Privacy Policy

GTI generally determines why and how personal information is processed for the operation of the Platform and therefore acts as the personal information processor, controller or equivalent responsible organization under applicable law.

In some cases, a company using the Platform may separately determine why it provides or uses personal information about its employees, representatives or contacts. That company is responsible for ensuring it has authority and a lawful basis to provide such information to GTI.

Depending on how you interact with the Platform, we may collect the following categories of personal information.

Account and identity information

• first name and last name;
• business email address;
• account identifier and authentication records;
• job title and decision-making level;
• mobile telephone number;
• WhatsApp, WeChat or other contact identifiers;
• preferred language; and
• account, membership and approval status.

Company and professional information

• company name, brand name and organization type;
• country, region, city and business address;
• website and company contact details;
• company description and business activities;
• products, product categories and product types;
• markets served and areas of interest;
• company administrator status and company membership role;
• supporting documents submitted for company verification; and
• other professional information supplied by you or your organization.

Buyer and supplier activity

• buyer sourcing requests;
• product requirements and preferred markets;
• supplier interests and responses;
• business introduction requests;
• matching and recommendation activity;
• saved opportunities or visit lists;
• review status and administrative notes; and
• communications associated with requests, interests or introductions.

Exhibition and event information

• buyer, supplier, visitor or exhibitor registration data;
• event edition and attendance details;
• company, booth and exhibition information;
• badge, pass, QR code and registration identifiers;
• check-in and scan records;
• visit lists and booth-finder activity;
• uploaded registration or verification documents; and
• event-related support communications.

Online event information

• an invitation to a GTI online event, if GTI sends you one: your email address, the name, company and country GTI holds for you, when and how many times it was sent, and how it ended (joined, declined, withdrawn by GTI or marked by GTI staff as undelivered);
• your registration for a GTI online event: the participant type (buyer, supplier or audience), which GTI assigns to each company for each event, your company, GTI’s review decision (with any internal note), for suppliers when the presentation rules were accepted, for buyers the buyer code GTI gives (such as BUY03) and for the audience when its rules were accepted;
• your presence in the meeting room (when you joined and were last seen), the name the room shows for you and your status in the room (such as a raised hand, permission to speak and until when, a buyer camera place, or removal from the room by the host or because your registration is no longer approved);
• which supplier presentations you were in the meeting room for, and when;
• for presenting suppliers, whether and since when you agreed that GTI staff may record your presentation for a highlight video;
• the suppliers you mark as interesting (☆); and
• the questions you type in the meeting room.

The audio, video and screen sharing of the meeting room are transmitted live by Agora (see section 13). GTI does not record the meetings and never records buyers; please do not record them yourself. GTI’s hosts see the name shown for you; the other participants and the audience see a supplier or a host by that name and a buyer only by the buyer code. Everyone in the meeting room, the audience included, sees your video and hears your voice while your camera or microphone is on, and sees your screen while you share it. Attendance and ☆ marks are seen by GTI staff; after the event, each buyer also sees on their GTI dashboard the list of the suppliers they marked ☆, with a link to a supplier’s company page when it is public in the GTI Directory. Presenting suppliers receive totals and never see who marked them; questions go to the GTI host, who may read them out in the meeting room without your name.

Nobody chooses an identity when registering: GTI assigns each company its identity for each event, buyer, supplier or audience. The audience is a watch-only identity. It sees and hears the whole event, including the buyers’ and the suppliers’ cameras, the shared screens, the subtitles, the running order and the list of people in the room, but it cannot speak, use a camera, raise a hand, mark ☆ or ask questions, and it accepts rules not to record or share the meeting. Buyers are shown to the other participants and to the audience only by a code such as BUY03; GTI staff see their names. The other participants see only how many people are in the audience, not who they are. The audience’s own details (name, company, country, email address and whether and when it entered the meeting room) are seen by GTI staff only.

After the event, GTI gives the buyers who marked a supplier ☆ that supplier’s company details and the name and contact details of its contact person, so that they can follow up with it. GTI does not give suppliers the names, companies or contact details of the buyers who marked them ☆, and suppliers receive only totals.

