GDPR and Data Protection Rights

Does the GDPR apply to you?

The General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR apply to the processing of personal data of people in the European Economic Area (EEA) and the United Kingdom when we offer goods to them or monitor their behavior. Our website is aimed at business buyers worldwide, including in Europe, so we follow these rules for enquiries from those regions.

This page supplements our privacy policy and explains points that matter under the GDPR. This policy is a draft and requires review by qualified legal counsel before publication.

Who is the controller, and is there a representative?

The controller is Lab Manufacturers China, owner: Lab Manufacturers China, address: Guangzhou, China. Contact for data protection matters: sales@labmanufacturerschina.com.

We are located outside the EEA and the UK. Where the GDPR requires us to appoint a representative in the EU or the UK, or a data protection officer, the details will be published on this page. Current status: {Representative — to be confirmed}. Until then, please use the contact above and we will route your request appropriately.

What are the legal bases for processing?

We rely on the following bases under Article 6 of the GDPR.

• Contract or pre-contractual steps (Article 6(1)(b)): to answer a quotation request, prepare an offer and perform a sales contract.
• Legal obligation (Article 6(1)(c)): to keep tax, accounting, customs and export records.
• Legitimate interests (Article 6(1)(f)): to keep the website secure, to analyze aggregate usage with cookie-less analytics, to manage business correspondence and to establish or defend legal claims. We balance these interests against your rights, and you may object.
• Consent (Article 6(1)(a)): for any marketing emails or optional technologies. You can withdraw consent at any time.

The data we ask for in a quote form is limited to what we need to respond. We do not intentionally process special categories of personal data, and we ask that you do not send them.

How are international transfers handled?

We are based in China, and the European Commission has not issued an adequacy decision for China. A transfer of your data from the EEA or the UK to us is therefore made on the basis of appropriate safeguards or an exception. We intend to use the European Commission's standard contractual clauses, and the UK International Data Transfer Agreement or Addendum where applicable, together with supplementary measures such as encryption in transit and access control. Where a transfer is necessary to take pre-contractual steps at your request, Article 49(1)(b) may apply.

Our hosting and email service providers may process data in other countries, and each is bound by a data processing agreement. You can request a copy of the relevant safeguards by writing to sales@labmanufacturerschina.com. Status of documents: {Certification — to be confirmed}.

What are your GDPR rights?

Under the GDPR you have the following rights, subject to conditions and exceptions in the law.

• Access (Article 15): to receive confirmation of whether we process your data and a copy of it.
• Rectification (Article 16): to correct inaccurate or incomplete data.
• Erasure (Article 17): to ask us to delete your data, for example where it is no longer needed.
• Restriction (Article 18): to ask us to limit processing in certain situations.
• Portability (Article 20): to receive data you provided in a structured, commonly used, machine-readable format.
• Objection (Article 21): to object to processing based on legitimate interests, and at any time to direct marketing.
• Withdraw consent (Article 7(3)): at any time, without affecting earlier processing.
• Not to be subject to solely automated decisions with legal effects (Article 22). We do not make such decisions.

We do not charge a fee unless requests are manifestly unfounded or excessive.

How do you exercise rights or complain?

Write to sales@labmanufacturerschina.com with the subject "Data protection request", from the email address you used with us, and describe the right you wish to exercise. We may ask for information to verify your identity. We will respond within one month, which may be extended by two further months for complex requests, and we will tell you if we do so.

If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority in the EU member state where you live, work or where the alleged infringement took place, or in the UK with the Information Commissioner's Office. We would welcome the chance to address your concern first.

See our privacy policy for what data we collect and how long we keep it, and our cookie policy for information on cookie-less analytics and consent. This policy is a draft and requires review by qualified legal counsel before publication.