Privacy Notice

1. Data Controller Information

The data controller in charge of any personal information obtained through this website and our analytical intake system is:

2. What Personal Information Do We Collect and How?

We collect personal information that you provide when submitting sample test orders, requesting price estimates, querying Certificates of Analysis (COAs), or communicating with our laboratory chemists.

Such personal information typically includes:

• Identity Information: Full name, professional title, research group, and institution or company name;
• Contact Details: E-mail address, professional telephone or mobile number, and physical mailing address for sample collection or return;
• Sample & Testing Data: Batch/lot numbers, blind sample codes, compound identifiers, HPLC/MS test requirements, and shipment tracking identifiers;
• Billing & Transaction Details: Invoicing information, transaction reference IDs, and payment verification (processed via secure PCI-DSS compliant gateways);
• Technical & Usage Data: IP address, browser type, device information, and audit logs recorded when querying certificate serials on our public verification portal.

3. Why Do We Use Personal Information About You?

We process the information collected through our website and intake manifests for the following lawful purposes:

• Executing and fulfilling laboratory testing contracts, including quantitative HPLC purity assays, LC-MS molecular weight confirmation, and contaminant screenings;
• Generating, issuing, and maintaining authentic Certificates of Analysis (COAs) and cryptographic verification records;
• Processing and responding to sample intake requests, quotation calculations, and technical inquiries;
• Coordinating secure courier intake (via SF Express, DHL, FedEx) and sample reception at our Hong Kong Science Park laboratory;
• Maintaining the security, integrity, and anti-counterfeit protection of our public COA verification database;
• Complying with laboratory accreditation standards (ISO/IEC 17025, ISO 15189, ISO 27001) and statutory legal requirements under Hong Kong and international law;
• Preventing laboratory fraud, unauthorized access, and altered Certificate counterfeiting.

4. Legal Grounds for Processing

Depending on the context, we rely upon the following legal bases to process your personal data:

1. Contractual Performance: Processing necessary to execute the testing agreement entered into with you or your organization;
2. Accreditation & Legal Obligations: Retention of analytical raw chromatograms, sequence files, and audit records as mandated by ISO/IEC 17025 and Hong Kong regulations;
3. Legitimate Interests: Operating a secure, tamper-proof certificate verification registry, safeguarding intellectual property, and optimizing our analytical equipment workflow;
4. Explicit Consent: Where you have provided voluntary consent (e.g. subscribing to analytical research bulletins or specialized notifications).

5. Withdrawal of Consent

Where processing is based on your consent, you have the right to withdraw your consent in full or in part at any time by contacting our compliance officer at [email protected]. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

6. Who Your Personal Information Will Be Transferred To

We do not sell, rent, or trade your personal data. Your personal data is strictly protected under non-disclosure obligations and will only be shared in the following limited circumstances:

• Authorized Laboratory Personnel: Senior chemists and analysts bound by strict professional confidentiality;
• Logistics & Courier Providers: Designated shipping couriers (e.g., SF Express, DHL) strictly for transporting sample packages;
• Secure Infrastructure Providers: ISO 27001 certified cloud database and server providers hosting our encrypted registry;
• Accreditation Auditors: Qualified third-party accreditation bodies (e.g., HOKLAS, HKAS, Bureau Veritas) during standard quality compliance audits;
• Legal & Regulatory Authorities: When required by enforceable court orders or statutory legal obligations under Hong Kong law.

7. Cross-Border & International Data Transfers

As an international analytical laboratory serving clients across Asia, Europe, and the Americas, laboratory reports and Certificates of Analysis may be transmitted internationally. All international transfers are encrypted using TLS 1.3 cryptographic protocols and comply with applicable cross-border data transfer safeguards.

8. Your Rights Under Hong Kong PDPO & International Law

You are entitled to exercise the following data protection rights:

• Right of Access: Request a copy of the personal information we hold concerning you;
• Right to Rectification: Request correction of inaccurate, incomplete, or outdated personal information;
• Right to Erasure: Request deletion of your personal data when no longer required for analytical contract fulfillment or ISO compliance;
• Right to Restriction: Request restriction of processing under specific statutory conditions;
• Right to Data Portability: Obtain your digital testing data in a structured, commonly used machine-readable format.

To submit a request, please email [email protected] with the subject line "Data Access Request - [Your Name]".

9. Data Retention Period

Your personal and testing data will be retained only for as long as necessary to fulfill the analytical purposes for which it was collected. In accordance with ISO/IEC 17025 laboratory accreditation standards, analytical records and raw chromatography data are maintained for a minimum of 5 to 10 years to guarantee verifiable audit trails and public COA verification integrity.

10. Updates to This Privacy Notice

We may periodically update this Privacy Notice to reflect enhancements in our laboratory processes, technology, or legal requirements. Any modifications will become effective immediately upon posting to this page.

Last Revised: August 15, 2026 • Zenith BioChemical Laboratories (Hong Kong) Limited