Website and operator
Website: https://jewelboxmfg.com
Version: 21 October 2026
Effective date: First publication of this approved version on this website.
The operator named in this notice is HC PACKAGING VIETNAM COMPANY LIMITED. Registered address: Lot C-10B-CN, Road D13, Bau Bang Industrial Park Expansion, Bau Bang Commune, Ho Chi Minh City, Vietnam.
For questions about this notice or your inquiry information, contact hc@hcpackagingasia.com. This privacy contact is separate from the sales email and WhatsApp channels.
Scope and current operating mode
This notice describes the packaging inquiry form and the contact choices on this independent website. Product photographs and reference descriptions help buyers prepare a packaging brief. The form is an inquiry channel; it does not place an order or take payment.
The approved operating model stores accepted form submissions in this website's dedicated database. After a form submission is saved, the website sends inquiry notifications through NetEase SMTP from outbox@hcpackagingus.com to thomas@hcpackagingus.com and the authorized backup at hc@hcpackagingasia.com. These notifications contain the submitted business contact details and project brief, the selected product reference where provided, the inquiry identifier and time, and a link to the protected Reader. The visitor's email address is used as Reply-To for a manual project response. Authorized staff continue to review and reply manually. No advertising or third-party analytics event is sent by the current inquiry implementation. Saving an inquiry does not establish that a member of staff has read it or that an email has been delivered.
Information in a packaging inquiry
The form asks for company, contact name, work email, packaging type or selected product, estimated quantity, project requirements, and confirmation of the privacy notice checkbox. Project requirements may include dimensions, insert or finish references, destination and timing that you choose to supply. Please include information needed for the packaging discussion and avoid unrelated personal or sensitive information.
When the form is opened for a selected product, the saved brief also contains the verified product reference: its identifier, name, website path and URL, category, and original product-source URL. A general inquiry is marked as general instead. These product fields describe the selected reference, not a determination of its final manufacturing site or specification.
For an accepted submission, the inquiry database also records a record identifier, submission time, a keyed hash derived from the connecting IP address for request limits, and a fingerprint derived from the saved inquiry content for matching duplicate requests. The inquiry table does not store the raw IP address or browser user-agent as separate fields. This description is limited to the inquiry table; it is not a statement that a future host, proxy, backup system or contact provider keeps no logs.
How the form uses this information
Inquiry information is used only for inquiry review, specification clarification, project-specific replies, and security and abuse prevention. Submission metadata supports protection against repeated or excessive submissions. Matching saved content is recognized within a 120-second window; request limits use 60-second and 600-second windows. These checks do not define a retention period or erase earlier records.
The required checkbox records agreement to the displayed privacy notice for that request. The checkbox alone does not establish the legal basis for every processing activity. Business contact details and project information that you actively submit are used only to evaluate your packaging inquiry, clarify specifications and respond to your project. Where applicable law requires consent for an activity, the consent must be explicit, informed and specific to that purpose. Agreement to, or acknowledgement of, a privacy notice is not by itself treated as valid consent for every processing activity. The current form requires an affirmative notice-agreement checkbox; that fact alone does not establish that a legally sufficient consent mechanism or a complete consent record is in place.
The security cookie, request token, IP-derived keyed hash, content-matching fingerprint, request limits and other abuse-prevention measures must each be assessed under the lawful basis and requirements applicable to that activity. Describing a measure as necessary for security does not by itself establish a consent exemption, a legitimate-interests basis, or coverage by the inquiry checkbox. These measures are limited to the security purposes described in this notice and are not permission for unrelated advertising or profiling.
Where consent is the applicable basis, you may request its withdrawal through hc@hcpackagingasia.com. Withdrawal does not affect processing already lawfully carried out before withdrawal. Its effect on continued handling of an inquiry or on separate security and recordkeeping activities must be assessed under the law applicable to the activity; it is not a blanket authorisation to continue the same processing on an unverified alternative basis.
Cookie and browser behavior
When you submit the form, the browser first requests a form security token from this website. That endpoint sets an hc_csrf_session cookie with a one-hour expiry, a website-wide path, HttpOnly and SameSite=Strict settings. Its Secure setting follows whether the website is accessed over HTTPS. The security cookie and token protect the submission; they are not saved in the inquiry payload. The final HTTPS environment and cookie behavior must be verified before release.
The current public inquiry flow does not implement advertising or analytics tracking. Authorized WordPress account sessions are a separate administrative flow. Hosting, proxy, administrative cookies and any future integrations must be included in the final environment inventory; no future tracking service is approved by this draft.
Access and operational handling
The current application permits authorized Inquiry Reader users and administrators with the inquiry-reading capability to view saved briefs. The Reader role is limited to reading and inquiry reading. Its screen shows the latest 100 saved records; this display limit is not deletion or a retention rule. The notification process handles newly saved inquiries and sends a separate copy to each authorized recipient. Staff use the Reader to verify the saved record; a notification is not an automatic reply to the visitor. An email failure does not remove an inquiry already saved in the website database.
The manual process assigns Thomas as the primary inquiry contact and a separate authorized backup. Checks are scheduled for 09:00 and 17:00 on Vietnam business days (Asia/Ho_Chi_Minh). Staff use approved company communication channels to reply manually, with an operational target of a first response within one business day. This is a service target rather than a guaranteed delivery time. An unavailable primary contact hands pending work to the backup; unresolved operational or privacy issues are escalated to the designated operator.
Email, WhatsApp and other links
The sales Email button opens the visitor's email application addressed to thomas@hcpackagingus.com. The WhatsApp button opens the confirmed sales channel through WhatsApp. A product-specific button may prefill the product name and website reference path. Opening a channel does not mean that a message has been sent, received or read. The visitor chooses whether to send the prepared message.