A presenting supplier may agree, with an optional box when it registers, that GTI staff record its own presentation (its voice, its camera or shared screen and its company name, nothing of the buyers or the rest of the meeting room) for a short highlight video that GTI shares on its own channels, such as its website, WeChat and e-mails to suppliers. The supplier can withdraw this on its GTI dashboard until the event starts; GTI staff record only the presentations of the suppliers who agreed. Afterwards, a supplier who wants GTI to stop using the video can write to GTI’s address for online events, info@gti-expo.net (or to the address in section 24), and GTI then stops sharing it on its channels.

Invitations are seen by GTI staff only and are delivered through Resend (see section 13); section 19 says how to decline one. GTI does not accept presentation files for online events: presenters show their slides by sharing their screen, so please share nothing you would not show to the whole room.

A GTI host may turn on live subtitles in the meeting room. While they are on, the speech of anyone whose microphone is on is sent to Agora, which recognises it, translates it between Chinese and English and sends the text back into the meeting room (see section 13). The text stays on screen for a few seconds. GTI does not store it: it does not reach GTI’s servers or database, and GTI keeps only a technical record that subtitles were on (when they started and Agora’s reference for the task), not what was said. If you keep your microphone off, your speech is not sent.

Hosted buyer programme and visa invitation letters

If GTI invites you to its hosted buyer programme (hotel accommodation that GTI arranges for selected buyers during a GTI EXPO edition), or you apply to it, GTI collects:

• the invitation: your email address, name and organisation;
• your name as printed in your passport, your passport number, date of birth, passport expiry date and place of issue, your gender and nationality;
• your job title, company name and address, contact email, phone number and WeChat ID;
• your arrival and departure flights, airport and times, your check-in and check-out dates, room type, the number and names of your companions and any special requests;
• if you ask for a visa invitation letter, your planned dates of entry into and exit from China, and the letter GTI issues; and
• GTI’s review of your application (with any note or reason for declining it) and your hotel booking (the hotel, the confirmation number and any booking note).

GTI uses these details to book your hotel room and, when you ask for one, to issue a visa invitation letter. They are seen by the GTI staff who run the programme, and GTI sends the hotel it books a rooming list with them. How long they are kept is stated in section 15.

A buyer whose registration GTI has approved may also request a visa invitation letter to enter China for a GTI EXPO edition without taking part in the programme. For that request GTI collects your name as printed in your passport, your passport number, date of birth, passport expiry date and place of issue, your gender and nationality, your planned dates of entry into and exit from China, your job title, company name and address and phone number (taken from your registration where you leave them blank) and the contact email of your registration, and keeps the letter GTI issues. GTI uses these details only to issue the letter and to tell you when it is ready. They are seen by the GTI staff who issue the letter and are not sent to a hotel. How long they are kept is stated in section 15.

Communications and support information

• contact form submissions;
• emails and messages sent to GTI;
• customer support requests;
• complaints, enquiries and feedback;
• communication history; and
• records necessary to resolve an issue.

Technical and usage information

• IP address;
• browser type and operating system;
• device and network information;
• login date, time and authentication events;
• pages, routes and features accessed;
• error logs and diagnostic data;
• security, fraud and abuse signals;
• referring pages or links; and
• cookie or similar technology identifiers.

AI and automated feature information

• questions or instructions submitted to AI features;
• AI conversation content;
• search terms and requested product categories;
• generated summaries, matches and recommendations;
• feedback on automated outputs; and
• system records used to monitor reliability, safety and performance.

We may collect personal information:

• directly from you;
• from your employer or organization;
• from a company administrator;
• through buyer or supplier registration forms;
• through exhibition registration and on-site systems;
• when you submit a buyer request, supplier interest or introduction request;
• when you use the AI Advisor or search tools;
• when you contact GTI by email, form, telephone, WeChat or WhatsApp;
• from publicly available company websites, exhibition catalogues or business directories;
• when GTI staff add your business contact to the invitation list of an online event;
• from authorized GTI employees, contractors, partners or event organizers; and
• automatically when you access or use the Platform.

We may use personal information to:

• create, authenticate and maintain accounts;
• verify email addresses and account access;
• connect individuals to their company or organization;
• manage Primary Administrator, Secondary Administrator and member permissions;
• review and approve company membership requests;
• maintain personal and company profiles;
• operate company and supplier directories;
• display approved public company information;
• process buyer and supplier registrations;
• process exhibition and event registrations;
• invite people to online events and record requests not to be invited;
• provide live subtitles in online events;
• issue QR codes, badges, passes or admission records;
• provide booth-finder, map and visit-list functions;
• receive and manage buyer sourcing requests;
• receive and manage supplier interests;
• provide matching and introduction services;
• generate AI-assisted results, summaries and recommendations;
• communicate about accounts, requests and events;
• respond to enquiries and support requests;
• improve data quality and category consistency;
• operate, maintain and improve the Platform;
• protect Platform security and prevent misuse;
• investigate fraud, abuse or unauthorized access;
• maintain internal records and audit trails;
• comply with legal and regulatory obligations; and
• establish, exercise or defend legal claims.

Depending on the applicable law and the circumstances, GTI may process personal information on one or more of the following grounds:

• your consent;
• processing necessary to enter into or perform an agreement with you;
• processing necessary for human-resources or organization management carried out under lawful rules;
• compliance with legal obligations;
• protection of life, health, safety or property in an emergency;
• reasonable processing of information lawfully made public;
• our legitimate interests or those of another party, where not overridden by your rights, only where the law that applies to you recognises this ground (for example in the European Union or the United Kingdom); it is not a ground under the law of mainland China; or
• another basis permitted by applicable law.

Where consent is required, you may withdraw consent, although withdrawal will not affect processing already lawfully completed before withdrawal.

The Platform connects individual users to company accounts. Approved company administrators may view company membership information and take permitted administrative actions, including approving, rejecting or removing members and assigning authorized administrator roles.

Company administrators may see limited professional information about company members, such as name, business email, job title, decision level, membership status and company role.

Each user manages their own Personal Account information. Company administrator permissions do not authorize an administrator to impersonate another person or change another person’s private login credentials.

Your employer or organization may have its own privacy obligations and policies concerning the information it submits or accesses through the Platform.

Certain approved company, product, brand, exhibition and business information may be made publicly accessible through company profiles, directories, exhibition listings and search results.

Public information may include company name, brand name, country, city, company description, website, business contact information, product categories, product types, booth details and other approved business information.

Personal contact information will not be made public unless the relevant feature, submission process, account setting or authorization indicates that it is intended for public display.

Search engines and third parties may independently index or retain information that has been made publicly available.

Buyer request information may be shared with suitable suppliers or reviewed by GTI staff for matching and introduction purposes.

GTI may limit the disclosure of buyer identity or contact information until an introduction is approved or another authorized communication stage is reached.

Supplier interest information may be shared with the relevant buyer, GTI reviewers or authorized company administrators as necessary to evaluate or facilitate the opportunity.

Users must not use information received through an introduction for unrelated marketing, data harvesting, harassment or unauthorized disclosure.

GTI may use automated systems to classify information, identify product categories, rank search results, suggest suppliers, generate summaries, support matching or assist users through conversational tools.

Automated outputs may be based on information supplied by users, public business information, GTI-managed data, structured categories, platform activity and system rules.

AI outputs may be inaccurate or incomplete and should not be treated as a guarantee, certification or final decision.

GTI does not intend to use fully automated processing to make decisions that produce legal or similarly significant effects on an individual without appropriate review or another lawful basis.

The live subtitles of GTI online events are produced automatically by Agora’s speech recognition and translation (see sections 2 and 13). Nobody checks them before they appear, and they may contain errors; they are not a record of what was said.

You should not submit unnecessary sensitive personal information, confidential information or trade secrets to AI features.

GTI does not generally require sensitive personal information for ordinary Platform membership.

Certain event, identity-verification, security or legal processes may involve information treated as sensitive under applicable law. Where required, GTI will provide specific notice and obtain separate consent or another valid legal basis before processing such information.

Passport numbers, which GTI collects with the date of birth, passport expiry date and place of issue (section 2), may be sensitive personal information. GTI asks for them only in its hosted buyer programme and in a request for a visa invitation letter to enter China, uses them only to book the hotel room and to issue a visa invitation letter, and deletes them 30 days after the exhibition edition ends (section 15).

Users should not upload identity documents, financial account information, health information, biometric information or other sensitive personal information unless the relevant feature specifically requests it and the submission is necessary.

