Who is responsible
CPS Biotech (HK) Limited decides how your data is used and answers for it. Write to us on WhatsApp or through the contact page.
What we collect
When you write to us on WhatsApp or by e-mail, we keep your message and the contact details you give us: your name, company or laboratory, phone number, e-mail address and delivery address.
When you order, we also keep what you ordered, your invoices and your payment records, including the payment reference and any proof of payment you send us.
Why we use it
We use your data to answer you, to quote, to make and ship your order, to invoice you and to handle any customs question, refund or complaint.
For buyers in the European Union, the legal bases are performing our contract with you, meeting our legal duties on financial records, and our legitimate interest in running and protecting the business. We do not send marketing unless you ask for it, and we make no automated decisions about you.
Who receives it
We do not sell or rent your data. The manufacturer that packs your order receives the name, company, delivery address and phone number it needs to ship it, and not your payment details or our prices. The carrier receives the same shipping details, and customs authorities can receive them with the shipping documents.
Companies that run our systems process data for us under contract: hosting and database, encrypted backup storage, messaging and e-mail. Our banks and payment providers see the payments you make. We also disclose data when the law requires it.
Transfers outside your country
Our systems and the companies above work in several countries, including outside Hong Kong and the European Union, and our main database is in Singapore. When we send data from the European Union to a country without an adequacy decision, we rely on standard contractual clauses or on what is necessary to perform your contract, such as shipping your order to you.
How long we keep it
We keep invoices, payment records and the order details behind them for 7 years, because financial records must be kept that long. Those documents show the name and address they were issued to.
Messages and contact details that are not part of a financial record are removed when you ask, or when we no longer need them. Encrypted backups are kept for up to 12 months and then deleted. If we ever restore one, we apply your erasure request again.
Analytics and cookies
This site does not use analytics, advertising pixels or tracking cookies. Our hosting provider keeps standard server logs for security.
Your rights
You can ask to see your data, correct it or have it erased. Write to us on WhatsApp or through the contact page. We answer within 30 days. When we erase, we remove your personal data from our working records, and the financial records above stay for their 7 years.
Buyers in the European Union can also ask us to restrict or stop a use of their data, ask for a copy to take elsewhere, and complain to their local data protection authority. In Hong Kong you can complain to the Privacy Commissioner for Personal Data.