PRIVACY / DATA GOVERNANCE

Privacy notice

This notice describes the actual data processing of the UNALLUX B2B platform operated by UNALLI. Analytics and behavior analytics are separate, optional choices. The platform does not calculate an automatic lead score and never infers identity from an IP address.

Last updated: 13 August 2026

Categories and full explanation

The banner uses four clear categories. Marketing remains visible for transparency but is locked because no marketing technology is active.

Necessary

Always active

What do we collect?: Language and security state, form and quote-list state, Complianz choice cookies, a random consent-receipt ID, and limited Cloudflare Turnstile signals when a form is attempted. The local receipt contains no IP address or user agent.
Why do we collect it?: To operate the website, security, forms, and your privacy choice, block bots, and make the choice auditable.
How long do we keep it?: Session data for up to 12 months; the consent receipt for 730 days by default. The single-use Turnstile token is not retained locally.
Who do we share it with?: This WordPress installation, technical hosting operations, and Cloudflare Inc. solely for form security. No advertising or analytics platform.
How can you turn it off?: Not through the banner because this processing is necessary for form security. You can clear browser storage; language, forms, or the quote list may then reset.

Analytics

Optional

What do we collect?: Visit start, page view, language, coarse device/browser category, referrer host, and permitted UTM fields. No full URL query, IP address, full user agent, or fingerprint.
Why do we collect it?: To understand aggregate reach, page interest, and traffic sources.
How long do we keep it?: 180 days by default.
Who do we share it with?: Only locally in this WordPress installation; no Google Analytics, GTM, or other external analytics tag is active.
How can you turn it off?: Reject Analytics in the banner or later open “Manage privacy preferences”. Withdrawal stops the stream and deletes events for this purpose.

Behavior analytics

Optional

What do we collect?: Clicks, scroll depth (25/50/75/100%), page/product duration, and product, category, catalog, quote, and channel actions. No field values, email/phone content, passwords, keystrokes, mouse paths, messages, or session replay.
Why do we collect it?: To improve navigation, product discovery, and the B2B inquiry experience.
How long do we keep it?: 180 days by default.
Who do we share it with?: Only locally in this WordPress installation; not shared with external behavior-analytics providers.
How can you turn it off?: Reject Behavior analytics or withdraw it separately later. The tracker stops immediately and behavior events are deleted.

Marketing

Not in use

What do we collect?: Nothing. No advertising pixel, remarketing tag, or cross-site tracker is active.
Why do we collect it?: Not applicable.
How long do we keep it?: No marketing data.
Who do we share it with?: Nobody.
How can you turn it off?: Not required; the category is locked as not in use. Any future marketing technology requires a new explicit choice.

Platform operation and privacy contact

UNALLI operates the UNALLUX B2B platform. The exact legal identity of the controller and required company details must be verified and published before public production launch.

Privacy requests can be submitted through the secure contact form. A public email address is shown only when a verified business address is configured.

Data you provide

For a catalog request, we process company name, corporate email, selected country, catalog language, download asset, reference number, and request time.

For a quote request, we process the entered company, contact, project, and product details, quantities, notes, and reference number.

For a contact enquiry, we process company name, contact person when supplied, corporate email, country, message, and reference number. We use these details only to store, forward, and answer the B2B enquiry you initiated.

A request you initiate is processed to take steps at your request before a contract and, where applicable, under the legitimate interest in answering a self-initiated B2B inquiry. Analytics processing is separately based on consent.

Form security with Cloudflare Turnstile

When you attempt to submit a protected form, Cloudflare Turnstile performs a necessary security check. Cloudflare processes limited browser signals for this purpose, including the client IP address, TLS fingerprint, user-agent, public sitekey, and associated origin, to distinguish people from bots.

This security check is not an analytics or marketing purpose and is always active under our legitimate interest in protecting forms and personal data from abuse. Cloudflare acts as processor for the security service and as a separate controller when improving its own bot-detection capability, as described in the Turnstile Privacy Addendum.

The single-use Turnstile token is sent only to Cloudflare Siteverify and is not stored in the lead record or analytics tables. We do not send the IP address again as the optional Siteverify parameter, and Turnstile pre-clearance is not enabled.

Measurement only after separate consent

Before consent to Analytics or Behavior analytics, no analytics visitor or session ID is created and no analytics request is sent.

Analytics contains only visits, page views, and limited technical acquisition fields. Behavior analytics contains clicks, scroll depth, duration, and product, catalog, and quote actions. The server assigns every event to exactly one purpose.

Technical fields are limited to coarse device, operating-system, browser, screen, and viewport categories. Exact screen dimensions and the full user agent are not stored.

What we do not collect

Apart from the text and details you enter into a form, we do not collect files, content from your email account, WhatsApp content, passwords, contacts, sensitive data, activity on other websites, or cross-site profiles.

The IP address is not stored in the CRM or analytics tables. A temporary HMAC token may be used for no more than one hour to limit abuse and excessive requests.

Anonymous history is linked to a lead only when the same random visitor ID has active statistics consent and the visitor identifies themselves through a form.

Storage, recipients, and retention

Telemetry and consent receipts are stored locally in this WordPress installation. Requested lead messages are sent to the WordPress administrator address. No external analytics tag is configured.

Anonymous telemetry is retained for 180 days by default. Self-identified B2B leads and linked analytics are retained for 730 days by default. Consent receipts without an IP address or user agent are retained for 730 days by default. A demonstrable legal retention duty can pause automatic erasure through a visible legal hold.

If you choose to open WhatsApp, you leave this website and the external provider's privacy terms apply.

Your choices and rights

You can reject Analytics and Behavior analytics separately or withdraw either later. Collection for that purpose stops immediately and events for the withdrawn purpose are deleted. When both optional purposes are off, local analytics IDs and associated telemetry are deleted.

You may request access, correction, erasure, restriction, portability, or objection where the relevant right applies. You may also complain to your competent supervisory authority.