The Platform may use cookies, local storage, session storage and similar technologies to:

• maintain login sessions;
• remember language or interface preferences;
• protect account and Platform security;
• prevent fraud and unauthorized access;
• support essential technical operations;
• measure service performance; and
• diagnose errors.

Essential technologies may be required for the Platform to function. Where required by law, non-essential cookies or analytics technologies will be used only after appropriate notice or consent.

Browser settings may allow you to block or delete cookies, but doing so may affect login, preferences or other Platform functions.

GTI does not sell personal information to advertisers.

We may share personal information only as reasonably necessary with:

• your company and authorized company administrators;
• buyers, suppliers or business contacts involved in an authorized request, interest or introduction;
• exhibitors, event organizers, venues or event-service partners;
• the other participants of an online event, as section 2 describes;
• cloud-hosting, database, storage and authentication providers;
• email and communication providers;
• security, fraud-prevention and technical providers;
• analytics and diagnostic providers;
• professional advisers and auditors;
• regulators, courts, law-enforcement or government authorities where legally required;
• a successor, purchaser or restructuring party in connection with a merger, acquisition, financing, reorganization or transfer of Platform operations; and
• another party where you have authorized or requested the disclosure.

Service providers are expected to process personal information only for authorized purposes and subject to appropriate confidentiality, security and data-protection obligations.

GTI uses third-party infrastructure and service providers to operate the Platform. Depending on the deployed service and region, these providers may support:

• cloud application hosting;
• database hosting and storage;
• account authentication;
• email delivery;
• document and image storage;
• logging and error monitoring;
• security and abuse prevention;
• AI or language-processing functions; and
• event and communication services.

As at the effective date, the principal providers are:

• Supabase — database, authentication and file storage; project hosted in Australia (Sydney);
• Vercel — website and application hosting; content is served from a global edge network and application code runs in Australia (Sydney);
• Sentry — error and performance monitoring; data region United States. Error and performance reports are configured to exclude request bodies, cookies, authorization headers, IP addresses and the values in web addresses (such as pre-filled form fields); e-mail addresses and phone numbers are removed from error messages. Internal record identifiers may be included;
• Agora — live audio and video for GTI online events (the meeting room). The media is relayed over Agora’s global network, which may route it through servers in mainland China, the United States or other countries or regions, depending on where the participants are. Agora receives the audio, video and screen sharing of participants who turn them on, and connection data such as IP addresses and a numeric participant number, not names or email addresses. GTI does not record the meetings, apart from the presentation of a supplier who agrees to a highlight video, which GTI staff record themselves (see section 2); please do not record them yourself. When a GTI host turns on live subtitles, Agora also receives the speech of participants whose microphone is on, recognises it, translates it between Chinese and English and sends the text back into the meeting room; whatever is said aloud, names included, reaches Agora in this way;
• OpenAI — language model used by the AI Advisor; United States. The AI Advisor sends it the messages of your conversation, with the email addresses, phone numbers, web addresses and messaging IDs that GTI can detect removed, and the public directory information of the suppliers it recommends, without their contact details; GTI staff tools also use it to draft recommendation text from sourcing requests and suppliers’ responses to them, with the same details removed, and to translate event content that GTI publishes; and
• Resend — email delivery; United States.

These providers are recipients outside mainland China. Their formal names and contact details, as each gives them in its own privacy policy or data processing terms, are:

• Supabase: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513; privacy@supabase.com. The Platform’s data is stored in Sydney, Australia;
• Vercel: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States; privacy@vercel.com;
• Sentry: Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, United States; compliance@sentry.io;
• Agora: Agora, Inc. and its affiliates (as Agora’s terms of service name them); privacy contact Agora Lab, Inc., 2804 Mission College Blvd, Suite 110, Santa Clara, CA 95054, United States; privacy@agora.io;
• OpenAI: OpenAI OpCo, LLC, 1455 3rd Street, San Francisco, CA 94158, United States; privacy@openai.com; and
• Resend: Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, United States; privacy@resend.com.

They process personal information for GTI, for the purposes and in the ways this section and section 14 describe. To exercise your rights over the information they hold (section 17), write to GTI at the address in section 24: GTI handles the request and passes it on to the provider where needed. You may also contact a provider at the address above.

The providers actually used may change as the Platform develops. GTI will assess providers and contractual protections according to the nature of the service and applicable law, and will update this section when a principal provider or storage location changes.