These actions move the conversation to the chosen email application/provider or WhatsApp. Information you send there is handled through that channel as well as by the people receiving it. The website does not automatically copy the form's company, name, email or requirements into these contact links. Review the information you choose to send.
The website's dedicated database is hosted on Tencent Cloud infrastructure in Virginia, United States. Authorized inquiry staff access the system from Vietnam. An offsite backup is held on a Mac mini in the United States. Inquiry notifications are transmitted through NetEase SMTP to the authorized mailboxes described above. The notification provider and recipient mailbox services handle those messages in addition to the website database. The visitor-selected sales email and WhatsApp channels remain separate contact choices. These arrangements involve storage or access in countries that may differ from the country where you are located. The operator is responsible for identifying the actual recipients, their roles and locations, and the safeguards, assessments or other arrangements required by applicable law for each relevant data flow. A recipient's location, the choice of a United States server or backup, or use of email or WhatsApp does not by itself establish that a required transfer mechanism or assessment has been completed.
You may ask the privacy contact about the recipients and protections relevant to your information. This notice does not claim that any particular provider agreement, statutory transfer mechanism or cross-border filing has already been completed. Separate email and WhatsApp exchanges follow their own communication route as well as the operator's handling; the form's database rules do not automatically control those providers' records.
Retention and removal
The approved retention rule for inquiry records is 24 months after the last business contact. The approved rule for technical security logs is 90 days. These periods are separate from the short duplicate-protection and request-limit windows. The Reader screen's 100-record display limit does not delete records or define their retention. The current application records the submission time, but does not record the last business contact or automatically enforce these retention periods. Applying the 24-month inquiry rule therefore requires a separate, restricted last-contact record and a manual review, approval, execution and verification process. The submission date must not be used as a substitute for the actual last business contact. The operator must identify the security-log sources, their time references and the records to which the 90-day rule applies before representing that rule as implemented.
The IP-derived hash and content-matching fingerprint stored with an accepted inquiry remain part of that inquiry record until it is removed; the current implementation does not separately erase them after the short request-limit windows or after 90 days. They must not be described as anonymous or as automatically deleted security logs. Their retention and any restriction or removal must be assessed as part of the inquiry record and its approved retention process. A 30-day backup-retention period is the proposed rotation plan, not a verified current deletion schedule. Backup locations, authorised access, actual rotation and expiry must be documented and tested before the plan is represented as implemented. Removing an active inquiry does not mean that every backup copy is immediately erased.
An approved deletion or restriction must be recorded in a restricted restoration-suppression record with only the information needed to prevent the affected record from being returned to active use. If a backup is restored, approved removals and restrictions must be reapplied and checked before the restored data resumes ordinary use. Any retained backup copy must remain restricted to authorised recovery or another specifically justified purpose, and follow the approved expiry and exception decisions. The backup and restoration process does not create a right to retain inquiry information indefinitely. Records may be retained beyond the ordinary period only where, and to the extent, applicable law requires or permits retention for a specific legal obligation, an existing dispute or legal request, or a necessary security investigation. Such an exception must have a documented reason and applicable legal basis, limited records and access, an identified review date, and an end condition or deletion trigger. A possible future dispute or a general business preference is not a blanket justification for indefinite retention. Retained information must not be reused for unrelated purposes. When the justification ends, the operator must review the affected scope and authorise the appropriate deletion or continued restriction. Inquiry-notification copies, separate email correspondence and WhatsApp correspondence must be included in the approved operational retention inventory; the form rules must not be assumed to delete data from external providers.
Privacy questions and requests
Send questions or requests concerning access, correction or removal of your inquiry information to hc@hcpackagingasia.com. Include enough context to locate the inquiry without sending unnecessary sensitive information. Requests are handled manually through this existing privacy contact. Staff should request only information needed to match the request and verify authority, route it to the authorized privacy handler, and record the decision and any approved action in a restricted record. An Inquiry Reader cannot edit or delete website records. HC PACKAGING VIETNAM COMPANY LIMITED is responsible for decisions on privacy requests received through hc@hcpackagingasia.com. A Reader may route a request to that contact, but has no authority to edit or delete the inquiry database. An authorised privacy decision maker must approve the decision and its scope; an authorised technical administrator must carry out any approved change to website records. The operator must assign these responsibilities and restricted case-record access before this process is represented as operational.
The manual procedure must record a case reference, receipt date, request scope, proportionate identity or authority checks, the decision and reason, the affected records or channels, the approving and executing roles, action date, verification result and any exception review date. Identity checks should use the minimum information needed to match the request and protect against unauthorised disclosure or erasure. Additional sensitive identity documents should not be requested routinely. A request must not be sent back to a Reader as if the Reader had deletion powers.
A technical action must be limited to the approved records, checked after execution and coordinated with the relevant backup-restoration suppression and external-channel records. The present custom inquiry implementation does not provide an automated privacy-request, export or erasure function, and this notice does not claim that WordPress's general privacy tools automatically cover its inquiry table. Email or WhatsApp records require separate handling through the appropriate authorised channel.
Requests, withdrawals, objections, restrictions, corrections and removal decisions must be handled within the time periods and conditions that applicable law actually requires. No fixed statutory response period or guaranteed erasure outcome is asserted here without that assessment. Where a request cannot be fulfilled in full, the response must identify the relevant lawful reason and any required escalation or complaint route, without disclosing information that applicable law requires to remain restricted.
Final notice and changes
The final notice will identify its approved domain, effective date and operating scope. Material changes in form fields, recipients, hosting, retention, contact handling or tracking require a fresh review of the notice before those changes are represented publicly.