Skip to content
Shenzhen Oriental PharmaceuticalShenzhen Oriental PharmaceuticalOrientalSpecialty APIs since 1995
Request a Quote
Legal

Privacy Policy

Last updated 2026-10-31

This notice explains what personal data we collect when you use www.szoriental.com, why we collect it, who it goes to, how long we keep it and what rights you have. It is written for our business partners — pharmaceutical manufacturers, regulatory affairs teams and procurement professionals — and applies to visitors in the EU/EEA under the General Data Protection Regulation (GDPR) as well as to visitors elsewhere.

Data controller

Company
Shenzhen Oriental Pharmaceutical Co., Ltd.
Registered address
No.43 Dakeng Road, Tongle Village, Longgang District, Shenzhen, Guangdong, China
Telephone
+86 755 2892 8743
Fax
+86 755 8487 3052
Legal representative
MIAO Jinchuan
Unified social credit code
9144030061890620XX
Data protection contact
No data protection officer is designated (not mandatory under GDPR Art.37 for this site); data protection inquiries: info@szoriental.com
For any question about this notice, or to exercise a right listed below, write to the email address above. We reply within 30 days as required by GDPR Art.12(3).

What we process, and why

We only process data you give us, plus the technical data any web server necessarily sees. There is no advertising network, no analytics profile and no cross-site tracking on this website.

1. Server access logs

When your browser requests a page, our web server records the requested URL, your IP address, browser type, referring page and timestamp. Purpose: keeping the site running, detecting abuse and enforcing regional access rules. Legal basis: our legitimate interest in secure operation (GDPR Art.6(1)(f)). These logs are held on the server and are not combined with other data about you.

2. Quotation request form

If you submit the RFQ form we process: name, company, business email, country, your role, the product and CAS number you asked about, indicative quantity, target market, the documents you requested, your free-text message, the page you sent it from, and your IP address. Purpose: preparing and sending you a quotation, CoA, SDS or regulatory documentation. Legal basis: the steps you asked us to take before entering a contract (GDPR Art.6(1)(b)), together with the consent you give by ticking the form checkbox (Art.6(1)(a)). We also record your company's email domain in our customer system so that a colleague can see the enquiry history.

3. The AI product assistant

When you ask the on-page assistant a question, we send your question and up to eight previous turns of that conversation to the answering model, together with the page path you are on and the interface language. Your IP address is not forwarded to the model. Purpose: answering product, documentation and regulatory questions immediately. Legal basis: your request for that answer (GDPR Art.6(1)(b)) and your legitimate expectation that a chat box answers you (Art.6(1)(f)). The question, the answer, your IP address, the page and the response time are written to a log table so we can see what partners actually ask about. The assistant is deliberately restricted: it will not reveal manufacturing processes, pricing or customer identities, and any CAS number it produces that fails check-digit validation is replaced before it reaches you.

4. Handover to a human colleague

If the assistant cannot answer, or you ask for a human, a card appears asking for your email, a topic and an optional note. If you submit it we store your email, the topic, your note, a transcript of the conversation so far, the page and your IP address. Purpose: letting a colleague continue your enquiry without making you repeat yourself. Legal basis: your request to be contacted (GDPR Art.6(1)(b)).

5. Regional access control

We check the IP address of each request against a country database held on our own server, in order to refuse online services from certain jurisdictions. The check happens on our infrastructure; your IP address is not sent to an external lookup service. Purpose: complying with trade restrictions. Legal basis: compliance with a legal obligation (GDPR Art.6(1)(c)).

6. Browser storage on your own device

The assistant remembers a random session identifier and a few display flags in your browser so it can keep the conversation coherent and avoid repeating prompts. This stays on your device. The product page also passes the product name and CAS number to the enquiry form through your browser so you do not have to retype them. Nothing in this category is transmitted to us on its own.

