinely required, please contact us separately so we can agree secure handling of it.
2.2 Information collected automatically
When you browse the website we automatically collect:
- Device and browser information — IP address, browser type and version, operating system and version, device type, screen resolution and browser language setting;
- Access logs — time of access, pages visited, referring URL, HTTP status codes, approximate network operator region;
- Performance and interaction statistics — page load timings, resource errors and interaction events used to improve the site ;
- Cookies and local storage — see section 4.
2.3 What we do not collect
- We do not knowingly collect personal data directly from children through this website (see Children's Privacy below);
- We do not collect special category personal data (Article 9 GDPR) or sensitive personal information (CCPA/CPRA) through this website. The enquiry form fields are not sensitive personal information;
- We do not serve interest-based advertising through this website, and we do not build advertising or marketing profiles.
3. Why we process your information and our legal bases
| Purpose | Categories of personal data | Legal basis |
|---|---|---|
| To respond to your business enquiry, contact you and discuss requirements | Name, telephone, work email, company, project notes | Steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR); and/or our legitimate interests in operating our B2B business (Art. 6(1)(f)) |
| To prepare solutions and quotations, match engineering samples and assess feasibility | As above, plus cooperation model, target product, estimated volume | Art. 6(1)(b) and/or Art. 6(1)(f) |
| To manage the customer relationship and follow up on the opportunity | As above | Art. 6(1)(f) |
| To display the site, maintain sessions and remember your language preference | Cookies / local storage identifiers, language setting | Strictly necessary cookies: Art. 6(1)(f). Non-essential cookies: your consent (Art. 6(1)(a)) |
| To keep the site and our servers secure and prevent scraping, abuse and attacks | IP address, access logs, device information | Our legitimate interests (Art. 6(1)(f)) and compliance with legal obligations (Art. 6(1)(c)) |
| To improve site performance and the browsing experience and produce aggregated statistics | Performance and interaction data | Your consent for non-essential cookies/statistics technologies (Art. 6(1)(a)); legitimate interests for aggregate measurement where permitted |
| To retain network logs and respond to lawful requests from authorities | Access logs, IP | Compliance with legal obligations (Art. 6(1)(c)); legitimate interests in establishing or defending legal claims |
Legitimate interests. Where we rely on legitimate interests, we have balanced our interests against your interests, rights and freedoms. You may ask us for information about that assessment by writing to the address in section 14.
Consent for the enquiry form.
We will not use your personal data for a purpose that is incompatible with the purposes above. If we intend to use it for a new purpose, we will update this policy and, where required, seek your consent.
4. Cookies and similar technologies
Cookies are small text files placed on your device. We use the following categories:
| Category | Purpose | Examples | Approximate lifespan |
|---|---|---|---|
| Strictly necessary | Maintaining sessions, remembering your selected language (local storage), preventing cross-site request forgery, basic rate limiting | Language key, security tokens | Session cookies expire when you close your browser; language preference stored for up to 12 months |
| Analytics / performance | Counting page views and time on site, detecting resource load errors, helping us improve the site | Processed by us | Up to 13 months |
Strictly necessary cookies are required for the site to function and generally cannot be switched off. Where we enable analytics or other non-essential technologies, we will notify you and, where required, obtain your consent.
You can refuse or delete cookies through your browser settings. Please note that refusing cookies may prevent parts of this website from working properly, including language preference and submission of the enquiry form.
Do Not Track / Global Privacy Control.
5. Who we share your information with
5.1 We do not sell your personal information
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act as amended ("CCPA"). We do not disclose personal information to any third party for that third party's own marketing purposes. Information you submit through the enquiry form is used solely for business communications with you, preparing solutions and quotations, matching engineering samples and managing the resulting customer relationship.
5.2 Recipients
| Recipient | Role | Purpose | Note |
|---|---|---|---|
| Our hosting and cloud infrastructure provider | Processor | Hosting the website, running the backend services and database | |
| DingTalk Yida (钉钉宜搭) business opportunity management system | Processor | Recording and managing sales leads internally | Submitted form data is written to our own database and synchronised into our internal DingTalk Yida lead form |
| DingTalk group robot notifications and internal email | Internal routing channel | Real-time notification of a new enquiry to our staff | Data remains within our control and is not disclosed to any third-party marketing platform |
| Our professional advisers (lawyers, accountants, auditors) | Processor | Access only where necessary for disputes, compliance or audit | |
| Government or regulatory authorities with statutory powers | Independent legal recipient | Responding to lawful supervision, inspection or investigation requests | We verify the legality and scope of each request |
Our processors act only on our documented instructions and may not process personal data for their own purposes. We require our processors to process personal data only within the scope we instruct and not for their own purposes.
Beyond the above, we will not disclose your personal data to other recipients without notifying you of the recipient's identity and the purposes involved, and obtaining any consent or separate agreement required by law.