GTI serves an international industry. Personal information may therefore be accessed, stored or processed in jurisdictions outside the country or region where it was collected.

In particular, because the Platform’s primary infrastructure is located in Australia and certain monitoring, AI and email delivery providers (Sentry, OpenAI and Resend) are located in the United States (see section 13), personal information collected from users in mainland China, Hong Kong, Taiwan or elsewhere is transferred to and stored in those locations. GTI EXPO staff in Guangzhou, China access this information to operate the Platform and events.

The audio and video of GTI online events are relayed live over Agora’s global network (see section 13), which may carry them through mainland China, the United States or other countries or regions; GTI does not record or store them, apart from the presentation of a supplier who agreed to a highlight video (see section 2), which GTI staff record and keep to make and share that video. While live subtitles are on, spoken words also go to Agora for recognition and translation (see section 13).

This may occur where GTI personnel, users, event participants, service providers, infrastructure or business contacts are located in different countries or regions.

For personal information collected in mainland China, how these transfers are made under the law of the People’s Republic of China depends on who you are:

• if you have registered with GTI (an account, a buyer or supplier registration, a registration for an exhibition or an online event, or an application to the hosted buyer programme), GTI provides your information to the recipients listed in section 13 because this is necessary to provide the Platform and the services you registered for, that is, to conclude and perform an agreement to which you are a party (Article 13, paragraph 1, item 2 of the Personal Information Protection Law);
• that basis does not cover people who have no agreement with GTI: people GTI invites to an online event or to the hosted buyer programme before they register or apply (GTI stores their business contact details at Supabase and sends its invitations through Resend), and visitors who use the Platform without registering (their requests reach Vercel, error reports about their visits go to Sentry, and their on-site activity records of section 22 are stored at Supabase). The transfers of their personal information are made under the exemption from the security assessment, the standard contract and certification described in the next paragraph.

Under Article 5, item 4 of the Provisions on Promoting and Regulating Cross-Border Data Flows, a data processor other than a critical information infrastructure operator that, counting from 1 January of the year, provides the personal information of fewer than 100,000 individuals in total (not including sensitive personal information) outside mainland China is exempt from the data export security assessment, the standard contract for the export of personal information and personal information protection certification. The transfers in this section, except the passport details described below, are exempt under this provision from those three procedures. GTI has not been identified as a critical information infrastructure operator. The exemption applies only while fewer than 100,000 individuals are concerned in a year; if the number approaches 100,000 in a year, GTI will complete the procedure the law then requires.

The passport number, date of birth, passport expiry date and place of issue described in section 2 (together, the passport details) may be sensitive personal information (section 10). GTI asks for them only in two cases: in its hosted buyer programme, and when a buyer requests a visa invitation letter to enter China. Both are only for buyers from outside mainland China: the programme because GTI offers it only to them, and the letter because only people from outside mainland China need one. Those buyers give these details from outside mainland China, before they travel, directly to the Platform, which is hosted outside mainland China (section 13). In GTI’s assessment these details are therefore not personal information collected in mainland China, and keeping them on the Platform is not a transfer out of mainland China, so the exemption above, which does not cover sensitive personal information, is not needed for them.

The names and contact details of the recipients are in section 13, which also says for what purpose each receives personal information and how it processes it (storage, delivering the website, error monitoring, relaying audio and video, AI processing or e-mail delivery). The categories of personal information each receives are those of section 2 that its service handles: Supabase, all the categories the Platform keeps; Vercel, what you send or view through the website, with request logs; Sentry, error and diagnostic data; Agora, the audio, video and connection data of the meeting room and, while subtitles are on, speech; OpenAI, AI Advisor conversations and the content of GTI staff tools; Resend, email addresses and the content of the e-mails GTI sends. To exercise your rights over information held by these recipients (section 17), write to GTI at the address in section 24, and GTI handles the request with the recipient.

Laws and enforcement practices in another jurisdiction may differ from those in your place of residence.

GTI retains personal information only for as long as reasonably necessary for the purposes described in this Policy, including to:

• maintain an active account or company membership;
• provide requested services;
• support exhibitions and business introductions;
• maintain security and prevent fraud;
• resolve complaints or disputes;
• maintain appropriate business and audit records;
• comply with legal obligations; and
• establish, exercise or defend legal claims.

