Privacy Policy

1. Introduction and Scope

This Policy applies to personal data we process through our website, by email, by telephone, by instant messaging and in the course of our business-to-business (B2B) activities as a contract manufacturer. It does not apply to websites operated by third parties that we may link to, or to the privacy practices of our customers and suppliers, who are independent data controllers in their own right.

We are a business-to-business supplier. Our website is directed at companies, brands, distributors and professional buyers rather than at consumers or the general public. Where we do interact with an individual in a personal capacity, we still process their personal data in accordance with this Policy and with applicable law.

2. Who We Are

The entity responsible for the personal data described in this Policy (the “data controller”) is:

Any question, request or complaint about privacy or data protection should be sent to the privacy contact above. We will route it to the person responsible for data protection within our organisation. Where required by law, we will appoint and identify an appropriate representative in the relevant jurisdiction.

3. Personal Data We Collect

We collect the following categories of personal data.

3.1 Information you give us

• Enquiry and quotation data submitted through our contact form or by email, telephone or instant messaging: your name, company name, business email address, telephone or messaging number, country, product interest, order or project requirements, the content of your message, and any attachments you choose to send.
• Business relationship data created while we evaluate, quote for, negotiate and perform a project: contacts, correspondence history, technical requirements, specifications, artwork files, delivery and invoicing details supplied by you.
• Preferences and requests such as your preferred language, the subjects you ask us about, and any marketing preferences you tell us about.

3.2 Information collected automatically

• Technical and device data: IP address, browser type and version, operating system, device and screen characteristics, language settings and referring URL.
• Usage data: the pages you view, the date and time of your visit, the time spent on a page and the links you follow, together with a general (city or country level) location derived from your IP address.
• Server logs and security records: records generated by our hosting infrastructure to operate the website, troubleshoot faults, block abuse and defend against attacks.

3.3 What we do not collect through this website

• We do not ask for or store payment card numbers, bank credentials or government identification numbers through this website.
• We do not knowingly collect the special categories of personal data referred to in Article 9 GDPR (for example data concerning health, biometric data for identification, or data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or data concerning sex life or sexual orientation). Please do not send such information to us.
• We do not knowingly collect personal data from children. See section 14.

4. Why We Process Your Personal Data, and Our Legal Bases

Under the GDPR and the UK GDPR we must have a lawful basis for each purpose for which we process personal data. The table below sets out our purposes and the corresponding legal bases under Article 6(1) GDPR.

Purpose	Personal data used	Legal basis
Responding to your enquiry, preparing a quotation and taking steps you ask for before entering into a contract	Enquiry and quotation data, business relationship data	Performance of a contract or steps taken at your request prior to a contract — Art. 6(1)(b)
Performing, administering and invoicing a contract with you or your employer	Business relationship data, correspondence, delivery and invoicing details	Art. 6(1)(b)
Operating, securing, debugging and improving our website and its infrastructure	Technical and device data, usage data, server logs	Our legitimate interests in operating a secure and functional website — Art. 6(1)(f)
Understanding in aggregate how our website is used so we can improve its content	Usage data, technical and device data	Legitimate interests — Art. 6(1)(f), or your consent where required — Art. 6(1)(a)
Business-to-business marketing, including following up on an enquiry, sending relevant product or capability information and maintaining contact records	Name, business contact details, company, correspondence	Legitimate interests in promoting our business to professional contacts — Art. 6(1)(f); consent — Art. 6(1)(a) where we are required to obtain it
Keeping accounting, tax, customs, quality and compliance records	Business relationship data, transaction records	Compliance with legal obligations — Art. 6(1)(c)
Detecting and blocking fraud, abuse, spam and attacks; establishing, exercising or defending legal claims; complying with lawful requests from authorities	Technical and device data, server logs, correspondence, transaction records	Legitimate interests — Art. 6(1)(f); legal obligation — Art. 6(1)(c); legal claims — Art. 6(1)(f) and, where applicable, Art. 9(2)(f)
Sanctions, export-control and restricted-party screening before we trade with a counterparty	Company and contact details, country, transaction data	Compliance with legal obligations — Art. 6(1)(c); legitimate interests — Art. 6(1)(f)

If you provide personal data relating to another person (for example a colleague or an end customer), you are responsible for ensuring you are entitled to do so and for informing that person about this Policy.

