Privacy Policy

1. Who is responsible and how to contact us

This notice concerns personal data processed through CIRPAL (https://cirpal.com). OM Group Limited is the website's controller for GDPR purposes and data user under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486, “PDPO”). The PDPO and, where applicable, the EU General Data Protection Regulation (“GDPR”) govern the processing described here.

Privacy enquiries and requests for access or correction: Privacy Contact, OM Group Limited, at the postal address above or [email protected]. You may also use [email protected]. This is our privacy contact, not an appointed Data Protection Officer.

EU privacy contact and representative

Commercial register: Amtsgericht Hamburg, HRB 194421. Postal correspondence: EU Data Protection Representation for OM Group Limited.

Contact: [email protected]. Please address the message to Ocean Material Solutions GmbH, EU Data Protection Representation.

Ocean Material Solutions GmbH has been designated in writing as OM Group Limited’s EU privacy contact and, for processing to which Article 27 GDPR applies, as its representative in the Union. OM Group Limited remains the controller. Ocean Material Solutions GmbH is not the website operator, controller or Data Protection Officer.

2. Visiting the website: hosting, delivery and security

The site is delivered through Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Processing for delivery, network operation and security can include your IP address, requested address, date and time, HTTP status, browser and device information, referring page where supplied, and technical security or connection events.

These data allow requested pages to reach your device, help detect attacks and diagnose failures, and maintain availability. Where the GDPR applies, the basis is Article 6(1)(f): our legitimate interests in operating a reliable, secure public website and preventing misuse. We consider these interests against visitors' rights and limit processing to what is necessary.

Cloudflare also supplies email-address obfuscation, which can load a script from this website to display contact addresses. Network-error reporting headers can instruct supported browsers to report connection failures to Cloudflare. These features are distinct from advertising tracking.

OM Group Limited uses the Cloudflare services for this project under Cloudflare's applicable online terms and data-processing terms. The current website does not use Cloudflare Web Analytics or Zaraz. Security and network records are retained according to the enabled service, security purpose, account settings and Cloudflare's applicable contractual and legal requirements.

Provider information: Cloudflare Privacy Policy, Data Processing Addendum and subprocessors.

3. Email and telephone enquiries

If you contact us, we process your email address or telephone number, name and organisation where provided, message content, attachments and correspondence metadata to answer your enquiry and organise any requested follow-up. Providing these details is voluntary. Without a reply address and enough information about your request, we may be unable to respond. Please do not send identity documents or sensitive personal information unless specifically needed and requested.

For a contract or pre-contractual steps requested by you personally, the GDPR basis is Article 6(1)(b). For general enquiries, communications with representatives of businesses and relationship management, it is Article 6(1)(f), based on our legitimate interest in handling relevant correspondence. Article 6(1)(c) applies only where a binding EU or Member-State legal obligation requires processing; a Hong Kong obligation is not automatically treated as an Article 6(1)(c) basis.

Email links open your mail application. Clicking alone does not submit a form or subscribe you to a newsletter. Sending an enquiry does not constitute consent to unrelated advertising.

Messages sent to this website’s hello address are forwarded through Cloudflare Email Routing to a Microsoft 365 mailbox. They are currently handled only by OM Group Limited’s authorised Director; no other person routinely reads these website enquiries. Forwarding and mailbox processing involve the sender and recipient addresses, email headers, message content and attachments, for delivery, storage and handling of your enquiry. Cloudflare is the forwarding service; Microsoft 365 is the mailbox service. This routing is not permission to share enquiries with unrelated partners for their own purposes.

Provider information: Cloudflare Email Routing and Microsoft Data Protection Addendum.

The Microsoft 365 subscription is held by OM Group Limited under a Microsoft Online Subscription Agreement and is subject to Microsoft's applicable data-protection terms. The tenant’s administration view identifies Asia Pacific as the current Exchange Online data-at-rest region. This does not establish a specific data centre or exclusive processing in Hong Kong or the EU. Service logs, recovery copies and backups follow Microsoft's applicable service, security, recovery, contractual and legal requirements and are separate from the correspondence-retention rule below.

4. Direct contact with MeSentia

Links to [email protected] address your message directly to MeSentia, not to an OM Group website form. MeSentia's role and privacy information govern its handling of messages it receives for its own purposes. Consult MeSentia's website for its contact and privacy information.

OM Group does not receive such a message merely because this website contains the link. If you copy OM Group, or a message is shared with us on an appropriate legal basis, this notice applies to our handling of that copy. Any shared mailbox access, automatic forwarding or joint processing must be separately documented; it is not assumed here.

5. Cookies, browser storage and embedded services

The reviewed website source does not include advertising pixels, visitor analytics, embedded maps or videos, social-media plugins, user accounts, newsletter sign-up or a contact-form backend. Images, styling and fonts are served as website assets rather than fetched from external font services.