The periods GTI applies are listed below, each with its exceptions. Most are carried out every day by an automatic job; the others are carried out by GTI staff. Information kept because of an exception is deleted once the exception no longer applies and the period has passed.

Accounts and registrations

• your account (your login, name, contact details, company membership and preferences) is kept while the account is open. GTI does not delete accounts automatically because they have not been used for a long time. If you ask GTI to delete your account (section 18), GTI deletes it within 15 working days of receiving the request;
• a buyer or supplier registration that was submitted but whose email address was never verified is deleted 90 days after it was submitted or last changed, together with the login created for it, unless one of the exceptions for rejected registrations below applies;
• a buyer or supplier registration that GTI rejected is deleted 12 months after it was submitted, reviewed or last changed, whichever is latest, with the documents uploaded for it. It is kept while an account was set up from it, a company or a brand was created from it, it is still published in the GTI Directory, a sourcing request, a supplier interest or a match result is linked to it, a company’s verification rests on its business licence, it has a hosted buyer application, or it has an active expo pass. A hosted buyer application keeps it only until 12 months after the exhibition edition the application was made for ends: if nothing else keeps it, the registration is then deleted with the application;
• when such a registration is deleted, the daily job also deletes the login created for it and, for a supplier, the person record and the pending or rejected company membership created for it, unless they are still used, for example by an account or another registration; a person record that other records still refer to is kept without its company and contact details, and the login linked to it is then kept with it;
• an exhibition registration request that GTI rejected or that was cancelled is deleted 12 months after it was submitted, reviewed or last changed, unless the exhibition registration made from it is still valid;
• a registration under review is kept until GTI decides on it; an approved registration becomes part of your account and company information and is kept with them;
• requests to join a company account are deleted 12 months after the company or GTI has decided on them; and
• buyer expo passes are deleted with the buyer registration they belong to.

Company information and business activity

• company profiles, the contact persons named on them and company verification documents are kept while the company’s account is open or the company is listed in the GTI Directory. When a contact person leaves the company or asks GTI, GTI removes their name and contact details within 15 working days; when a company account is closed, GTI deletes its verification documents and contact details within 15 working days and keeps only its exhibition history, such as the company name;
• sourcing requests, introductions and supplier interests are records of the company they were made for and are kept while its account is open. When you delete your own account, the link to you is removed from them and GTI deletes its notes and tasks about its follow-up with you; what you wrote in a request or an interest stays with your company’s records, and a supplier interest keeps the contact name and contact details (email address, phone and WhatsApp number) given in it, which you may ask GTI to remove (section 17); what an unresolved dispute needs is kept until the dispute is resolved, and at most 3 years after the last activity on it;
• AI Advisor conversations are deleted 2 years after their last activity, unless a sourcing request that comes from them is still in progress, changed or was matched within those 2 years, or has other requests merged into it; the technical records of AI runs and daily AI usage are deleted after 180 days; and
• contact form messages are deleted 3 years after they were sent or last handled.

Exhibitions and hosted buyers

• records of QR code scans at an exhibition are deleted 2 years after the scan or their last change, unless GTI staff are still following up on them; entrance check-in records are deleted 2 years after the check-in;
• raw on-site behavioural events (section 22) are retained for up to 180 days after the relevant exhibition edition, which is the window used to compute demand indicators, and are then deleted or reduced to aggregated form;
• in other activity records (for example use of the AI Advisor or the GTI Directory), who acted (the person, the company or the browser session) is removed after 2 years; the record keeps what happened and the business record it concerns (such as a sourcing request or a supplier interest), which is kept for that record’s own period;
• GTI has not yet set a period for exhibition registrations, for registrations made at the exhibition entrance (with or without an email address) and their expo passes, or for the email address and message sent with the “Tell GTI what you are sourcing” form: until GTI sets one and states it here, they are kept, and you may ask GTI to delete them at any time (section 17); and
• in the hosted buyer programme and in a request for a visa invitation letter (section 2), the passport number, date of birth, passport expiry date and place of issue, and the files kept with an application or a request (such as a visa invitation letter), are deleted 30 days after the exhibition edition ends; GTI deletes its own copies outside the Platform (such as the rooming list) at the same time and asks the hotel to delete the rooming list after check-out. The other personal details of an application or a request are cleared 12 months after the edition ends, leaving only that you applied and whether a room was booked. A hosted buyer invitation that was never accepted is deleted 45 days after the edition ends, an accepted one 12 months after it ends.

