Privacy Policy

1. Who we are

Joint Knowledge Limited ("JKL", "we", "us", "our") is a limited company incorporated in Hong Kong under the Companies Ordinance (Cap. 622 of the Laws of Hong Kong), with Company Registration Number 76924000, registered office at RMS 501-2 Wilson House, 19-27 Wyndham Street, Central, Hong Kong.

JKL provides regulatory and market-entry consulting services to nutraceutical brands seeking to enter the Chinese market. This Privacy Policy explains how we collect, use, disclose and protect personal data submitted via our website jointknowledgeltd.com (the "Website").

2. Scope and B2B nature of our services

JKL is a business-to-business (B2B) consulting firm. Our clients are corporate entities — typically nutraceutical brands and their group companies — and not individual consumers. Our Website is intended for use by representatives of such companies (for example, brand managers, regulatory affairs managers, business development managers) acting in their professional capacity on behalf of their employer or principal.

When a representative of a company submits an enquiry via our contact form, the data we collect is limited to the information needed to identify and respond to that representative as a business contact. We do not market services to consumers and do not knowingly collect personal data from individuals acting in a private (non-professional) capacity.

Our Website primarily addresses companies established in the European Union and the United Kingdom. We do not direct our Website to individuals located in Hong Kong or in the People's Republic of China.

3. Applicable laws

JKL is established in Hong Kong and complies with the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO").

Where we process personal data of business contacts located in the European Economic Area or the United Kingdom — including their names and professional contact details when they submit enquiries on behalf of their employer — we also act in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the UK GDPR, to the extent applicable. We note that, while data protection laws apply to natural persons rather than to legal entities, the professional contact details of individuals representing a corporate counterparty are still personal data within the meaning of those laws.

4. Personal data we collect

When you submit the contact form on our Website, we collect the following personal data, which we treat as professional contact information:

• Full name (mandatory)
• Email address (mandatory)
• Company name (optional)
• Phone number (optional)
• Subject of your enquiry (mandatory)
• The content of your message (mandatory)
• Technical metadata associated with your submission, such as the date and time of submission

We do not knowingly collect any other personal data through the Website. We do not collect special categories of personal data (such as health, racial or ethnic origin, political opinions, or religious beliefs) and we ask that you do not include such information in the message field of the contact form.

5. Why we collect your data and legal bases

We use the personal data submitted via the contact form for the following purposes:

• To respond to enquiries received from prospective and existing business clients;
• To send an automated acknowledgement confirming receipt of your enquiry;
• To maintain a record of correspondence for follow-up, audit and accountability purposes;
• To comply with applicable legal obligations.

Under the GDPR and UK GDPR (where applicable), the legal bases for processing are:

• Article 6(1)(f) — our legitimate interest in carrying on a B2B consulting business, in responding to professional enquiries from prospective clients, and in maintaining records of business communications. Where we rely on this basis, we have considered and balanced this interest against the rights and freedoms of the individuals concerned, taking into account that the data is processed in a professional context, is limited to standard business contact details, and is handled within the reasonable expectations of a person who voluntarily contacts a consulting firm via its website;
• Article 6(1)(b) — performance of pre-contractual steps taken at your request, where the enquiry concerns the possible engagement of our consulting services;
• Article 6(1)(c) — compliance with legal obligations to which we are subject.

Under the PDPO, personal data is collected directly from you for purposes directly related to our consulting business and for purposes you would reasonably expect when initiating contact with a B2B consulting firm.

6. Who has access to your data

We do not sell, rent, trade or otherwise make your personal data available to third parties for marketing purposes. We share your personal data only with the following categories of recipients:

• Authorised JKL personnel, who handle business enquiries and client communications, on a need-to-know basis;
• The service providers acting as data processors on our behalf, listed in Section 7;
• Competent authorities, courts and law enforcement agencies, where required by applicable law or legal process.

7. Service providers and sub-processors

We use the following third-party service providers in connection with the operation of the Website and the contact form:

• Lovable (hosting platform for the Website) — operated by Lovable AB, with infrastructure primarily in the United States;
• Cloudflare, Inc. (DNS and content delivery) — operated globally;
• Resend (transactional email delivery) — operated by Resend Inc., with infrastructure in the European Union (Ireland, eu-west-1);
• Aruba S.p.A. (email hosting for our @jointknowledgeltd.com mailboxes) — infrastructure in Italy.

Each provider acts as a data processor and is bound by appropriate contractual safeguards, including, where applicable, data processing agreements and standard contractual clauses for international transfers.

8. International transfers of personal data

Personal data submitted through our Website may be transferred to, and processed in, jurisdictions outside the European Economic Area, the United Kingdom and Hong Kong, including the United States and other countries where our service providers operate.

Where such transfers are made from the EEA or the UK to a country that has not been recognised as providing an adequate level of data protection, we rely on appropriate safeguards as required by the GDPR and the UK GDPR, including the EU Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum.

9. How long we keep your data

We retain personal data submitted through the contact form for a maximum of twelve (12) months from the date of submission, after which it is securely deleted, unless:

• the company you represent has subsequently engaged JKL as a client, in which case data is retained in accordance with the contractual relationship and applicable retention obligations;
• we are required to retain it longer to comply with a legal obligation, defend a legal claim, or for other lawful purposes.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or alteration. These include encryption of data in transit (TLS), authentication and access controls on our hosting and email systems, and regular review of our security practices.

No system is fully secure. While we work to protect your personal data, we cannot guarantee absolute security.

11. Your rights under the GDPR (and UK GDPR)

If the GDPR or UK GDPR applies to the processing of your personal data, you have the following rights, subject to applicable conditions and exceptions:

• Right of access — to obtain confirmation of whether we process your personal data and to receive a copy;
• Right to rectification — to request correction of inaccurate or incomplete personal data;
• Right to erasure ("right to be forgotten") — to request deletion of your personal data;
• Right to restriction of processing — to request that we limit the processing of your personal data;
• Right to data portability — to receive your personal data in a structured, machine-readable format;
• Right to object — to object to processing carried out on the basis of our legitimate interests, on grounds relating to your particular situation;
• Right to withdraw consent — where processing is based on your consent, at any time, without affecting the lawfulness of processing prior to withdrawal;
• Right to lodge a complaint with a supervisory authority in your country of residence or place of work.

To exercise any of these rights, please contact us at info@jointknowledgeltd.com.

12. Your rights under the Hong Kong PDPO

Under the Personal Data (Privacy) Ordinance, you have the right to request access to, and correction of, personal data we hold about you. Such requests can be made by contacting us at info@jointknowledgeltd.com. We may charge a reasonable fee for complying with a data access request, as permitted by the PDPO.

13. Cookies and tracking

Our Website does not use analytics cookies, marketing cookies, tracking pixels, session replay tools or third-party advertising scripts. We do not use Google Analytics, Meta Pixel, LinkedIn Insight Tag, or comparable tools.

A small number of strictly functional cookies may be set by the technical components of the Website to support its basic operation. These cookies do not track you across websites and are not used for profiling.

If, in the future, we introduce analytics or other non-essential cookies, we will update this Policy and, where required by law, request your prior consent through a cookie banner.

14. Children

Our Website is intended for business users acting in a professional capacity and is not directed to children. We do not knowingly collect personal data from individuals under the age of 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

15. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable law. The "Effective date" at the top of this document indicates when this Policy was last revised. We encourage you to review this Policy periodically.

16. How to contact us

For any question relating to this Privacy Policy or to the processing of your personal data, you can contact us at: