Privacy policy
This site is deliberately built so that it collects almost nothing about you. This page states exactly what happens to the information you do give us, in the same plain terms we use everywhere else.
This website sets no cookies, runs no analytics and loads no third-party scripts or fonts. Your quote list is stored in your own browser and is never transmitted to us. The enquiry form does not send anything to a server — it opens your email client so that you can decide whether to send it. We receive your details only when you actually email or message us, and we use them to answer you and to run the order.
Contents
- Who is responsible for your data
- What this site does not do
- What is stored in your browser
- What happens when you submit the enquiry form
- Email, WhatsApp and other direct contact
- Server logs
- Why we are allowed to process your data
- How long we keep it
- Who we share it with
- International transfers
- Your rights
- Security
- Age and business use
- Changes to this policy
1. Who is responsible for your data
The data controller is Taiyu International Limited, a company registered in Hong Kong SAR, China, company number 71580904. PepCore Biosciences is a trading brand of that company; there is no separate legal entity behind the brand.
For any question about this policy, or to exercise any right described below, write to sales@pepcore-bio.com with the subject line “Privacy request”. We do not have a statutory data protection officer, because our processing does not meet the threshold that requires one; privacy requests are handled by the person responsible for sales administration.
2. What this site does not do
Most of this policy is about what we don’t do, because the site is built that way on purpose. You can verify every point below by opening your browser’s developer tools and looking at the network and storage panels — nothing here is a promise you have to take on trust.
- No cookies. The site sets no cookies of its own, which is why you have not seen a consent banner. There is nothing to consent to.
- No analytics or advertising. No Google Analytics, no ad pixels, no heat-mapping, no A/B testing, no session recording.
- No third-party requests. Fonts are system fonts, not Google Fonts; there is no CDN, no embedded video, no chat widget, no social plugin. Opening a page contacts our server and no one else.
- No profiling. We do not build behavioural profiles, and we make no automated decisions about you.
- No sale of personal data. We have never sold personal data and we do not share it for cross-context behavioural advertising.
- No card data. We do not take card payments through this site. Payment is by bank transfer against our invoice, so card numbers never reach our systems.
3. What is stored in your browser
When you add products to the quote list, the product IDs are saved in your browser’s localStorage under the key pepcore_quote. This is a feature, not tracking: it is what lets the list survive a page reload or a move between the product catalogue and the contact page.
That data stays on your device. It is never sent to our server, never synchronised across devices, and we cannot read it. To delete it, clear site data for pepcore-bio.com in your browser settings, or use a private window.
4. What happens when you submit the enquiry form
The form on our contact page asks for: your name, company, business email, country, preferred reply channel, a contact ID for that channel (phone number or handle, optional), your requirements as free text, and the products currently in your quote list.
The form does not post to a server. When you press submit, the page assembles those fields and hands them to your own email client as a pre-written message addressed to our sales inbox. Nothing leaves your device until you press send in that email client — and if you close it without sending, we receive nothing.
This design means we hold no enquiry database. It also means the security of what you type depends on your own device and email provider, which is worth knowing if you are sending anything confidential.
5. Email, WhatsApp and other direct contact
Once you email us or message us on WhatsApp, we hold what you chose to send: your name, company, contact details, the content of the message and any attachments (for example a specification, a purchase order or a shipping address).
WhatsApp is operated by Meta, and messages sent through it are also processed by Meta under Meta’s own privacy terms. If you would rather not use it, email reaches the same people.
Where you ask for a quotation, we may keep a record of what was quoted to you so that a later order is priced consistently.
6. Server logs
Our hosting provider records standard web server logs when a page or file is requested: IP address, browser user-agent, the URL requested, the response status and a timestamp. These logs exist to keep the site available and to detect abuse, and they are retained on a short rolling basis under the host’s standard policy.
We do not use these logs to identify visitors, to build profiles or for marketing, and we do not attempt to link them to enquiries.