Online events

• online event records (registrations, presence and status in the meeting room, which presentations you attended, ☆ marks and questions) are deleted 12 months after the event ends;
• the identity GTI assigned for an event, a buyer’s code and when the audience accepted its rules are part of the registration and are deleted with it; the audience’s records follow the same periods as everyone else’s;
• online event invitations nobody joined through (never answered, withdrawn or declined) are deleted 45 days after the event ends; an invitation someone joined through is deleted 12 months after the event ends;
• the records of online event invitation e-mails (the address an invitation was sent to) are deleted 90 days after sending;
• if you decline an online event invitation, GTI keeps a hash of your email address (a code computed from the address, not the address itself) on its do-not-invite list for as long as GTI sends online event invitations, or until you ask GTI to delete it, so that the refusal also holds for later events. The hash is still personal information, because anyone who has your address can compute it; deleting it ends your refusal; and
• for a highlight video made from a supplier’s presentation, GTI staff delete the raw recordings within 90 days of the event; GTI uses the video for at most 3 years and stops sharing it sooner when the supplier asks (see section 2), and keeps the record of the supplier’s agreement for as long as it uses the video.

E-mails, logs and backups

• records of the e-mails GTI sends (the address, the subject, which message and whether it was delivered) are deleted 2 years after sending, those of online event invitation e-mails after 90 days (see above). The subject, which can include an entry ID, a reference number or the name of a company or event, is kept until then; the other details used to personalise a message (such as names, links and entry IDs) are cleared after 90 days;
• the log of GTI staff actions on the Platform (for example who exported, reviewed or changed what, and when) is deleted after 3 years;
• lists that GTI staff upload to register people in bulk are deleted 90 days after they were processed, or 90 days after they were uploaded if they were never processed, and no password is kept from them;
• error reports sent to Sentry are kept for at most 90 days;
• the server logs of Vercel and Supabase are kept for at most 7 days; the sign-in and security log that the Platform’s account system keeps in its database (sign-ins, sign-ups and other account events, with the email address and IP address) is kept for 6 months, as the Cybersecurity Law of the People’s Republic of China requires, and is then deleted by the daily job;
• backup copies are kept for at most 7 days and are then overwritten; and
• OpenAI and Resend keep their own copies, under their own rules, for at most 30 days; for Agora, see Agora’s own privacy policy (its contact is in section 13).

When information is no longer required, GTI will delete, anonymize or otherwise securely dispose of it, subject to technical and legal limitations. Except for the server logs of Vercel and Supabase and the error reports sent to Sentry, which are kept only for the periods stated above, where a law requires GTI to keep information for longer, GTI keeps it for the period that law sets.

GTI uses reasonable administrative, technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, disclosure or destruction.

These measures may include:

• authenticated access controls;
• role-based permissions;
• database security policies;
• encrypted network transmission;
• restricted administrative access;
• logging and monitoring;
• software updates and vulnerability management;
• backups and service-recovery procedures;
• service-provider review; and
• staff confidentiality obligations.

No method of transmission or storage is completely secure. Users are responsible for protecting their passwords, authentication links and account devices.

Where required by law, GTI will assess and respond to personal information security incidents and provide notifications to affected individuals or competent authorities.

Subject to applicable law and relevant exceptions, you may have the right to:

• know how your personal information is processed;
• request access to your personal information;
• request a copy of your personal information;
• request correction or completion of inaccurate information;
• request deletion of personal information;
• withdraw consent;
• object to or restrict certain processing;
• request transfer of information where legally applicable;
• request an explanation of personal information processing rules;
• object to certain automated decision-making or request human review;
• close your account;
• submit a complaint; and
• authorize another person to exercise rights where permitted by law.

Some information can be updated directly through Personal Account or Company Information features.

For other requests, contact GTI using the details below. We may need to verify your identity, authority or account relationship before completing a request. GTI answers privacy requests within 15 working days of receiving them.

A request may be limited or refused where permitted by law, including where disclosure would adversely affect another person, compromise security, reveal confidential information or conflict with a legal retention obligation. GTI will provide an explanation where required.