5. Cookies and Similar Technologies

Our website uses a small number of cookies and comparable technologies (for example local storage) to keep the website working and, where you agree, to understand how it is used.

Category	What it does	Consent
Strictly necessary	Session handling, security, protection against cross-site request forgery, load balancing and remembering your cookie choices. The website cannot function without them.	Not required. These are exempt from the consent requirement under the ePrivacy Directive and French, UK and other national implementations.
Functional	Remembering optional preferences you have selected.	Set only with your consent where consent is required.
Analytics	Understanding, in aggregate, which pages are visited and how visitors reach us.	Set only with your consent where consent is required.

We do not use advertising, profiling or cross-site tracking cookies, and we do not use cookies to build advertising profiles of you. We do not sell or share your personal information for cross-context behavioural advertising as those terms are defined under California law.

Where consent is required, you may withdraw it at any time with future effect by clearing or blocking cookies in your browser settings, or by contacting us. Blocking strictly necessary cookies may stop parts of the website from working. You can also configure your browser to notify you when a cookie is set, or to refuse cookies generally; the help function of your browser explains how.

Some browsers transmit “Do Not Track” signals and some provide a “Global Privacy Control” (GPC) setting. Because we do not engage in cross-context behavioural advertising or the sale of personal information, we do not respond differently to those signals, but we honour a valid GPC opt-out preference signal as an objection to the sale or sharing of personal information as required by California law.

6. Marketing Communications

We send commercial messages to business contacts where we have a lawful basis to do so. Where we rely on consent, we will ask for it before sending and we will keep a record of it. Where we rely on legitimate interests in a B2B context, we will always give you a simple way to opt out. Every message we send contains an unsubscribe or opt-out mechanism, or clear instructions on how to object.

You may opt out of marketing at any time by using the unsubscribe mechanism in the message or by writing to cyrus@capsulebiotech.com. Opting out of marketing does not stop us from contacting you about a live enquiry, an existing order, an invoice, a warranty or a legal or safety matter.

7. How We Share Information

We do not sell your personal data, and we do not share it for others' independent marketing purposes. We disclose personal data only as described below.

• Service providers (processors). Hosting, website infrastructure, email, IT support, analytics and professional advisers who process data on our behalf and under our instructions. They may only use the data to provide their service to us and are bound by confidentiality and, where required, by a written data processing agreement.
• Group and affiliated companies, where necessary for the purposes described in this Policy.
• Professional advisers such as accountants, auditors and lawyers, where necessary and subject to confidentiality.
• Logistics, customs and inspection providers, where necessary to arrange shipment and clear goods, limited to the contact and delivery details required.
• Authorities, courts and regulators, where we are required by law or where it is necessary to establish, exercise or defend legal claims, to comply with a lawful request, or to protect the rights, property or safety of any person.
• Parties to a corporate transaction, such as a merger, acquisition, reorganisation or sale of assets, subject to appropriate confidentiality safeguards.

Where we act as a processor on behalf of a customer, we disclose data as instructed by that customer, and the customer is responsible for providing the relevant privacy information to the individuals concerned. See section 17.

8. International Data Transfers

We are established in the People's Republic of China, and our website and some of our service providers are also located outside the European Economic Area, the United Kingdom and Switzerland. Your personal data may therefore be transferred to, stored in and processed in a country outside the country in which you are located, including China, where data protection laws may differ from those in your country.

Where we transfer personal data out of the EEA, the UK or Switzerland, we put in place appropriate safeguards, which may include:

• the Standard Contractual Clauses approved by the European Commission (Decision (EU) 2021/914);
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, for transfers subject to the UK GDPR;
• a transfer to a country, territory, sector or organisation covered by an adequacy decision or an approved certification or code of conduct; and
• where required, a transfer impact assessment and supplementary technical and organisational measures, such as encryption in transit, access controls and data minimisation.

You may request further information about the safeguards we use, including a copy of the relevant contractual clauses, by contacting us at cyrus@capsulebiotech.com.

