ALFI International Limited ("ALFI") – Comprehensive Privacy Policy

Last Updated: 17.06.2025

1. Definitions & Scope

1.1 This Privacy Policy governs all data processing activities of ALFI International Limited (trading as "ALFI"), including but not limited to:

• The website [www.alfiltd.com] and subdomains

• Business communications (email, phone, in-person)

• Product development and manufacturing processes

• Marketing and client portfolio management

1.2 Key Definitions:

• "Data Subject": Any identifiable individual (client, supplier, website visitor)

• "Processing": Any operation performed on personal data (collection, storage, use, etc.)

• "Client Portfolio": Public display of past/present client collaborations with explicit consent

2. Data Collection: Types & Legal Bases

2.1 Collected Data Categories

Data TypeExamplesLegal BasisIdentity DataName, title, companyContract fulfillment, Legitimate InterestContact DataEmail, phone, business addressContract fulfillment, ConsentTransaction DataOrder history, payment recordsContract fulfillment, Legal ComplianceTechnical DataIP address, browser type, cookiesLegitimate Interest (website security/analytics)Marketing DataCommunication preferencesConsentClient Portfolio DataClient names/logos (with release form)Explicit Consent

2.2 Special Category Data
We do not intentionally collect sensitive data (e.g., biometrics, political views). If received inadvertently, it will be deleted immediately.

3. Detailed Processing Purposes

3.1 Core Business Operations

• Sample development and production fulfillment (GDPR Art. 6(1)(b))

• Quality control and warranty management (GDPR Art. 6(1)(f))

• Compliance with export/import regulations (GDPR Art. 6(1)(c))

3.2 Marketing & Client Portfolio

• Displaying client collaborations requires:

  • Signed Client Release Form specifying:

    • Duration of display

    • Approved logos/materials

    • Right to withdraw consent via [contact@alfiltd.com]

• Newsletter subscriptions require double opt-in confirmation

4. Data Sharing & Transfers

4.1 Third-Party Processors
All vendors sign Data Processing Agreements (DPAs) complying with:

• GDPR (for EU data)

• PDPO (Hong Kong)

• CCPA (California) where applicable

4.2 International Transfers
Data may be transferred to:

• Sister factories in Southeast Asia (under Standard Contractual Clauses)

• Cloud servers (AWS/GCP with encryption-at-rest)

5. Data Subject Rights

5.1 Comprehensive Rights Table

RightActionResponse TimelineAccessProvide data copy30 calendar daysRectificationCorrect inaccurate data14 business daysErasureDelete non-essential data30 calendar daysRestrictionSuspend processing5 business daysPortabilityProvide machine-readable data30 calendar daysObjectionCease specific processing10 business days

5.2 Withdrawal of Portfolio Consent
Clients may request removal from the Client Portfolio section via:

• Email: [contact@alfiltd.com]

• Registered post to 1503 Entrepot Centre, Kwun Tong, Hong Kong, 0000
  Processed within 7 business days with confirmation of removal

6. Security Measures

6.1 Organizational

• Annual staff training on data protection

• Role-based access controls (RBAC)

• Vendor security audits

6.2 Technical

• AES-256 encryption for data-at-rest

• TLS 1.3 for data-in-transit

• Quarterly penetration testing

6.3 Breach Protocol

• Notification to authorities within 72 hours (where required)

• Affected individuals notified via encrypted channels

7. Retention Schedule

Data CategoryRetention PeriodRationaleClient contracts7 years post-terminationHong Kong Companies OrdinanceMarketing consents2 years after last activityIndustry best practiceWebsite analytics26 monthsGoogle Analytics standardClient portfolio dataUntil withdrawal requestConsent-based processing

8. Cookie Policy

8.1 Strictly Necessary

• Session cookies (exempt from consent)

8.2 Performance/Analytics

• Google Analytics (IP anonymization enabled)

8.3 Marketing Cookies

• Only activated after explicit opt-in

9. Policy Updates

9.1 Amendment Procedure

• Version control with changelog

• 30-day advance notice for material changes

• Archived versions available upon request

10. Jurisdiction-Specific Provisions

10.1 Hong Kong (PDPO)

• Compliant with DPP6 (data access/correction)

11. Contact & Complaints

Email: selina@alfiltd.com
Phone: [+852 23892126]
Post: 1503 Entrepot Centre