Privacy Notice

1. Regional Data Controllers

Depending on your geographic location and sample intake hub, the designated data controller responsible for personal information obtained through our platforms is:

2. What Personal Information Do We Collect and How?

We collect personal information that you provide when submitting sample test orders, requesting price estimates, querying Certificates of Analysis (COAs), or communicating with our laboratory chemists.

Such personal information typically includes:

• Identity Information: Full name, professional title, research group, and institution or company name;
• Contact Details: E-mail address, professional telephone or mobile number, and physical mailing address for sample collection or return;
• Sample & Testing Data: Batch/lot numbers, blind sample codes, compound identifiers, HPLC/MS test requirements, and shipment tracking identifiers;
• Billing & Transaction Details: Invoicing information, transaction reference IDs, and payment verification (processed via secure PCI-DSS compliant gateways);
• Technical & Usage Data: IP address, browser type, device information, and audit logs recorded when querying certificate serials on our public verification portal.

3. Why Do We Use Personal Information About You?

We process the information collected through our website and intake manifests for the following lawful purposes:

• Executing and fulfilling laboratory testing contracts, including quantitative HPLC purity assays, LC-MS molecular weight confirmation, and contaminant screenings;
• Generating, issuing, and maintaining authentic Certificates of Analysis (COAs) and cryptographic verification records;
• Processing and responding to sample intake requests, quotation calculations, and technical inquiries;
• Coordinating secure courier intake (via DHL, FedEx, UPS, SF Express) and sample reception at our Frankfurt, Hong Kong, and São Paulo laboratories;
• Maintaining the security, integrity, and anti-counterfeit protection of our public COA verification database;
• Complying with laboratory accreditation standards (DAkkS, HKAS/HOKLAS, INMETRO, ISO/IEC 17025, ISO 15189, ISO 27001) and statutory legal requirements;
• Preventing laboratory fraud, unauthorized access, and altered Certificate counterfeiting.

4. Legal Grounds for Processing

Depending on the context, we rely upon the following legal bases to process your personal data under EU GDPR (Art. 6), HK PDPO, and Brazilian LGPD (Art. 7):

1. Contractual Performance: Processing necessary to execute the testing agreement entered into with you or your organization;
2. Accreditation & Legal Obligations: Retention of analytical raw chromatograms, sequence files, and audit records as mandated by ISO/IEC 17025 and applicable jurisdictional regulations;
3. Legitimate Interests: Operating a secure, tamper-proof certificate verification registry, safeguarding intellectual property, and optimizing our analytical equipment workflow;
4. Explicit Consent: Where you have provided voluntary consent (e.g. subscribing to analytical research bulletins or specialized notifications).

5. Withdrawal of Consent

Where processing is based on your consent, you have the right to withdraw your consent in full or in part at any time by contacting our compliance officer at [email protected]. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

6. Who Your Personal Information Will Be Transferred To

We do not sell, rent, or trade your personal data. Your personal data is strictly protected under non-disclosure obligations and will only be shared in the following limited circumstances:

• Authorized Laboratory Personnel: Senior chemists and analysts bound by strict professional confidentiality;
• Logistics & Courier Providers: Designated shipping couriers (e.g., DHL, FedEx, UPS, SF Express) strictly for transporting sample packages;
• Secure Infrastructure Providers: ISO 27001 certified cloud database and server providers hosting our encrypted registry;
• Accreditation Auditors: Qualified third-party accreditation bodies (e.g., DAkkS, HKAS, INMETRO/CGCRE, Bureau Veritas) during standard quality compliance audits;
• Legal & Regulatory Authorities: When required by enforceable court orders or statutory legal obligations under applicable law.

7. Cross-Border & International Data Transfers

As an international analytical laboratory serving clients across Europe, Asia-Pacific, and Latin America, laboratory reports and Certificates of Analysis may be transmitted internationally. All international transfers are encrypted using TLS 1.3 cryptographic protocols and comply with Standard Contractual Clauses (SCCs) under EU GDPR, HK PDPO cross-boundary principles, and LGPD transfer rules.

8. Your Rights Under EU GDPR, Hong Kong PDPO & Brazilian LGPD

You are entitled to exercise the following comprehensive data protection rights:

• Right of Access & Information: Request a copy of the personal information and analytical records we hold concerning you;
• Right to Rectification: Request correction of inaccurate, incomplete, or outdated personal information;
• Right to Erasure ('Right to be Forgotten'): Request deletion of your personal data when no longer required for analytical contract fulfillment or ISO compliance;
• Right to Restriction of Processing: Request restriction of processing under specific statutory conditions;
• Right to Data Portability: Obtain your digital testing data in a structured, commonly used machine-readable format;
• Right to Object & Revoke: Object to processing based on legitimate interests or revoke prior consent.

To submit a request, please email [email protected] with the subject line "Data Privacy Request - [Your Name]".

9. Data Retention Period

Your personal and testing data will be retained only for as long as necessary to fulfill the analytical purposes for which it was collected. In accordance with ISO/IEC 17025 laboratory accreditation standards, analytical records and raw chromatography data are maintained for a minimum of 5 to 10 years to guarantee verifiable audit trails and public COA verification integrity.

10. Updates to This Privacy Notice

We may periodically update this Privacy Notice to reflect enhancements in our laboratory processes, technology, or legal requirements across Germany, Hong Kong, and Brazil. Any modifications will become effective immediately upon posting to this page.

Last Revised: August 2026 • Zenith BioChemical Laboratories International Network