Privacy Policy

Vemlora Limited is a Hong Kong trading company. We deal mainly with businesses, so most of the personal data we hold consists of the professional contact details of the people we work with every day — buyers, engineers, logistics coordinators and accounts staff. This page explains what we collect, why we collect it, who we share it with and how long we keep it.

1. Introduction and scope

This policy explains how Vemlora Limited ("Vemlora", "we", "us" or "our") handles personal data. It applies to two things:

• This website — the pages served from our domain, including the product catalogue, ordering overview, quotation request forms, downloads and contact pages.
• Our business communications — enquiries, quotations, purchase orders, order confirmations, shipping and customs documents, inspection reports, invoices, and correspondence by email, telephone, messaging applications, video calls and meetings.

It does not apply to third-party websites we link to, or to personal data processed independently by our customers, our suppliers, our freight forwarders or other service providers under their own privacy notices. Those organisations are separate data users and you should read their notices if you deal with them directly.

We are a business-to-business supplier. The individuals whose data we hold are normally acting in a professional or commercial capacity rather than as consumers, and the information involved is usually limited to business contact details and the commercial documents exchanged with them. Where we do hold personal data relating to an individual consumer or a sole trader, we apply exactly the same safeguards described in this policy.

2. Who we are and how to contact us

Vemlora Limited is a company incorporated in Hong Kong under the Companies Ordinance (Chapter 622), Business Registration No. 81370206. For the purposes of the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) we are the data user of the personal data described in this policy.

Questions about this policy, requests to exercise your rights, and any privacy complaint should be sent by email to [email protected] with the subject line "Personal Data Request", or by post to the registered office address above, marked for the attention of the Data Protection Contact. Please use the same subject line for complaints so that they are routed correctly.

We aim to acknowledge a data request within seven business days and to respond substantively within 40 days of receiving the information we need to verify your identity and locate the data.

3. Information we collect

We try to collect as little personal data as the purpose allows. In practice, the information falls into three groups.

3.1 Information you give us

• Enquiry and quotation details — the name, company, job title, business email address, telephone or messaging number, country and product interest you enter in an enquiry form or send us by email.
• Order, invoicing and shipping information — purchase order references, invoice contact, billing address, consignee and delivery address, the name and telephone number of the person receiving the goods, and the details needed on customs and export documents.
• Correspondence — the content of emails, quotations, order confirmations, meeting notes and call records, including any attachments.
• Technical documents — drawings, specifications, bill of materials, Gerber and artwork files, sample notes and test requirements, which sometimes carry the name and contact details of the engineer who prepared them.
• Account and payment information — the invoicing details of account customers and the payment references shown on remittances. We do not ask for identity card numbers, dates of birth or payment card numbers, and we ask that you do not send them unless we specifically request a document for customs, banking or sanctions-screening purposes.

3.2 Information collected automatically

Our hosting provider keeps basic server logs when pages are requested. These logs typically contain the IP address, browser type and version, operating system, the page requested, the referring page and the time of the request. They are used for security, capacity planning and aggregate visitor statistics. They are not used to build advertising profiles or to identify individuals, and we do not merge them with the business contact data described above.

3.3 Information received from third parties

We may receive personal data about you from someone else — for example where your employer names you as the technical or logistics contact on a purchase order, where a freight forwarder, customs broker or inspection agency passes on the details of a receiving contact, where a bank or credit reference is used for account terms, where a sanctions or export-control screening provider returns a match, or where a colleague refers you to us. In each case we use that information only for the purpose for which it was passed to us.

4. How we use information

Personal data is used only for the purposes for which it was collected or for purposes directly related to them. In practice this means:

• responding to enquiries and requests for samples, drawings or documentation;
• preparing quotations, price comparisons and technical clarifications;
• confirming orders and coordinating production, tooling and schedules with manufacturers;
• arranging inspection, packing, consolidation, freight booking and shipping;
• preparing export, customs, certificate-of-origin and insurance documents;
• invoicing, collecting payment, bookkeeping, audit, tax and statutory reporting;
• handling warranty claims, returns, replacements and complaints;
• sanctions, export-control and denied-party screening, and fraud prevention;
• protecting the security and availability of our website and IT systems;
• sending commercial updates about products, prices and lead times to business contacts, subject to the consent rules described below; and
• establishing, exercising or defending legal claims.

We do not use personal data for automated decision-making that produces legal or similarly significant effects, and we do not sell personal data or use it for third-party advertising.

5. Legal basis and consent

Hong Kong. We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486). In summary, we collect data lawfully and fairly for purposes connected with our trading activities, collect no more than is necessary, take reasonable steps to keep it accurate, retain it no longer than necessary, use it only for the purposes for which it was collected or directly related purposes, and protect it with reasonable security measures. You have the right to request access to and correction of the data we hold about you. We do not use your personal data for direct marketing without your consent, and we do not reuse your data for marketing without a fresh consent where the Ordinance requires one.

European Union. Where you are in the European Union or the European Economic Area and we offer goods to you or perform a contract with you, the General Data Protection Regulation (EU) 2016/679 ("GDPR") may also apply. In that case our lawful bases are: performance of a contract or steps taken at your request before a contract (Article 6(1)(b)), for example preparing a quotation or delivering an order; our legitimate interests (Article 6(1)(f)) in administering business relationships, coordinating suppliers and keeping our systems secure, balanced against your rights; compliance with a legal obligation (Article 6(1)(c)), such as tax, accounting, customs and export-control record keeping; and your consent (Article 6(1)(a)) for optional commercial updates, which you may withdraw at any time.

Consent and third-party data. Where we rely on consent, you can withdraw it at any time by emailing us; withdrawal does not affect processing already carried out. If you give us the contact details of a colleague, a consignee or a customer of yours, you are responsible for making sure you are allowed to share that information with us, and we will use it only for the purpose for which you supplied it.

6. Sharing and disclosure

We disclose personal data only where it is necessary to complete the work you have asked us to do, or where the law requires it. Disclosures are limited to what each recipient needs, and each recipient is expected to keep the information confidential.

We never sell, rent or trade personal data. We do not share personal data with advertising networks, data brokers or unrelated third parties, and we do not disclose customer lists for marketing purposes.

7. International transfers

Vemlora is based in Hong Kong but our supply chain is regional. Personal data may therefore be transferred to, stored in, or accessed from places outside Hong Kong, including:

• Mainland China — production coordination, tooling, quality control, factory contacts and sample approvals;
• Other manufacturing and transit markets — for example Taiwan, Vietnam, Thailand, Malaysia, India, the European Union, the United Kingdom and the United States, where a supplier, forwarder, inspection agency, bank or IT provider involved in your order is located; and
• Cloud and email infrastructure operated by our service providers, whose servers may be located in more than one jurisdiction.

When we transfer personal data between Hong Kong and mainland China for manufacturing coordination, we limit the transfer to the contact details and technical documents required for that order, restrict access to the named staff and supplier contacts who need it, and ask recipients to keep it confidential and to use it only for the order in question. Where the GDPR applies, we transfer data only where there is a lawful basis and an appropriate safeguard — normally the necessity of the transfer for the performance of the contract with you, or standard contractual clauses with the recipient — and we will tell you which safeguard applies if you ask.

8. Retention periods

We keep personal data only as long as it is needed for the purpose it was collected for, for warranty and claim handling, or to meet accounting, tax and legal record-keeping requirements. The table below shows our normal retention periods; where the same record is subject to more than one period, the longest applies.

Deletion may be deferred where a record is required for an ongoing claim, audit, investigation or legal obligation. In that case access is restricted to the people who need the record for that purpose and the data is deleted as soon as the reason for keeping it ends.

9. Your rights

Subject to the conditions and exemptions in the applicable law, you have the following rights:

• Access — to ask whether we hold personal data about you and to receive a copy of it, together with information about how we use it.
• Correction — to ask us to correct data that is inaccurate, incomplete or misleading, and to be told what we have corrected.
• Objection and restriction — to object to processing based on our legitimate interests, and to ask us to restrict processing while a question about accuracy or lawfulness is resolved.
• Erasure — where the GDPR or a comparable law applies, to ask us to delete data that we no longer need, that was processed unlawfully, or that you have withdrawn consent for, subject to our legal record-keeping obligations.
• Portability — where the GDPR applies and we process data by automated means on the basis of consent or a contract, to receive it in a structured, commonly used format.
• Direct marketing — to withdraw consent to commercial messages at any time, without affecting your order or our service; every marketing message we send explains how to opt out.
• Complaint — to complain to a supervisory authority. In Hong Kong this is the Office of the Privacy Commissioner for Personal Data ("PCPD"), whose contact details and complaint form are published at www.pcpd.org.hk. If you are in the European Union you may also complain to the supervisory authority in your country of residence, place of work or where the alleged infringement occurred.

