← VANT
DRAFT — to be reviewed by counsel before go-live (see the note under “Cross-border processing” below).

Privacy Policy

Last updated: July 2026

This policy explains how ALVECIS Limited (“VANT”, “we”) handles personal data when you visit this website or use the contact form. We keep data collection to the minimum needed to respond to your inquiry, and we write this policy with the EU General Data Protection Regulation (GDPR) in mind because this site is directed at business contacts in Europe.

Controller

ALVECIS Limited, 2301, 23/F Bayfield Building, 99 Hennessy Road, Wanchai, Hong Kong. Email: [email protected].

What we collect

When you submit the contact form we process exactly the fields you fill in: company name, contact name, position, country, email address, company website, product category, current European markets, target European markets, your selected main challenge, your free-text message, and whether you ticked the consent checkbox.

Providing this data is voluntary; without a valid email address we cannot reply to you.

When you load the site, our server and our content-delivery and security provider (Cloudflare) process technical connection data such as your IP address, browser information and request timestamps, briefly and for the purpose of delivering and securing the site.

Purpose and legal basis

We process the data you submit through the contact form in order to review your inquiry and take the steps you requested towards a possible engagement — this is necessary for pre-contractual measures at your request (Art. 6(1)(b) GDPR).

Where the inquiry does not lead directly to a contract, we continue to process it on the basis of our legitimate interest in responding to business inquiries, maintaining a record of them, and following up where appropriate (Art. 6(1)(f) GDPR).

Cloudflare's processing of technical connection data is likewise based on our legitimate interest in operating a secure and reliable website (Art. 6(1)(f) GDPR).

Where your data is stored

Inquiry data is stored in a database that we operate ourselves on our server, outside the public web directory and not reachable from the internet. It is not shared with any party beyond those named under “Recipients” below.

Recipients (processors)

To send the internal notification email and, where applicable, to maintain a corresponding contact record for the resulting business relationship, we use Brevo (Sendinblue GmbH / Brevo SA) as a processor under a data processing agreement (Art. 28 GDPR).

Site delivery, performance and protection against abuse are provided by Cloudflare, likewise as a processor under Art. 28 GDPR.

Brevo and Cloudflare are not “third parties” in the sense of the GDPR — they process data only on our instructions and for our purposes. We do not sell your data and do not share it with anyone else.

Retention

We keep inquiry records in our own database for up to 24 months after your last contact with us, or for as long as any resulting business relationship continues, and delete them afterwards unless we are legally required to keep them longer.

Data held by Brevo (the notification email and, where created, your contact record) is subject to Brevo's own retention settings within our account; we delete or anonymize contact records there once they are no longer needed for the purpose above.

Your rights

Subject to applicable law, you have the right to request access to, rectification of, restriction of, or erasure of your personal data, to object to certain processing, and to receive your data in a portable format. To exercise these rights, contact us at [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority — in particular the authority of the EU member state where you live, work, or where the alleged infringement took place.

Cross-border processing — Hong Kong controller, EU data subjects

ALVECIS Limited is a Hong Kong company; it is not established in the European Union. Because this website addresses business contacts in the EU, the GDPR may nonetheless apply to this processing under its extraterritorial scope (Art. 3(2) GDPR).

Whether Art. 27 GDPR requires us to appoint a representative in the European Union, and if so the appointment of that representative, is currently under legal review and has not yet been finalized. This section will be updated once that review is complete; contact us at [email protected] for the current status.

Cookies

This site sets no marketing or analytics cookies. Any storage used is strictly necessary for the site to function.

Legal notice