Privacy Policy

a) Information you provide to us. When you complete the inquiry form on our Site or contact us by email, phone or WhatsApp, we collect the personal details you choose to give us, including:

• Full name and company name;
• Email address and phone / WhatsApp number;
• Target market and countries you sell to (if you tell us);
• Product interest, estimated order quantity and formulation / packaging / certification requirements;
• Any other details you include in your message.

b) Information collected automatically. When you browse the Site, our hosting and analytics providers may automatically collect limited technical data, such as your IP address, browser type and language, device type, operating system, approximate geographic location, pages visited, referring URL and time of visit. This data is used in aggregate to keep the Site secure and improve its performance.

c) Information we do NOT collect. We do not request or collect sensitive categories of personal data (such as health, religious or political information) through this Site. We do not knowingly collect credit card numbers on this website — see Section 6 below.

We use the information we collect for the following purposes:

• Responding to your inquiry — reviewing your requirements and sending you product information, quotations, samples and technical documentation;
• Customer relationship management — communicating with you about your project, providing after-sales support and following up on your request;
• Improving our services — understanding which products and markets our customers are interested in so we can improve our product range and website experience;
• Security and fraud prevention — protecting the Site and our systems against misuse, attacks and illegal activity;
• Legal compliance — meeting our obligations under applicable laws and responding to lawful requests from regulators or authorities;
• Marketing (only with your consent) — if you have agreed to receive updates, we may send you occasional industry news or new-product announcements. You may opt out at any time by replying "unsubscribe" or contacting us.

We will never sell or rent your personal information to anyone.

Where the GDPR or similar laws apply, we process your personal data on the following legal grounds:

• Performance of a contract / pre-contractual steps — when you ask for a quotation or samples, processing is necessary to take steps at your request before entering into a business relationship;
• Legitimate interests — for security, fraud prevention, service improvement and business follow-up, where our interests do not override your fundamental rights;
• Consent — where we rely on your consent (e.g. for marketing communications), you may withdraw it at any time;
• Legal obligation — where processing is required to comply with applicable laws.

Where the UAE PDPL or the Saudi PDPL applies to you, we process personal data only for lawful, specific and legitimate purposes described in this Policy.

Our Site uses a small number of cookies and similar technologies:

• Essential cookies — required for the correct operation of the Site;
• Analytics and advertising cookies — we use services such as Google Analytics and Google Ads (including Google Tag Manager) to measure site traffic and the effectiveness of our advertising. These services may set cookies that collect aggregate browsing data and help us understand which pages are visited. Where required by law, advertising cookies are only served after you have given consent through the consent banner.

You can control or delete cookies through your browser settings at any time. Blocking certain cookies may affect parts of the Site's functionality. To learn how Google uses data when you use our Site, please visit policies.google.com/technologies/partner-sites.

We apply appropriate technical and organisational measures to protect your personal information against loss, misuse, unauthorised access, alteration and disclosure:

• Encryption in transit. All data exchanged between your browser and our Site is encrypted with SSL/TLS (HTTPS). Your inquiry form data is transmitted securely.
• Secure infrastructure. The Site is served through Cloudflare's global CDN, which provides DDoS protection and additional security layers.
• Access control. Only authorised HP Biotech staff who need the data to answer your inquiry can access the emails and records containing your information, and they are bound by confidentiality obligations.
• Data minimisation. We collect only the information reasonably needed to respond to your request.
• Staff training & procedures. Our team follows internal procedures for handling customer inquiries and personal data.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security; we will notify you and the relevant supervisory authority of any data breach where we are legally required to do so.

Our current website is an informational and inquiry site — it does not collect, process, transmit or store any credit card, debit card or other payment card details. We do not ask you to enter card numbers anywhere on this Site, and we request that you never send card numbers by email or through form submissions.

If we introduce online payments in the future, they will be processed exclusively by PCI-DSS certified third-party payment gateways under their own security controls. Your full card number would be handled directly by the payment provider and never stored on our servers. We will update this Policy before any such feature is launched.

For any commercial transactions concluded offline (e.g. by bank transfer), we use the standard banking security measures of the issuing and receiving banks.

We only share personal information in the limited circumstances described below:

• Service providers. Your inquiry form is delivered to us through FormSubmit, a third-party form-to-email service, and is then received at our business email (hp@xahpsw.cn). We may also use IT, hosting and email service providers (including Cloudflare) that process data on our behalf under confidentiality agreements;
• Business partners with your consent. We never share your data with third parties for their own marketing purposes;
• Legal requirements. We may disclose information where required by law, regulation, legal process or governmental request, or to protect our legal rights and the safety of our users;
• Business transfer. In the event of a merger, acquisition or sale of assets, personal data may be transferred as part of the transaction, subject to this Policy continuing to apply.

HP Biotech operates from the People's Republic of China. Your information is transmitted to us in China and may also pass through or be stored on servers in other countries (for example, the servers used by FormSubmit, Cloudflare and our email provider). When personal data is transferred across borders to a country that may not provide the same level of data protection as your home country, we rely on appropriate safeguards — such as standard contractual clauses or the service provider's certified compliance programmes — to protect your data. By submitting your information, you acknowledge this international processing.

We keep personal information only for as long as necessary to fulfil the purposes described in this Policy. Specifically:

• Inquiry and customer correspondence is retained for the duration of the business relationship and, after it ends, for a reasonable period needed to handle warranty, quality, re-order or legal matters (typically up to 5 years);
• Analytics data is retained in aggregated or de-identified form where possible;
• Where we are required by law to keep records, we retain them for the period required by the applicable regulation.

When personal data is no longer needed, we delete or anonymise it.

Depending on the law that applies to you, you may have the right to:

• Access a copy of the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your personal data ("right to be forgotten") where legally applicable;
• Restrict or object to certain processing of your data;
• Data portability — receive your data in a structured, machine-readable format;
• Withdraw consent at any time where processing is based on consent (this does not affect the lawfulness of processing before withdrawal);
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, please contact us at hp@xahpsw.cn with the subject line "Privacy Request". We will respond within 30 days. We may need to verify your identity before acting on your request.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us: