Privacy policy.Privacy policy.

01 · Who we are

This website (vectorgene.hk) is operated by VectorGene Biotech Limited, a company incorporated in Hong Kong (company registration no. 77684304) with its registered office at Tower 1, 2/F, Tern Centre, 237 Queen’s Road Central, Sheung Wan, Hong Kong Island, Hong Kong (“VectorGene”, “we”, “us” or “our”).

VectorGene is a technology transfer company supporting governments, hospitals, research institutes and biotechnology partners in building local genomics, CAR-T manufacturing, cell therapy and gene therapy capability.

VectorGene is the data user under the Hong Kong Personal Data (Privacy) Ordinance (“PDPO”) and, where the EU or UK General Data Protection Regulation (“GDPR”) applies, the controller of personal data submitted through this website.

02 · Information we collect

We collect only the personal data that is reasonable and necessary for the purposes in this policy.

• Partnership enquiry form: your first and last name, work email, phone number (optional), organisation, organisation type, country, role, areas of interest, timeline and message, the page and language you sent it from, and the time you gave consent.
• Direct correspondence: emails you send to partnerships@vectorgene.hk or other VectorGene contacts.
• Documents you choose to share in partnership discussions, such as concept notes, requests for proposal or hospital profiles.
• Technical data: our web server records the IP address, browser type, requested page and time of each visit in its logs, for security and to operate the website. To limit repeated form submissions, we store a keyed hash of your network address, not the address itself.

We do not collect patient medical records, health insurance information, financial account details or other sensitive personal data through this website. If patient-related information is shared during partnership discussions, it is handled separately under specific confidentiality agreements and applicable health-data rules.

03 · How we use your information

We use personal data to:

• Respond to partnership enquiries and follow up on collaboration discussions.
• Assess the feasibility, scope and fit of proposed technology transfer or partnership programmes.
• Send you information about VectorGene’s services that you have asked for, or where there is a legitimate business interest.
• Keep the website secure and working, and prevent abuse of the enquiry form.
• Comply with legal, regulatory and reporting obligations.
• Protect the legal rights of VectorGene and its partners.

We do not sell, rent or trade personal data to third parties for marketing.

04 · Legal basis for processing

Under the PDPO, we collect personal data fairly and lawfully, for a stated purpose and limited to what is necessary. Where the GDPR applies (visitors in the European Economic Area, the United Kingdom or Switzerland), we rely on:

• Consent: when you submit the partnership enquiry form and tick the consent box.
• Legitimate interests: for direct business-to-business communication with institutional partners and for website security.
• Performance of a contract: when we work with you under a partnership agreement, memorandum of understanding or service contract.
• Legal obligation: when the law requires us to keep or disclose information.

05 · Sharing & disclosure

We share personal data only as necessary, and only with parties bound by appropriate confidentiality and data protection obligations:

• Service providers: Hostinger, which hosts our web server and our email, and Amazon Web Services, which stores website media and backups and delivers email notifications.
• Partner institutions: only where directly relevant to your enquiry and with your awareness, for example when an enquiry concerns a platform that requires coordination with a partner institution in mainland China.
• Professional advisors: legal, accounting, regulatory and compliance advisors bound by professional confidentiality.
• Authorities: where required by valid legal process or regulatory inquiry, or to protect VectorGene’s legal rights.

Partner institutions and confidential commercial details are never disclosed publicly without explicit prior written consent.

06 · Cross-border transfers

VectorGene operates internationally, so personal data may be transferred to and stored outside Hong Kong. Our web server and database are hosted in India by Hostinger, and website media and backups are stored with Amazon Web Services in India. Partnership discussions may also involve partner jurisdictions, including mainland China.

Where personal data is transferred from a jurisdiction with stricter data protection requirements, such as the European Economic Area, we apply appropriate safeguards, including standard contractual clauses or other lawful transfer mechanisms.

07 · Data retention

We keep personal data only for as long as necessary for the purposes it was collected for, including legal, regulatory, accounting and reporting requirements.

• Active partnership enquiries: for the duration of the discussion and any resulting engagement.
• Concluded partnerships: for the term of the agreement plus the legal limitation period that applies to it.
• Enquiries that do not progress: up to 24 months from the last meaningful contact, then deleted or anonymised.
• Web server logs: 14 days.
• Database backups: 35 days, after which they are deleted automatically.

08 · Your rights

Subject to applicable law, you have the right to:

• Access: ask whether we hold personal data about you and obtain a copy.
• Correction: ask us to correct inaccurate or incomplete data.
• Deletion: ask us to delete your data where there is no compelling legal reason to keep it.
• Restriction: ask us to restrict processing in certain circumstances.
• Objection: object to processing based on legitimate interests.
• Data portability: receive certain data in a structured, machine-readable format, where the GDPR applies.
• Withdraw consent: withdraw consent at any time, without affecting processing that took place before.

To exercise any of these rights, email partnerships@vectorgene.hk. We will respond within the period required by applicable law, typically within 40 days under the PDPO and one month under the GDPR.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD), or to the data protection authority in your country of residence.

09 · Cookies & analytics

Visitors to the public website do not receive cookies, and the website uses no analytics, advertising or tracking technologies.

Signed-in editors of the website’s content management system receive session cookies, which are needed for sign-in and draft previews.

10 · Security

We use appropriate technical and organisational measures to protect personal data, including:

• HTTPS (TLS) encryption for all data sent to and from this website.
• Access to partnership enquiries limited to named accounts on a need-to-know basis.
• Encrypted storage for backups.
• Regular review of how information is handled.

No method of transmission over the internet is completely secure. We apply reasonable safeguards but cannot guarantee absolute security.

11 · Children

This website is intended for institutional and professional audiences. It is not directed at anyone under the age of 18, and we do not knowingly collect personal data from minors. If you believe a minor has sent us information, please contact us so we can remove it.

12 · Updates to this policy

We may update this privacy policy to reflect changes in our practices, services or legal requirements. The “Last updated” date at the top of this page shows the most recent revision. We will announce material changes on the website or, where appropriate, by email to active partnership contacts.

13 · Contact us

For questions about this privacy policy, or to exercise your rights, contact us using the details below. In Hong Kong, the supervisory authority for privacy complaints is the Privacy Commissioner for Personal Data (PCPD).