9. How Long We Keep Personal Data

We keep personal data only for as long as is necessary for the purposes set out in this Policy, including to satisfy legal, accounting, tax, customs, quality and reporting requirements and to establish, exercise or defend legal claims. In practice:

• Enquiries that do not lead to a contract: retained for up to 24 months from the last contact, after which they are deleted or irreversibly anonymised.
• Customer and supplier records and transaction documents: retained for the period required by applicable commercial, tax and customs law, and in any event for as long as a contractual relationship or a warranty or claims period is running.
• Marketing contact records: retained until you object or opt out, plus a short suppression record so that we can honour your choice.
• Server logs and security records: retained for a short, limited period, then rotated or deleted.

Where a longer retention period is required or permitted by law, or where data must be kept to defend a legal claim, we may retain it for that longer period. When it is no longer needed, we delete it or irreversibly anonymise it.

10. How We Protect Personal Data

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the nature of the data and the risks of processing. These measures include access controls and authentication, encrypted connections (HTTPS/TLS) for the website, restricted internal access on a need-to-know basis, confidentiality obligations for staff and contractors, regular review of our systems, and the use of reputable hosting and email providers.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we take our obligations seriously. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected individuals, without undue delay and within the time limits required by applicable law.

11. Your Rights

Depending on where you are and on the circumstances, you may have some or all of the following rights. Most of them are not absolute: they are subject to exceptions and to our ability to verify your identity and to establish that the request relates to you.

Right	What it means
Access	To be told whether we process personal data about you and to receive a copy of it, together with information about how and why it is processed.
Rectification	To have inaccurate personal data corrected and incomplete data completed.
Erasure	To have personal data deleted, for example where it is no longer necessary, where you withdraw consent and there is no other lawful basis, or where processing is unlawful.
Restriction	To have processing limited, for example while we verify accuracy or assess an objection.
Objection	To object to processing based on legitimate interests, and to object at any time to the use of your data for direct marketing.
Portability	To receive personal data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
Withdrawal of consent	To withdraw consent at any time with future effect, where we relied on consent. This does not affect the lawfulness of processing carried out before withdrawal.
Non-discrimination	Not to be discriminated against for exercising your privacy rights.
Complaint	To lodge a complaint with a supervisory authority.

To exercise any right, contact us at cyrus@capsulebiotech.com, describing your request and the personal data concerned so that we can locate it. We may ask you to provide information necessary to confirm your identity, so that we do not disclose personal data to the wrong person. We will respond within the period required by applicable law — normally one month under the GDPR and the UK GDPR (extendable by two further months for complex requests, with notice), and 45 days under California law (extendable once by a further 45 days, with notice). Exercising your rights is free of charge, except where a request is manifestly unfounded or excessive.

How to complain. We would prefer the chance to resolve your concern first, but you have the right to complain to a data protection authority at any time. This includes, in particular:

• the supervisory authority in the EU or EEA country where you live or work, or where the alleged infringement occurred;
• in France, the CNIL (Commission Nationale de l'Informatique et des Libertés);
• in the United Kingdom, the Information Commissioner's Office (ICO);
• in the United States, the California Attorney General or the California Privacy Protection Agency for California-specific rights, or the authority designated under your state's privacy law;
• in mainland China, the Cyberspace Administration of China and the competent provincial or sectoral authorities.

12. Specific Notices for the United States

This section applies to individuals resident in the United States to the extent that a state privacy law grants them rights, and is our notice at collection for those laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, and comparable statutes in other states such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana.

Categories of personal information we collect. Identifiers (name, company, business email address, telephone number, IP address); commercial information (products enquired about, order and project details); internet or network activity (browsing and interaction with our website); geolocation data at city or country level derived from your IP address; and professional or employment-related information (employer, job role where you provide it).

Purposes of collection. As set out in section 4, and disclosed here for the purposes of the notice at collection requirement.

Disclosure. We disclose the categories above to the categories of recipients described in section 7 and for the business purposes described in section 4.

We do not sell personal information, and we do not share personal information for cross-context behavioural advertising. We have not done so in the preceding twelve months. We do not use or disclose sensitive personal information for the purposes of inferring characteristics about you.