6. International data transfers
We are established in the People's Republic of China and personal data collected through this website is stored and processed primarily in mainland China.
For data subjects in the EEA, UK or Switzerland. If you choose to contact us from outside mainland China, your information will be transferred to and processed in China. China is not currently the subject of an adequacy decision by the European Commission or the UK government. Where Chapter V of the GDPR or the UK GDPR applies to an onward flow of personal data outside the EEA or UK — for example where one of our processors or their sub-processors is located in another country — we rely on appropriate transfer safeguards, including:
- the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914);
- for the UK, the International Data Transfer Agreement or the Addendum to the EU Standard Contractual Clauses issued under Article 46(2)(d) UK GDPR;
in each case supported by a transfer risk assessment and any supplementary technical or organisational measures that are appropriate in the circumstances. You may request a copy of the relevant safeguards by writing to us at the address in section 14.
Where we transfer personal data out of the People's Republic of China (which we do not do for website data at present) , we will comply with the applicable requirements of the PRC Personal Information Protection Law, including separate consent, one of the statutory transfer mechanisms (security assessment, personal information protection certification or the PRC standard contract) and the accompanying notice requirements, none of which we represent as completed unless and until they have been.
7. How long we keep your information
We keep personal data only for as long as is necessary for the purposes set out in this policy, and longer where required by law or necessary for the establishment, exercise or defence of legal claims.
| Category | Retention period |
|---|---|
| Business enquiry / contact information submitted via the form | 24 months from our last substantive interaction with you. If we go on to enter a business relationship, retained for the duration of the relationship and for 36 months afterwards. |
| Server and access logs | At least six months (a statutory minimum under PRC law), typically retained for 6 to 12 months |
| Cookies / local storage | See the table in section 4; you may also clear these yourself in your browser at any time |
| Records needed for dispute resolution, audit or regulatory inspection | Until the relevant matter is finally resolved |
Once the retention period expires, we delete the personal data (including from the DingTalk Yida lead form) or anonymise it. Anonymised data cannot be linked back to an individual and may be retained and used for statistical purposes to improve our website and products.
8. Security
We implement commercially reasonable technical and organisational safeguards designed to protect your personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, including:
- Encryption — HTTPS encryption in transit for the whole site, together with encryption or pseudonymisation appropriate to the data at rest;
- Access control — least-privilege access to enquiry data limited to personnel with a business need, with access logging and periodic review;
- Network and system protection — firewalls, hardening, monitoring and timely vulnerability remediation for internet-facing services;
- Governance — internal policies, data classification, and privacy and security training for staff;
- Vendor management — assessment of processor security and contractual security obligations;
- Resilience — backups appropriate to the criticality of the data, together with an incident response plan;
- Assessment — privacy impact assessments and periodic security reviews where appropriate to the activity.
While no method of transmission or storage can be guaranteed to be completely secure, and we therefore make no absolute guarantee of security, we work within these measures to reduce risk to a reasonable level.
Incident notification. If a personal data breach occurs or is likely to occur, we will activate our response plan, take appropriate remediation steps and notify the competent supervisory authority and, where required, the affected individuals without undue delay where the breach is likely to result in a risk to their rights and freedoms. Where individual notice would involve disproportionate effort, we may instead issue a public notice.
9. Automated decision-making
We do not use the information collected through this website to make decisions about you based solely on automated processing that would produce legal effects or otherwise significantly affect you, and we do not carry out profiling for marketing purposes through this website.
10. Your rights
10.1 If you are in the EEA, the UK or Switzerland
Subject to the conditions and exceptions in the GDPR / UK GDPR, you have the following rights:
| Right | What it means |
|---|---|
| Access (Art. 15) | Obtain confirmation of whether we process your data and receive a copy of it |
| Rectification (Art. 16) | Have inaccurate data corrected and incomplete data completed |
| Erasure (Art. 17) | Have your data deleted where one of the statutory grounds applies |
| Restriction (Art. 18) | Require us to restrict processing in certain circumstances |
| Portability (Art. 20) | Receive data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible |
| Object (Art. 21) | Object to processing based on legitimate interests, including profiling carried out on that basis |
| Withdraw consent (Art. 7(3)) | Withdraw consent at any time; this does not affect processing carried out before withdrawal |
| Not be subject to solely automated decisions (Art. 22) | Not be subject to a decision based solely on automated processing with legal or similarly significant effects |
| Complain (Art. 77) | Lodge a complaint with your national supervisory authority or, in the UK, the Information Commissioner's Office |
How to exercise your rights. Please write to us at the address in section 14. We will verify your identity before acting. We aim to respond within one month of receipt; where your request is complex we may extend this by up to two further months and will tell you why. We do not charge a fee unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse as permitted by law.
Complaints. We would appreciate the chance to address your concerns first, and you can contact us at any time. You also have the right to complain directly to your local supervisory authority.