You may request account closure by contacting GTI. Account closure may result in loss of access to company records, requests, interests, introductions, saved lists and other Platform functions.

Closing an individual account does not necessarily require deletion of:

• company information independently controlled by the company;
• approved public exhibition or company records;
• records necessary to protect other users or Platform security;
• communications or records required for legal compliance;
• information needed to resolve disputes or enforce agreements; or
• anonymized information that no longer identifies you.

GTI may send service-related communications concerning account security, registration status, company membership, buyer requests, supplier interests, exhibitions, support or material changes to Platform terms.

Where legally permitted, GTI may also send information about relevant exhibitions, products, services, industry updates or business opportunities.

You may opt out of non-essential marketing communications by using an unsubscribe method provided in the message or by contacting GTI. Opting out will not stop essential service-related communications.

GTI may invite buyers to online events by email, using business contacts it holds. Each invitation says why you received it and carries a “No thanks” link, which needs no account. The link in the latest invitation puts a hash of your address on a do-not-invite list, so that GTI does not invite that address to any online event again, and clears the name, company and country from the invitations you did not join. It works until that invitation is deleted (see section 15). You can also refuse at any time by writing to the address the invitation gives, info@gti-expo.net, or by contacting GTI (see section 24), and GTI then adds the address to the same list. If you have already joined an event you stay registered for it, and refusing does not stop essential service-related communications.

The Platform is intended for business and professional users and is not directed to children.

Users must normally be at least 18 years old or have the legal capacity required in their jurisdiction.

GTI does not knowingly collect personal information from children through ordinary Platform membership. Where an event or lawful service involves a minor, GTI will apply appropriate age, guardian-consent and sensitive-information safeguards as required by law.

The Platform may contain links to third-party websites, maps, communication platforms, social networks, event providers or other services.

GTI does not control the privacy practices of independent third parties. Their collection and use of personal information are governed by their own privacy notices and terms.

During GTI EXPO editions, the Platform offers on-site tools — the Exhibitors & Booth Finder, the floor map, the visit list, exhibitor detail pages and the “Tell GTI what you are sourcing” form — that can be used without an account, typically by scanning a QR code printed at the venue.

To measure which product categories, exhibitors and halls draw attention, the Platform records the following behavioural events when these tools are used: search terms and selected filters; product categories matched to a search; exhibitors added to or removed from a visit list; exhibitor detail pages opened; and sourcing requests submitted through the form. Each event carries the edition, the time, and the product categories involved.

Events from visitors who are not signed in are associated with a random identifier generated by the Platform and stored in the browser’s local storage. This identifier contains no personal details and is not linked to a name, telephone number or email address unless you later sign in or submit a form containing that information. It exists so that repeated actions by one visitor are not counted as many visitors. Clearing browser site data removes it.

The visit list itself is stored only in your browser and is not uploaded to GTI; only the act of adding or removing an exhibitor is recorded as an event.

GTI uses these events to produce aggregated, anonymised demand indicators — for example, how many distinct visitors searched for a product category during an edition — for internal planning, exhibitor recruitment, market reports and products offered to suppliers. Indicators are published only above minimum sample thresholds, and no single visitor’s activity is identifiable in them. GTI does not disclose an individual buyer’s identity, searches, visit list or sourcing requests to exhibitors or other suppliers, consistent with section 8.

Raw behavioural events are retained for the period stated in section 15 and may be deleted or further anonymised after the aggregated indicators have been produced. You may object to this processing, or ask for events associated with your identifier to be deleted, by contacting us under section 17; please include the identifier shown in your browser’s site data if you wish us to locate the events.

GTI may update this Privacy Policy to reflect changes in the Platform, processing activities, service providers, legal requirements or business operations.

Updated versions will be posted on this page with a revised effective date.

Where a change materially affects the way personal information is processed or affects individual rights, GTI may provide additional notice through the Platform, email or another appropriate method and obtain consent where required.

Questions, privacy requests or complaints may be submitted to:

Please describe your request clearly and include enough information for GTI to identify the relevant account, registration or processing activity.

GTI will review and respond within 15 working days of receiving your request. You may also have the right to complain to a competent data-protection, cybersecurity or other regulatory authority.