See your European and US buyers, not your mainland traffic

Reliable detection of visitors inside mainland China is not something lead.box offers, and we do not want to overstate this. The product is built and tuned to resolve company-level identity for organisations browsing from Europe and the United States, using network-level signals that are well mapped for those regions. Traffic originating from mainland China networks falls outside that coverage in practice, and lead.box does not process or store personal information relating to individuals located in mainland China. If your export site also draws meaningful mainland traffic and you need visibility into that segment, this product is not the tool for it, and you would need a mainland-specific solution assessed separately under the PIPL.

We do not claim PIPL compliance, because that claim would be inaccurate. The Personal Information Protection Law, in force since November 2021 and enforced by the Cyberspace Administration of China, sets its own consent standard, its own rules for cross-border transfer including security assessments, standard contracts and certification routes, and its own scope of personal information. lead.box has not sought PIPL certification and has not been assessed against it, because the product avoids the underlying trigger: it does not process personal information about individuals located in mainland China. What lead.box does claim, and can document, is GDPR-aligned processing of company-level data for European and US visitors, handled in EU data centres under a data processing agreement.

Because lead.box resolves the visiting organisation, not an individual, and the buyer company sits in Europe or the United States rather than mainland China, the applicable legal reasoning is GDPR-style, not PIPL-style. The usual basis is legitimate interest under Art. 6(1)(f) GDPR, supported by a documented balancing test that weighs the exporter's interest in identifying business visitors against the low intrusiveness of company-level, non-individual data. A European or US buyer's own procurement or legal team may ask a Chinese exporter for the same processor documentation any GDPR-facing vendor would provide, including a data processing agreement and sub-processor list, and lead.box supplies both so that chain of accountability is complete on request.

No. Identification runs from company-level network signals rather than cookies, local storage, device fingerprints or any advertising identifier, and it does not attempt to name or profile an individual person behind a visit. The output is a company name, not a person, which is the distinction that matters both for GDPR reasoning around European and US visitors and for keeping the product out of the personal information categories the PIPL, the Data Security Law and the Cybersecurity Law regulate for mainland China. This design choice was made deliberately to keep the product's claims narrow and defensible rather than to stretch coverage into jurisdictions or data categories it cannot properly support.

Chinese export manufacturers and trading companies typically run a small commercial team tracking a defined set of named accounts across export markets rather than a high-volume inbound funnel, often mixing WeChat-based internal coordination with email and phone follow-up toward overseas buyers. lead.box exports identified European and US companies as a CSV or Excel list, or pushes them by webhook into whichever CRM the export team already runs, so the export sales staff can see which named buyer researched a product page after a trade fair conversation or an initial quotation request. A weekly list of researching companies, timed against known trade-show and RFQ cycles, tends to fit this workflow better than a real-time alert dashboard.

A data processing agreement under Art. 28 GDPR is available, along with a published, versioned sub-processor list, and both can be reviewed before signing rather than requested mid-negotiation. Company-level data concerning European and US visitors is processed and stored in ISO-certified EU data centres, and that EU data is not routed through or stored in mainland China as part of this service. This matters for two separate reasons: it keeps the product aligned with GDPR-style expectations that a European or US buyer's own legal team may hold, and it avoids raising the cross-border transfer questions that mainland Chinese data would trigger under the Data Security Law if the product processed it, which it does not.

Rollout is a first-party JavaScript snippet added once to the site, after which identified European and US companies typically start appearing within the first days as qualifying traffic arrives, with no separate onboarding project required. Teams can add colleagues as seats, export results as CSV, Excel or JSON, and wire a webhook into an existing CRM or spreadsheet workflow without custom development. Because many export sites already run analytics or chat widgets, the snippet is designed to sit alongside those without conflicting, and it does not require changes to a site's cookie banner or consent management setup, since it does not rely on the device-level storage those tools govern.

Company-level identification resolves the organisation behind a visit from network-level signals, primarily IP address ranges associated with a known business, and accuracy depends on how cleanly a visitor's network maps to a specific company; visits from home connections, mobile networks, VPNs or shared hosting cannot be reliably resolved and are excluded rather than guessed. For internationally active buyers with recognisable corporate networks — the profile of most European and US procurement teams researching a Chinese supplier — resolution tends to be strong. Coverage for visitors on mainland Chinese networks is limited for the reasons already described, and the tool should be treated as a signal to prioritise follow-up, not as a verified, individually attributed contact record.