10.2 If you are a California resident
Categories collected (last 12 months). We collected: (a) identifiers, such as your name, telephone number, work email address, company name and IP address; (b) commercial information, such as the cooperation model, target product and estimated annual volume you indicate; and (c) internet or other electronic network activity information, such as pages viewed, referring URL and device/browser characteristics. We collect these directly from you and automatically through your use of the site. We disclose them to the recipients described in section 5 for the business purposes described in section 3.
Sale or sharing. We have not sold personal information and have not shared it for cross-context behavioural advertising in the preceding 12 months, and we do not do so. We do not knowingly sell or share the personal information of consumers under 16 years of age.
Sensitive personal information. We do not collect sensitive personal information (as defined by the CCPA) through this website, and we do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA.
Retention. See section 7 for our retention periods.
Your California rights. Subject to the conditions and exceptions of the CCPA, you have the right to:
- Know / access the personal information we have collected about you, including the categories, sources, purposes and categories of recipients;
- Delete personal information we collected from you;
- Correct inaccurate personal information;
- Opt out of the sale or sharing of personal information — we do not sell or share personal information, so there is nothing to opt out of at present; should this change we will provide a "Do Not Sell or Share My Personal Information" link;
- Limit our use and disclosure of sensitive personal information — not applicable, as we do not collect it;
- Non-discrimination — we will not deny you goods or services, charge you different prices, or provide a different level of quality because you exercised a privacy right.
How to submit a request. Email us at the address in section 14, or write to us at the postal address shown there. Please describe your request with enough detail for us to understand it. You may use an authorised agent who provides proof of authorisation; we may still ask you to verify your identity directly. We will confirm receipt within 10 business days and respond within 45 calendar days, extendable by a further 45 days where reasonably necessary, in which case we will notify you.
10.3 Other jurisdictions
If you are outside the EEA, UK, Switzerland and California, you may still contact us using the details in section 14 and we will consider your request in light of applicable local law.
11. Children's privacy
This website is a business-to-business site. It is not directed to children, and we do not knowingly collect personal information from children through it. We do not offer products or services directly to children on this website, and we do not knowingly collect personal information from anyone we know to be under the age of 16, or under 13 for the purposes of the US Children's Online Privacy Protection Act ("COPPA"). If you are a minor, please review this policy together with your parent or guardian and do not submit any information without their agreement.
If we learn that we have inadvertently collected personal information from a child through this website, we will delete it or anonymise it promptly. Please contact us at the address in section 14 if you believe this has happened.
Our children's products and services. Some of the devices and solutions we design and manufacture — including AI learning cameras, AI scanning pens and plush companion units — may be used by children. For those products our role and our customers' roles are as follows:
- Our business customers (brand owners, distributors and solution partners who bring those products to market) are generally the controller of any children's or end-user personal data collected through those products. They are responsible for providing notice and obtaining verifiable parental consent, for honouring parental rights, and for complying with applicable children's privacy law, including COPPA, GDPR Article 8, the UK Age Appropriate Design Code and the PRC Provisions on Cyber Protection of Children's Personal Information.
- We generally act as a processor on our customers' documented instructions and do not determine the purposes or means of that processing, except where we operate our own direct-to-consumer services, in which case those services are governed by their own privacy notice.
We contractually require our customers to comply with those obligations and expect them to operate appropriate age-assurance, notice, consent and deletion mechanisms in the end products and companion applications they offer.
12. Third-party websites and services
Our website may contain links to third-party websites, platforms or online properties, including those of our partners and business customers. When you follow a link you leave our website and enter a site operated by a third party; any personal data collected there is handled under that party's own privacy policy, which we do not control and which may differ from ours. We encourage you to review those policies before submitting any information.
13. Changes to this policy
We may update this policy from time to time to reflect changes in our practices, our website, or applicable law. We will post the updated version on this page and update the version date above.
- Material changes — changes affecting why or how we process personal data, the categories we collect, our recipients, or international transfers — will be notified to you by a prominent notice on the site, by email where we hold one, or by another appropriate means, and we will seek fresh consent where the law requires it.
- Other changes take effect when the updated version is posted on this website.
We encourage you to review this page periodically.
14. How to contact us
If you have any question, comment or complaint about this policy or about how we handle your personal information, or if you would like to exercise any of your rights, please contact us:
| Email (privacy and general enquiries) | BD@gurobot.com |
| Telephone | +86 137 5119 5479 (Monday–Friday, 09:00–18:00 Beijing Time) |
| Postal address | Shenzhen GUROBOT Technology Co., Ltd., 34F, Haofang Tianji Plaza, No. 11008 Beihuan Avenue, Nanshan District, Shenzhen, Guangdong Province, People's Republic of China |
We will acknowledge and handle your request within the timeframes stated in section 10.