1. Scope of This Policy
This policy applies to all personal information that is processed through this website and through the plaza desk services that HeZe ZhongHao Network Technology Co., Ltd. provides to clients, partners, sellers and visitors. It covers the pages that carry the plaza tile navigation, the pages that describe our six service stations, the contact form, and any correspondence that travels through the desk mailbox or the desk telephone line. It does not cover websites that we do not own or control, even when a link from our plaza leads to them.
The services we describe are offered to businesses and professionals. When we provide computer integrated systems design work, most of the information we handle relates to companies rather than to individual people. Personal information still enters the record at many points, for example when a named engineer signs a letter, when a seller includes a personal contact in a message, or when a visitor submits a question through the contact form. This policy is written so that those personal details are handled with the same care as any other record kept at the desk.
We may operate additional service channels in the future, including invitation only portals or partner windows. Unless a separate notice is provided for such a channel, this policy governs the personal information handled in it as well. If a specific channel requires different handling, we will present a clear notice at the point where the information is collected.
2. Who Controls Your Information
HeZe ZhongHao Network Technology Co., Ltd. is the controller of the personal information described in this policy. The company decides why information is collected and how it is used, and it is accountable for the way that information is protected. The company is registered in China and works from No 01027, Building B2, Wanjia New Town, Yingbin Road, Nancheng Subdistrict, Mudan District, HeZe City - 274000, China (CN).
The developer CentralHero builds and maintains the technical systems behind the plaza, including this website, the desk mailbox workflow and the internal record keeping tools. CentralHero acts on the instructions of the company and does not use personal information for any independent purpose. Where the law requires a named representative or a data protection contact, that role is handled through the desk mailbox at hero@centralhero.autos, and messages sent there are routed to the person responsible for privacy matters.
If the company is reorganised, merged or transferred, personal information may be part of the records that pass to a successor entity. In that situation the successor must honour this policy, and we will notify affected people before any materially different use of their information begins.
3. Information We Collect
The plaza desk collects only the information it needs to answer a request, prepare a plan, keep a record or maintain a working relationship. The categories below describe what we may collect in practice.
Identity and contact details include the name of a person, the name of a company, a job title, a postal address, an email address and a telephone number. We collect these details when someone submits the contact form, writes to the desk mailbox, calls the desk line or attends a sitting at the plaza.
Correspondence and records include the content of messages, the attachments that accompany them, the dates of exchanges, the notes produced during a plaza sitting, and the seller letters that pass through the desk. When a message refers to a project, we keep the reference so that the record can be understood later without reopening the whole file.
Project information includes the documents, diagrams, network plans, specifications and other materials that a client shares so that we can perform systems design work. Some of this material may describe individuals, such as named administrators or named site contacts, and it is handled under the confidentiality rules described in our Terms of Service.
Technical information includes the internet protocol address from which a page is requested, the type of browser and device used, the referring page, and the time of the request. This information is generated automatically by the web server and is used to keep the site available and secure.
Billing information includes the invoicing contact, the purchase order reference and the payment status of an engagement. We do not store full payment card numbers on the plaza systems. Where card payment is arranged, it is handled through a payment provider that applies its own security standards.
4. How We Obtain Information
Most of the information we hold comes directly from the person it concerns. A visitor fills in the contact form. A client sends a brief to the desk mailbox. A seller posts a letter that is logged at the seller letter desk. An attendee of a plaza sitting agrees to a short written record of the discussion.
We also receive information through the ordinary operation of the website. The server records a technical log for each request. The site may set a small preference cookie so that the navigation remembers the last section visited. These records do not attempt to identify a visitor personally, and they are not used to build advertising profiles.
In some cases a client shares information about other people, for example a site administrator who must be contacted before a network change. When this happens, the client is responsible for making sure that those people understand why their details are being shared with us. We use such details only to perform the work described in the engagement and we do not add them to any mailing list.
Public sources may also contribute to a project record. If a company publishes a network standard, a procurement notice or a public address, that published material may be included in the file. We treat public material as public, but we do not combine it with private information in ways that would reveal more than the source already reveals.
5. Why We Use Information
We use personal information to answer questions and requests that arrive at the plaza desk. This includes replying to the contact form, scheduling a sitting, preparing a hero sheet and sending the resulting record to the people who asked for it.