Cookies

This website sets no cookies and uses no advertising or analytics cookies. Because nothing is set, there is no consent banner to click away — that is deliberate. We do use browser storage, which stays on your device:

  • A random assistant session identifier, so a conversation can continue within one visit.
  • Which assistant prompts you have already dismissed.
  • A short daily usage counter used only to limit automated requests from your own browser.
  • The product name and CAS number carried from a product page to the enquiry form.
You can clear all of it at any time through your browser settings without affecting your ability to browse the site.

Who receives your data

We do not sell, rent or share your data for marketing. Data reaches only these recipients:

  • Our own sales, regulatory and quality staff, so that they can answer your enquiry.
  • Our group companies within Happy Industrial (Hong Kong) Investment Group, where one of them manufactures or ships the product you asked about.
  • The cloud infrastructure and AI answering provider named below, acting strictly as our processor.

We never disclose your enquiry to other customers or to third parties outside this list. Regulatory dossiers, certificates and specifications are exchanged under NDA.

Processors and international transfers

Two external services are involved, and we name them rather than hide them behind a generic phrase:

  • AI answering: your question and recent conversation turns are sent to Alibaba Cloud's model service to generate the answer. Your IP address is not forwarded. A data processing agreement under GDPR Art.28 is required for this and is on our verification list.
  • Hosting: the website and its database run on a server operated by Alibaba Cloud in mainland China.
  • Because that server is outside the EU/EEA, processing your data there is a transfer to a third country. For the enquiry and handover forms we rely on the fact that the transfer is necessary to perform the pre-contractual steps you requested (GDPR Art.49(1)(b)). We are reviewing whether to put standard contractual clauses in place for wider coverage; that review is recorded as an open item and is not presented here as done.

How long we keep it

Enquiry and handover records are kept for as long as the business relationship and our commercial, tax and pharmaceutical record-keeping duties require. The AI question log is kept for internal quality review. Server access logs are kept for the period configured on the server.

Honest statement of the current state: the site does not yet run an automatic deletion job, so records are not removed on a fixed schedule today. Retention is therefore governed by the duties above and by manual review on request — including your right to erasure below, which we act on. We would rather state this plainly than print a retention period the system does not actually enforce.

Your rights

  • Access — obtain a copy of the personal data we hold about you (Art.15).
  • Rectification — have inaccurate data corrected (Art.16).
  • Erasure — have data deleted where the legal grounds allow it (Art.17).
  • Restriction — limit how we use your data (Art.18).
  • Objection — object to processing based on legitimate interests, including the access logs described above (Art.21).
  • Portability — receive the data you gave us in a machine-readable format (Art.20).
  • Withdrawal of consent — at any time, without affecting what we already did lawfully (Art.7(3)).

To exercise any of these, email the address above. We may ask you to identify yourself so we do not disclose data to the wrong person.

You also have the right to lodge a complaint with the data protection authority of your EU member state, or with the competent authority in China.

Is providing data mandatory?

No. Browsing the catalogue requires nothing from you. Data is only needed if you choose to send an enquiry or ask the assistant to hand you to a colleague — and then only to the extent necessary to answer you. Refusing to fill a field simply means we may not be able to quote accurately.

Automated decision-making

We do not use your data for automated decision-making or profiling with legal or similarly significant effect (GDPR Art.22). The assistant generates text answers; it does not decide whether to supply you, at what price, or on what terms — people do.

Security measures

The database sits on the same host as the web service and is reachable only from that host, not from the internet. The administration interface is restricted to local access and is excluded from the published site. Cross-site submissions to our API are rejected unless they come from our own domain. Requests are rate-limited per IP address, and the enquiry form carries a honeypot field so that automated submissions are discarded without being stored as leads. Access to customer data is limited to the staff who need it.

Encryption in transit is currently incomplete and we say so plainly: the site is served over plain HTTP on the server address at present, and HTTPS will be enabled once DNS cutover and certificate issuance are done. Until then, data you submit could in principle be observed in transit — which is a further reason to prefer the encrypted channel we are putting in place, and a reason we do not ask you for anything beyond what an enquiry needs.

Changes to this notice

If we change how we process data, we update this page and the date at the top. A material change that widens processing will be announced on the site before it takes effect, not after.