Privacy Policy

Data controller: BIOAMA LIMITED, Room F, 6/F Mega Cube, No. 8 Wang Kwong Road, Kowloon, Hong Kong. For privacy requests: elena@bio-ama.it.

EU representative under Article 27 GDPR: Elena Barboni, elena@bio-ama.it, formally designated by BIOAMA LIMITED as its representative in the European Union. EU-based data subjects and supervisory authorities may contact the EU representative directly on all matters related to the processing of their personal data.

Contact form: name, company, email, phone, country, category of interest (APIs & intermediates / Pharmaceuticals / Chemicals & cosmetic raw materials / Supplements), and the message you submit.

Technical data: strictly necessary cookies and, subject to your consent, analytics identifiers described in the Cookie Policy. Server logs may temporarily record IP address, user agent and request metadata for security and abuse prevention.

We do not knowingly collect special categories of personal data (Article 9 GDPR). Please do not include sensitive personal or patient data in inquiry messages.

Responding to commercial inquiries submitted via the contact form — legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and, for the privacy consent checkbox, Article 6(1)(a) GDPR (consent).

Website analytics via Google Analytics 4 — legal basis: Article 6(1)(a) GDPR (consent), collected only after you accept analytics cookies via the consent banner.

Security, fraud prevention and network integrity (server logs) — legal basis: Article 6(1)(f) GDPR (legitimate interest in operating a secure website).

Commercial communications: we send commercial or marketing communications only where a separate legal basis exists (e.g. your explicit request, or an existing business relationship where permitted by applicable law).

Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden — hosting provider for this website and the database that stores contact form submissions ("Lovable Cloud", built on Supabase infrastructure). Website assets and submitted contact form data are stored on EU infrastructure (Frankfurt region) under a Data Processing Agreement.

Google Ireland Limited / Google LLC — Google Analytics 4, only if you accept analytics cookies. IP addresses are anonymized before storage.

Transactional email delivery provider: none currently in use. The contact form on this website does not, at the date of this policy, transmit submissions to any third-party email delivery service (such as Resend, SendGrid, Mailgun or similar). Inquiries are stored in the Lovable Cloud database and handled through the direct email addresses listed on the Contact page. If a transactional email provider is introduced in the future, this Policy and the international-transfer section will be updated accordingly before activation.

Internal BIOAMA offices (Hong Kong, Shanghai, Germany, Italy) — for the sole purpose of responding to your inquiry.

We do not sell personal data.

Website infrastructure and any data stored server-side — including contact form submissions — is hosted on EU infrastructure (Frankfurt, Germany) by Lovable Labs AB under a Data Processing Agreement. No data is hosted or processed in mainland China.

When you accept analytics cookies, Google Analytics may transfer data to the United States. The transfer is protected by the EU-U.S. Data Privacy Framework and, where applicable, by the European Commission's Standard Contractual Clauses.

No transactional email provider is currently used by this website, so no transfer of contact form data to a third-country email service takes place. Contact form submissions are stored in the EU-based Lovable Cloud database. Should an email provider be introduced, the applicable safeguards (Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework where applicable) will be disclosed here.

Data may also be accessed by authorized BIOAMA personnel in Hong Kong solely to respond to your inquiry; such access is limited, logged where applicable, and covered by internal confidentiality obligations.

Contact form submissions and related correspondence are retained for 24 months from the date of the last contact with you, or until you withdraw your consent or request deletion, whichever occurs first. Data required to establish, exercise or defend legal claims may be retained for longer periods where required by applicable law.

Analytics data is retained according to the retention setting configured in Google Analytics 4 (default 14 months) and may be deleted earlier upon request.

Security logs are retained for a limited period necessary for their purpose and then deleted or anonymized.

Subject to applicable law, you have the right to: access your personal data; rectify inaccurate data; request erasure; restrict processing; data portability; object to processing based on legitimate interest; and withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your residence, place of work or the place of the alleged infringement.

To exercise your rights, contact us at elena@bio-ama.it. EU-based data subjects may also contact the EU representative (Section 1). We may ask you for information reasonably needed to confirm your identity.

The website is served over HTTPS/TLS. Access to the database that stores contact form submissions is restricted to authorized personnel and processors and is subject to encryption in transit. Data at rest is encrypted by the underlying hosting infrastructure. We apply organizational and technical measures proportionate to the risk of processing.

No system is completely secure. In case of a personal data breach affecting your rights and freedoms, we will notify the competent supervisory authority and, where required, affected data subjects, in accordance with Articles 33-34 GDPR.

This website is directed to business (B2B) professionals and is not intended for minors. We do not knowingly collect personal data from children. If you believe a minor has provided personal data through this site, please contact us and we will delete the data.

We do not carry out automated decision-making, including profiling, that produces legal effects concerning visitors or similarly significantly affects them.

We may update this Privacy Policy from time to time to reflect legal, technical or business changes. The "Last updated" date at the top of this page indicates the most recent revision. Where changes materially affect your rights, we will provide additional notice.