We use information to deliver the services described on our services page. Hero sheet bays need the project summary. Plaza note runs need the observations gathered on site. Seller letter desks need the correspondence history. Network windows need a controlled view of current status. Link review rounds need the details of every connection under test. Plaza sittings need the names of the participants and a short record of the outcome.
We use information to keep the website working and secure. Technical logs help us detect abusive traffic, recover from faults and understand which pages are being read. They are not used to target advertising.
We use information to meet legal and accounting duties. Invoices, contracts and tax records must be kept for the periods that the law requires. Where a dispute arises, the records of the engagement may be used to resolve it.
We use information to improve the desk itself. Reading patterns on the public pages help us decide which explanations are unclear and which service descriptions need a better sentence. We look at aggregated patterns rather than individual behaviour when we make those decisions.
We do not use personal information for purposes that are incompatible with the reasons for which it was collected. If a new purpose arises, we will either seek consent or explain the change and the lawful ground that supports it.
6. Lawful Grounds for Processing
Where the law of a relevant jurisdiction requires a lawful ground, we rely on one or more of the following grounds. The first is the performance of a contract or the steps needed before a contract is formed. When a client asks us to prepare a hero sheet and then engages us for design work, the contact details and project materials are needed to carry out that engagement.
The second ground is our legitimate interest in running a professional desk. Answering enquiries, protecting the website, keeping accurate business records and improving our service descriptions are interests that we pursue in a way that respects the rights of the people concerned. We assess those interests before relying on them and we offer an easy way to object.
The third ground is legal obligation. Accounting, tax and record keeping rules require us to retain certain information for defined periods, and we comply with those rules even where a person would prefer earlier deletion.
The fourth ground is consent. Where we ask for consent, for example before adding a person to an occasional desk update, the person may withdraw that consent at any time. Withdrawal does not affect processing that took place before the withdrawal. We never make a service conditional on consent to marketing.
9. Service Providers and Processors
Each service provider that handles personal information for us is selected with care. Before a provider is engaged, we check that it can apply appropriate security measures, that it will process information only on our instructions, and that it will assist us if a person exercises a right or if an incident occurs.
Provider contracts include obligations on confidentiality, security, sub processing, deletion and audit. A provider may not appoint its own sub processors without our knowledge, and it must apply protections at least as strong as those we require of it. When a provider no longer serves the desk, we require the return or deletion of the information it held for us.
The main categories of providers are hosting and infrastructure, email delivery, accounting and invoicing, and professional advice. A provider that only handles technical metadata does not receive the contents of client correspondence. A provider that receives correspondence is bound by the same confidentiality terms that apply to the desk.
We review provider arrangements from time to time, and we update them when the law or the nature of the service changes. If a provider relationship changes in a way that affects personal information, we reflect that change in this policy where the change is material.
10. International Transfers
HeZe ZhongHao Network Technology Co., Ltd. works from China, and the plaza desk records are kept in facilities that may be located in China or in another country where our providers operate. As a result, personal information may be transferred across borders when a client or visitor is located elsewhere.
When we transfer information across a border, we use a recognised safeguard. That may be a contractual clause approved for the purpose, an adequacy decision that covers the destination, or another lawful mechanism. Where a safeguard requires additional measures, such as encryption in transit and at rest, we apply those measures before the transfer takes place.
A visitor or client may ask for more detail about the safeguards that apply to a specific transfer. The desk mailbox at hero@centralhero.autos is the route for such a request, and we will answer it within the time required by applicable law.
Transfers between the company and the developer CentralHero are covered by the same safeguards. CentralHero does not move personal information to any further destination for its own purposes.
11. How Long We Keep Information
We keep personal information only for as long as it is needed for the reason it was collected, or for as long as the law requires. The periods below describe the usual practice at the plaza desk.
Enquiries that do not lead to an engagement are kept for a short period so that we can follow up, and are then removed from the working file. Correspondence that becomes part of an engagement is kept for the duration of the engagement and for a defined period afterwards, so that a client can return to the desk and read the record.
Project records, including hero sheets, plaza notes, seller letters, network window logs, link review findings and plaza sitting records, are kept for the period agreed in the engagement or, where no period is agreed, for the period that professional practice and legal obligation require.