Your California rights. Subject to applicable exceptions, you have the right to know and to request access to the specific pieces and categories of personal information we hold about you, the right to delete, the right to correct inaccurate personal information, the right to opt out of sale or sharing, the right to limit the use and disclosure of sensitive personal information, the right not to be discriminated against for exercising your rights, and the right to use an authorised agent. You may submit a request by writing to cyrus@capsulebiotech.com. We will acknowledge and respond within the statutory periods and will verify your identity before acting. We do not knowingly collect or sell the personal information of consumers under 16 years of age.

Residents of other US states with comprehensive privacy laws may have rights of access, correction, deletion, portability and opt-out of targeted advertising or sale, and may appeal a refusal to act on their request. We will honour valid requests as required by those laws if they apply to us. This website is not directed to consumers and we do not process personal data for the purpose of targeted advertising.

13. Specific Notices for Mainland China

If you are located in mainland China, the Personal Information Protection Law of the People's Republic of China (PIPL), the Cybersecurity Law and related regulations apply to our processing of your personal information. In relation to that processing:

• We process personal information on the bases permitted by PIPL, which include your consent, the necessity to conclude or perform a contract to which you are a party, the necessity to perform statutory duties or legal obligations, and other circumstances permitted by law.
• We follow the principles of lawfulness, legitimacy, necessity and good faith, and we collect only the minimum personal information needed for the purposes described in this Policy.
• Because our systems and service providers may be located outside mainland China, your personal information may be transferred abroad. Where PIPL requires it, we will carry out the applicable cross-border transfer mechanism — for example a security assessment, certification, or the standard contractual clauses filed with the competent authority — and we will obtain your separate consent for the transfer where required.
• You have the right to know and to decide on the processing of your personal information, to access and copy it, to correct or supplement it, to delete it, to withdraw your consent, to request that it be transferred to another processor where the law provides, and to have the personal information of a deceased close relative accessed, copied, corrected or deleted as permitted by law.
• We will not use automated decision-making to make decisions that have a material impact on your rights and interests without your consent or a lawful basis, and we do not provide your personal information to any third party for its own independent use where PIPL requires your separate consent.
• If you are under 14 years of age, your personal information is treated as that of a minor and requires the consent of your parent or guardian. We do not knowingly collect it.

Requests relating to the rights described above may be sent to cyrus@capsulebiotech.com. Where this Policy is published in more than one language, the English version governs to the extent permitted by law.

14. Children's Privacy

Our website and our services are intended for business and professional use. They are not directed to children, and we do not knowingly collect personal data from children, including children under 13 in the United States, under 16 in the European Union and the United Kingdom, and under 14 in mainland China. If you believe that a child has provided personal data to us, please contact us and we will take reasonable steps to delete it.

15. Third-Party Links and Services

Our website may contain links to, or embedded content from, third-party websites and services, such as social media platforms and messaging providers. We do not control those services and this Policy does not apply to them. Their own privacy notices govern their processing. We encourage you to review the privacy information of any third-party service you use, and we are not responsible for the content, security or privacy practices of third parties.

16. Automated Decision-Making and Profiling

We do not use your personal data to make decisions based solely on automated processing that produce legal effects or similarly significantly affect you, and we do not build behavioural profiles for advertising purposes.

17. Business Customers, Suppliers and Data We Process on Instructions

In delivering manufacturing, OEM, ODM and related services we may process personal data contained in materials our customers provide to us (for example contact details on artwork, labels or shipping documents). In that role we act as a processor or entrusted party and process the data only on the documented instructions of the customer, who is the controller and is responsible for giving the required privacy information to the individuals concerned. We make a data processing agreement available where required by law, and we will assist the customer with reasonable requests relating to security, breach notification and the exercise of data subject rights.

18. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, our services or applicable law. The version and the effective date at the top of this page always indicate the current version. We will post the updated version on this page and, where the changes are material, we will provide a more prominent notice or, where required, seek your consent. We encourage you to review this page periodically.

19. How to Contact Us

For any question about this Policy, to exercise a privacy right, or to make a complaint, please contact us:

Please include enough information for us to understand and respond to your request. We will deal with it promptly and, where the law sets a deadline, within that deadline.

This Privacy Policy should be read together with our Disclaimer and Legal Notice, which contains important information about intellectual property, the nature of the information published on this website and the allocation of responsibilities between us and our customers.

Back to top