Local page navigation and email links do not require an advertising identifier. Cloudflare security features may use strictly necessary cookies when required to provide the requested service; their actual use and lifetime depend on the enabled features. Non-essential storage or access on your device requires prior consent where the applicable law requires it. Browser settings can also control cookies, but do not replace our duty to obtain consent before a consent-requiring technology is loaded.

We do not use visitor analytics, advertising pixels or other visitor-tracking services on this website. Cloudflare Web Analytics and Zaraz are not used. Cloudflare hosting, security and network-error reporting remain as described above. Before introducing additional services, we will update this notice and implement consent and withdrawal controls wherever required.

6. Recipients and disclosure

Access is limited to authorised persons working for OM Group Limited who need the information for the relevant task, and providers of hosting, network security, email delivery and storage, and IT support. Professional advisers or competent authorities may receive information where necessary for advice, a legal obligation or a legal claim. A business relationship with OM Group does not by itself authorise unrestricted sharing with partners.

When a provider processes personal data on our behalf, the required contractual protections must govern that processing. We do not treat a website enquiry as permission to sell contact data or provide it to partners for their own direct marketing.

7. International processing and transfers

OM Group Limited is established in Hong Kong. Messages addressed to OM Group may be accessed there by its authorised Director. Cloudflare and Microsoft operate internationally, including in the United States and other countries. Hong Kong does not have an EU adequacy decision.

Directly providing your own information to a Hong Kong controller and a transfer between organisations are legally distinct situations. A transfer subject to Chapter V GDPR requires an applicable transfer mechanism; merely using this website is not consent to such a transfer.

Email forwarding through Cloudflare and mailbox processing through Microsoft 365 form part of the processing described here. For covered international transfers, the providers' applicable data-processing terms contain transfer mechanisms, including EU Standard Contractual Clauses where applicable. Information about the relevant safeguards or a copy can be requested through the privacy contacts above; legally protected information may be redacted. Provider terms do not promise exclusively EU-based storage or access.

8. How long information is kept

Retention is determined by the purpose, whether an enquiry is still open, any resulting contractual relationship, applicable statutory record-keeping obligations, and a concrete need to establish, exercise or defend legal claims. Data that are no longer needed are deleted or anonymised; duplicate attachments and irrelevant personal data should not be kept simply because they were received.

For enquiries through this website, spam and clearly irrelevant messages are deleted promptly. Completed general enquiries without a resulting business relationship are kept only for necessary follow-up, normally for no more than 24 months after completion, and deleted earlier where no longer needed. Necessary correspondence for ongoing projects, contracts or business relationships is retained for the relevant purpose and applicable statutory periods. Specific legal claims and justified editorial evidence may require longer retention, with the reason documented and reviewed at least annually.

OM Group Limited implements these rules manually, reviews the relevant messages at least annually and organises deletion to meet the applicable deadlines. The rule also covers its own copies and attachments. Provider security logs, recovery copies and backups are retained and overwritten or deleted according to their purpose, the enabled service, security needs, contractual or legal requirements and the provider's recovery cycle. They can therefore remain for a limited period after deletion from the active mailbox.

9. Your rights under the GDPR

Where the GDPR applies, you may request access and a copy, correction, erasure or restriction, subject to the relevant legal conditions. Data portability applies to data you provided where processing is automated and based on consent or contract. You may withdraw consent at any time without affecting earlier lawful processing.

You may object, on grounds relating to your particular situation, to processing based on legitimate interests. You may object to direct marketing at any time, including related profiling.

We respond without undue delay and normally within one month. A permitted extension of up to two further months requires notice within the first month and reasons. Requests are normally free; the GDPR's limited exceptions remain applicable. We may request proportionate information needed to verify identity.

You may complain to a competent supervisory authority, particularly where you habitually reside, work or where an alleged infringement occurred. In Austria this is the Austrian Data Protection Authority. You do not have to contact us before making a complaint.

10. Your rights under Hong Kong's PDPO

You may request confirmation of whether we hold your personal data, access to those data and correction of inaccurate data, subject to the PDPO. Requests can be sent to the Privacy Contact identified above. A data-access request may use the official PCPD request form.

Applicable PDPO access and correction requests are generally handled within 40 calendar days. Where compliance within that time is not possible, the required notice and reasons will be provided. Any PDPO access fee must comply with the law and not be excessive; it does not override the GDPR's free-access rules where those apply.

You may complain to Hong Kong's Privacy Commissioner for Personal Data (PCPD). Direct marketing, if introduced, requires the prescribed information about data and marketing categories, the legally required consent and a free opt-out. We do not infer that consent from an ordinary enquiry.

11. Automated decisions, security and changes

We do not use the website enquiry process to make solely automated decisions producing legal or similarly significant effects, or to profile visitors for advertising. Security systems can automatically filter suspected abusive traffic.

Access controls, appropriate technical protection and arrangements with service providers must protect personal data against unauthorised access, loss and misuse. Email is not guaranteed to be a confidential channel; contact us first if you need to transmit especially sensitive material.

Changes to the actual processing will be reflected in this notice. Material new purposes or consent-requiring services will be addressed before the relevant processing starts.