Privacy Policy

ALS Analytical Ltd. is the data controller of the personal data described in this Policy, unless we act as a processor on your instructions under a Data Processing Agreement (see LEG-003 / PRI-003), in which case the client is the controller and ALS is the processor.

Legal entity

ALS Analytical Ltd.

HK BR No.

76239481-000-03-24-2

Companies Reg.

2913746 (Hong Kong)

PDPO Data User Registry

DU-2019-04412

Registered office

Units 2308–2312, 23/F, Kwun Tong Industrial Centre Phase 4, 480 Kwun Tong Road, Kwun Tong, Kowloon, Hong Kong SAR

Data Protection Officer

Ms. Cheryl Ho — dpo@als-analytical.hk · +852 3728 4507

EU/UK Article 27 Rep.

InstantRep (Netherlands) B.V., Kingsfordweg 151, 1043 GR Amsterdam — als@instantrep.eu

This Policy operates against the requirements of the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (‘PDPO’), and — where ALS offers services to or monitors data subjects in those jurisdictions — the EU General Data Protection Regulation 2016/679 (‘EU GDPR’), the UK GDPR and Data Protection Act 2018, Singapore’s Personal Data Protection Act 2012 (‘PDPA’), the Australia Privacy Act 1988 (Cth), and Japan’s APPI. Where obligations differ, we apply the higher standard.

Key definitions

Personal data

Any information relating to an identified or identifiable natural person, including online identifiers such as IP addresses and portal user IDs.

Sensitive data

Data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data concerning a person's sex life or sexual orientation. We do not require such data to deliver our services and ask that you do not include it in submissions.

Processing

Any operation performed on personal data, including collection, recording, structuring, storage, use, disclosure, transfer, restriction, erasure, or destruction.

Sample data

Analytical inputs and results (chromatograms, spectra, integrations, method parameters). This is client-confidential business information; it becomes personal data only when linked to an identifiable individual (e.g. a named patient on a sample label).

We only process personal data where at least one lawful basis applies. Where we rely on legitimate interests, we have carried out a documented Legitimate Interests Assessment (LIA-2025-11) available on request.

We do not sell personal data. We disclose it only to the categories of recipients listed below, and only to the extent necessary.

• Our sub-processors listed in the Sub-processors Register (PRI-004), each bound by written contract on Article 28 terms.
• Couriers and customs brokers — DHL Express (HK) Ltd., FedEx Express, Kerry Logistics — for inbound sample shipping only.
• Financial institutions — HSBC (Hong Kong), Airwallex, Stripe Payments Asia — for invoicing and payment processing.
• Professional advisers — Baker McKenzie (Hong Kong), Mazars CPA Ltd. — under professional confidentiality.
• Regulators, courts, and law enforcement — where compelled by valid legal process. We narrow, log, and (where lawful) notify the affected individual.
• A successor entity in the event of a merger, acquisition, or asset sale, subject to at least equivalent protections.

Personal data is primarily stored on servers located in Hong Kong SAR and Singapore. Where we transfer personal data outside your jurisdiction, we rely on the following safeguards:

• EEA/UK → Hong Kong: the EU Commission’s Standard Contractual Clauses (Module 1 / Module 2, Decision 2021/914) and the UK IDTA, supported by our Transfer Impact Assessment (TIA-2025-04, Hong Kong).
• Singapore: transfers under s.26 PDPA to jurisdictions with comparable protection.
• Onward transfers by our sub-processors are restricted to the regions listed in PRI-004 and require documented equivalent contractual protections.

A copy of the SCCs, IDTA, or TIA is available from dpo@als-analytical.hk on request.

Subject to local law, you may request to:

• Access the personal data we hold about you and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (‘right to be forgotten’), subject to retention obligations described in §07.
• Restrict or object to processing, including direct marketing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent, without affecting the lawfulness of prior processing.
• Complain to a supervisory authority — see §12 for the relevant contacts.

Requests should be sent to dpo@als-analytical.hk with proof of identity (a redacted government ID showing name and photo is sufficient). We respond within 30 calendar days (extendable by two months for complex requests, with notice). See PRI-005 for the full request procedure.

We apply technical and organisational measures aligned with ISO/IEC 27001:2022 Annex A. Highlights (full detail in SEC-002):

• TLS 1.2+ in transit; AES-256 at rest for portal database and object storage.
• Argon2id password hashing with per-user salt and pepper; MFA enforced for admin roles.
• Role-based access with least-privilege review every 90 days.
• Immutable audit trail on the portal (ALCOA+); 5-year retention.
• Documented incident-response plan with 72-hour regulator notification target.
• Annual third-party penetration test and quarterly automated dependency scans.

Our services are directed exclusively at businesses and regulated professionals. We do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this Policy from time to time. Material changes will be highlighted on the site for at least 30 days and notified by email to registered portal users. Prior versions are retained in the Document Master Index (QMS-000) and available on request.

• Hong Kong: Office of the Privacy Commissioner for Personal Data (PCPD), 12/F, Sunlight Tower, 248 Queen’s Road East, Wan Chai — +852 2827 2827 — enquiry@pcpd.org.hk
• EEA: The lead supervisory authority in your Member State (e.g. CNIL, BfDI, AP). Our Article 27 representative can direct you.
• United Kingdom: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF — 0303 123 1113.
• Singapore: Personal Data Protection Commission — +65 6377 3131.