Accounting and tax records are kept for the period set by law, which may be longer than the period for other records. When the legal period ends, the records are deleted or anonymised.
Technical logs are kept for a short period that allows fault diagnosis and abuse investigation, after which they are deleted or reduced to aggregated statistics. A log that is needed for an ongoing investigation is kept until the matter is closed.
When a record is deleted, it is removed from active systems and from backups within the normal backup cycle. Where deletion is not immediately possible because of a backup schedule, the record is placed beyond ordinary use and is deleted as soon as the cycle completes.
12. How We Protect Information
The plaza desk applies technical and organisational measures to protect the information it holds. Access to the working file is limited to the people whose role requires it, and access is reviewed when a role changes. Accounts are protected by strong authentication, and administrative access is logged.
Information is encrypted in transit between a visitor and the website, and sensitive records are encrypted at rest. The servers that hold the records are kept in facilities that apply physical access controls, environmental protection and monitored entry.
Staff and contractors are bound by confidentiality agreements and receive guidance on handling personal information. The guidance covers the recognition of suspicious messages, the safe handling of attachments, the correct route for a privacy request, and the steps to take when an incident is suspected.
We test the website and the desk workflow from time to time to check that the protections still work. A finding that affects personal information is corrected promptly, and the correction is recorded so that the same weakness does not return.
No system can promise absolute security. If a security incident does occur, we follow the response steps described later in this policy and we inform affected people where the law requires it or where the risk to them is significant.
13. Your Rights and Choices
Subject to the law that applies to you, you may have the right to be informed about the personal information we hold and the way we use it. This policy provides that information in a general form, and the desk will answer a specific question on request.
You may have the right of access, which means you can ask for a copy of the personal information we hold about you and for an explanation of the purposes and recipients. You may have the right to correction, which means you can ask us to fix information that is inaccurate or incomplete. You may have the right to deletion, which means you can ask us to remove information that we no longer need or that we have no lawful ground to keep.
You may have the right to restriction, which means you can ask us to pause the use of information while a question about it is resolved. You may have the right to object, which means you can ask us to stop a use that rests on our legitimate interest. You may have the right to data portability, which means you can ask for certain information in a structured and machine readable form.
You may withdraw consent at any time where consent is the ground for processing. You may also ask us not to send you desk updates, and we will stop unless a legal obligation requires a specific notice.
To exercise a right, write to hero@centralhero.autos or call +19899354798. We may need to confirm identity before acting, so that information is not released to the wrong person. We answer requests within the time required by applicable law and we explain any reason why a request cannot be fully met.
14. Access, Correction and Deletion
A request for access should describe the information sought and, where possible, the period and the project to which it relates. This helps the desk locate the record quickly and reduces the risk of releasing information about another person by mistake.
A request for correction should identify the information that is wrong and explain what the correct information is. Where a record is a note of a conversation rather than a statement of fact, we may add a correction note rather than rewrite the original, so that the history remains honest.
A request for deletion is honoured where the information is no longer needed, where consent is withdrawn and no other ground applies, where the processing was unlawful, or where the law requires deletion. We may keep a limited record of the request itself so that we can show that it was handled correctly.
Where we cannot delete information because a legal obligation requires us to keep it, we will explain the obligation and the period involved. The information will be restricted to the purpose that the obligation requires and will not be used for anything else.
If a request concerns information that a client shared with us, we may need to consult the client before acting, because the record may belong to the engagement rather than to the individual. In that case we will coordinate the response so that the client and the individual receive a consistent answer.
15. Privacy for Children
The plaza desk provides services to businesses and professionals. The website is not directed to children, and we do not knowingly collect personal information from a child. If a child sends a message to the desk, we will use the message only to reply and to explain that the service is intended for business users.
If a parent or guardian believes that a child has provided personal information to the desk, they may write to hero@centralhero.autos. We will check the record and delete the information unless a legal obligation requires us to keep it. We will confirm the outcome to the parent or guardian.
We do not use the website to advertise to children, and we do not operate features that encourage children to submit personal details. Any future feature that could appeal to a younger audience will be assessed before release and will include appropriate protections.
16. Marketing and Communications
The desk sends transactional messages as a normal part of its work. These include replies to enquiries, confirmations of a sitting, delivery of a hero sheet and notices about an engagement. Transactional messages are not marketing and are sent because the service requires them.
Occasional desk updates are sent only to people who have asked for them or who have an existing relationship and have not objected. Every update includes a simple way to stop future messages, and a stop request is acted on promptly.
We do not buy contact lists and we do not add a person to an update list merely because that person attended a meeting. A business card handed to the desk does not by itself authorise marketing.
If you receive a message from the desk that you believe you should not have received, reply to it or write to hero@centralhero.autos. We will investigate and correct the list. We keep a suppression record so that a person who has asked to stop is not added again by mistake.
17. Third Party Links and Windows
The website may link to third party pages, for example a standards body, a public register or a partner website. Those pages are governed by their own privacy notices, and we are not responsible for the way they handle information. We encourage a visitor to read the notice on any third party page before submitting details there.
A network window may display content that originates from a client system. The window is designed to show only the status that the client has agreed to publish, and it does not grant access to the underlying records. Where a window links to a client page, the client notice applies from the moment the visitor leaves our site.
We check the links we publish when they are added, but a third party page can change without notice. If a visitor finds a link that leads to an unsuitable destination, a report to the desk mailbox helps us correct it.
18. Automated Decisions and Profiling
The plaza desk does not make decisions with legal or similarly significant effects about a person through automated means. When we prepare a hero sheet or a link review, the judgement is made by people who read the material and discuss it at the desk.
Some routine operations are automated. The server may block a request that matches a pattern of abuse. The desk mailbox may filter a message that looks like bulk advertising. These measures affect the delivery of a message, not the rights of a person, and a blocked message can be restored by contacting the desk.
If we ever introduce a tool that scores enquiries or prioritises work automatically, we will describe it in this section, explain the logic in plain terms, and offer a way to request human review. We will not use such a tool to deny a service without a person having the chance to look at the case.
19. Data Breach Response
If we become aware of a personal data breach, we act quickly to contain it. The first step is to stop the loss and secure the affected systems. The second step is to establish what information was involved, who may be affected, and what harm could follow. The third step is to record the facts so that the response can be reviewed later.
Where the law requires notification to a supervisory authority, we notify within the required period and include the information that the authority needs. Where the law requires notification to affected people, we contact them directly and explain what happened, what we have done, and what they can do to reduce risk.
We also notify clients whose project records are affected, even where the law does not strictly require it, because a plaza record belongs to the engagement. The notice is written in plain language and avoids speculation about causes until the facts are confirmed.
After an incident, we review the cause and change the controls that failed. The review is documented, and the lessons are shared with the people who work at the desk so that the same incident does not repeat.
20. Changes to This Policy
We review this policy from time to time. A change may be needed because the law changes, because the desk introduces a new service, or because a provider arrangement changes. When we make a change, we update the effective date at the top of the page and, where the change is material, we add a short note that explains what changed.
If a change affects the way we use information that we already hold, we will tell the people concerned before the new use begins, unless the law allows the change without notice. Where consent is required for the new use, we will ask for it clearly and separately.
Earlier versions of the policy are kept with the desk records so that a person can see what the policy said at the time their information was collected. A request for an earlier version can be made to the desk mailbox.
21. Complaints and Contact
If you have a question, a concern or a complaint about privacy, please contact the desk first. Most matters can be resolved quickly when the details are clear. Write to hero@centralhero.autos, call +19899354798, or send a letter to No 01027, Building B2, Wanjia New Town, Yingbin Road, Nancheng Subdistrict, Mudan District, HeZe City - 274000, China (CN).
Please include enough detail for us to understand the matter, such as the date of the interaction, the channel used and the outcome you would like. Do not send passwords or full payment details in an email. If identity verification is needed, we will ask for it through a secure route.
We acknowledge a complaint within a reasonable period and aim to give a substantive answer within thirty days. If the matter is complex, we will explain why more time is needed and give an expected date. If you are not satisfied with our answer, you may have the right to complain to a supervisory authority in your country.
Desk contact details
HeZe ZhongHao Network Technology Co., Ltd.
No 01027, Building B2, Wanjia New Town, Yingbin Road, Nancheng Subdistrict, Mudan District, HeZe City - 274000, China (CN)
Email: hero@centralhero.autos
Phone: +19899354798