7. Why we are allowed to process your data
| What we do | Why we are allowed to |
|---|---|
| Reply to an enquiry, prepare a quotation, answer technical questions | Steps taken at your request before entering a contract (GDPR Art. 6(1)(b)); for Hong Kong, your provision of the data for that purpose |
| Fulfil an order: shipping, customs documents, COA and SDS transmission, after-sales handling | Performance of a contract (Art. 6(1)(b)) |
| Screen an enquiry for end-use, sanctions and export-control risk before accepting an order | Legitimate interests (Art. 6(1)(f)) — we are legally obliged not to supply restricted end uses, and we cannot do that without identifying the buyer |
| Keep invoices, customs records and trade documents | Legal obligation (Art. 6(1)(c)); under Hong Kong’s Inland Revenue Ordinance business records must be kept for seven years |
| Keep correspondence to defend against or bring a legal claim | Legitimate interests (Art. 6(1)(f)) — establishment, exercise or defence of legal claims |
We do not run a newsletter and we do not send marketing email to people who have not asked for a quotation. If we ever do, it will be opt-in, and every message will carry a working unsubscribe link.
8. How long we keep it
| Record | Retention |
|---|---|
| Enquiry that did not become an order | 24 months from last contact, then deleted |
| Quotation issued | 24 months, or the life of the resulting order if longer |
| Invoices, customs and shipping records | 7 years, as required by Hong Kong tax law |
| Batch and COA correspondence linked to a shipment | 5 years after the shipment, so that a later quality question can still be answered |
| Server logs | Short rolling period under the host’s standard policy |
When the retention period ends we delete the record, including from backups as they rotate.
9. Who we share it with
We share the minimum needed, and only with parties who need it to perform a task for us:
- Couriers and freight forwarders — name, delivery address, phone number and the customs description of the goods, so that the parcel can be delivered and cleared.
- Independent testing laboratories — sample identifiers and, where a report must be issued in someone’s name, the requesting company name. Reports we publish are described on the COA samples page, including whose name appears on them.
- Our email and hosting providers — they process mail and serve this website on our instructions.
- Accountants and auditors — invoice and payment records, where required for statutory accounts.
- Authorities — where we are legally required to disclose, for example customs, tax or a valid court order. If we are asked for your data and are allowed to tell you, we will.
We do not sell personal data, and we do not pass enquiry lists to other traders, brokers or lead-generation services.
10. International transfers
Our company is in Hong Kong and our records are held there and with service providers in the European Union and the United States. If you contact us from the EEA or the UK, your data will therefore be transferred outside your region.
For one-off enquiries we rely on the necessity of the transfer to take steps at your request before a contract (GDPR Art. 49(1)(b)). Where a relationship becomes ongoing, we put a data processing agreement with standard contractual clauses in place with the relevant provider. You can ask us which mechanism applies to your data.
11. Your rights
Subject to the limits set by law, you may ask us to:
- confirm whether we hold data about you, and give you a copy;
- correct anything that is wrong;
- delete it, where we have no legal obligation to keep it;
- restrict or object to processing based on our legitimate interests;
- provide it in a portable format, or send it to another controller;
- withdraw a consent you gave earlier, without affecting what was done before.
Write to sales@pepcore-bio.com and we will respond within 30 days. We do not charge a fee for access or correction requests. We may ask you to confirm your identity, because we will not hand business correspondence to someone who cannot show they are entitled to it.
If you are not satisfied with our answer you can complain to a supervisory authority — in the EU or UK, the authority in your country of residence; in Hong Kong, the Office of the Privacy Commissioner for Personal Data. We would rather you came to us first.
12. Security
The site is served over TLS, and access to the sales mailbox and to order records is limited to the people who need it. Because the enquiry form never reaches a server, the main risk to your information is the security of your own email account, not ours — use a business address you control, and send specifications you consider confidential only after we have agreed an NDA.
If a breach ever affected your data in a way that creates a risk to you, we would tell you and the relevant authority as required, rather than wait for you to read about it.
13. Age and business use
This is a business-to-business site. We sell to laboratories, manufacturers, contract research organisations and institutional buyers, not to consumers, and not to anyone under 18. We do not knowingly collect data from minors; if you believe a minor has sent us information, tell us and we will delete it.
14. Changes to this policy
If our practices change — for example if we add a form backend, a payment provider or analytics — this page will be updated before the change goes live, and the version number and date at the top will change with it. We keep earlier versions and will send you one on request.
Questions about anything on this page can go to the same address as an order enquiry: sales@pepcore-bio.com.