To exercise any of these rights, write to us at [email protected] or at the registered office address in section 2, using the subject line "Personal Data Request". Please tell us what you are asking for and which of our communications or orders it relates to, and provide enough information for us to verify that you are the individual concerned or authorised to act for them. We may charge a reasonable fee to cover the cost of complying with a data access request, as permitted by the Ordinance; we do not charge for correcting data. We will explain our decision in writing, and if we cannot comply with a request we will say why.

We would prefer the chance to resolve a concern directly, so please contact us first. Nothing in this section prevents you from approaching the PCPD or another supervisory authority at any time.

10. Cookies and third-party content

This website is a static site: the pages are pre-built files served as they are. We do not set advertising or analytics cookies, we do not embed third-party trackers, social plugins, remarketing pixels or embedded video players, and we do not load remote fonts or content from other domains. The stylesheet, the images and the single JavaScript file that runs the menu, the accordions and the scroll animations are all hosted on this domain, and that script does not profile visitors or send data anywhere.

Although we set no cookies ourselves, a website is never completely invisible to the infrastructure that serves it. Our hosting provider may keep basic server logs — normally the IP address, the browser type, the page requested, the referring page and the timestamp — to keep the site available and to detect abuse. Those logs are described in section 3.2 and are kept for no longer than 12 months. If you contact us by email or through a third-party messaging service, that provider handles your data under its own privacy policy; and if you follow a link to another website, the privacy notice of that website applies from the moment you arrive.

If we ever add analytics, advertising tags or embedded third-party content to this site, we will update this policy, list what has been added and, where the law requires it, ask for your consent before anything is set.

11. Data security and confidentiality

We protect the personal data and the technical documents we hold with measures appropriate to their sensitivity and to the risk of harm if they were misused:

• access is limited to the staff and named supplier contacts who need the information for a specific order or task, and access is removed when a person leaves or a project finishes;
• business accounts use strong passwords and, where available, two-factor authentication, and files are exchanged over encrypted connections;
• technical documents and commercial records are stored in access-controlled folders rather than in open shared spaces, and printed documents are kept in locked storage and shredded when no longer needed;
• suppliers, forwarders and other service providers receive only the information needed for their part of the work and are asked to treat it as confidential;
• we train the people who handle customer documents on these rules and review access rights periodically.

Non-disclosure agreements. We are happy to sign a mutual non-disclosure agreement before you send us drawings, bill of materials, artwork or other confidential technical information, and we can usually return a signed copy within two business days. Just ask your contact, or email [email protected] and we will send our standard NDA or review yours. If you would prefer not to email sensitive files, tell us and we will arrange an alternative transfer method.

No method of transmission or storage is completely secure, so we cannot promise absolute security. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the affected parties and the relevant authority without undue delay, and where the GDPR applies we will notify the competent supervisory authority within 72 hours of becoming aware of the breach where that is required.

12. Changes to this policy and effective date

This policy is reviewed at least once a year and whenever our practices, suppliers or legal obligations change. The current version takes effect on 13 October 2026 and was last reviewed on 16 October 2026. If we make a material change — for example a new category of recipient, a new international transfer, or the introduction of analytics — we will publish the revised policy on this page with a new effective date and, where the change affects an active business relationship, we will notify the relevant account contacts by email. Minor corrections such as wording, formatting or updated contact details are published without separate notice.

We encourage you to check this page occasionally. The version published here is the version that applies, and earlier versions are available on request.

Contact

Vemlora Limited, Workshop 251, 3rd Floor, Join-In Hang Sing Centre, Nos. 2–16 Kwai Fung Crescent, Kwai Chung, Hong Kong. Email [email protected], telephone +852 8201 8273. Business Registration No. 81370206. Questions about this policy, data requests and privacy complaints should be marked "Personal Data Request" so that they reach the right person quickly.