Privacy Policy

CITEC acts as the data controller within the meaning of Article 4(7) GDPR for the processing described in this policy.

• Controller: Changzhou Intl. Trade & Enterprises Cooperative Co., Ltd(CITEC), No. 20 Floor, Huajing Building, No. 1 Hejing Garden, Zhonglou District, Changzhou 213000, Jiangsu, P.R. China.
• EU representative: to be appointed and published under Article 27 GDPR before we offer goods or services to individuals in the European Union.
• Data Protection Officer: citec@citec-group.com — our designated contact for all data protection matters, including requests to exercise your rights.
• General enquiries: citec@citec-group.com · 0086 519 86803329

This policy applies to personal data we process through this website, including the enquiry and quotation forms, the technical support and document request pages, our e-mail and telephone correspondence, and our business contacts with healthcare professionals, institutional buyers and authorised distributors.

This website is intended for healthcare professionals, medical device distributors and institutional buyers. It is not directed at the general public. We do not process personal data submitted through this website for the purpose of providing medical care, and this policy does not describe any processing we carry out as a processor on behalf of a hospital or clinic.

We process personal data in accordance with the principles in Article 5 GDPR. In practice this means that we:

• process personal data lawfully, fairly and transparently, and tell you what we are doing with it;
• collect it only for the specific purposes described in section 5, and not use it for anything incompatible with those purposes;
• keep it adequate, relevant and limited to what those purposes require;
• keep it accurate and up to date, and correct it when you tell us it is wrong;
• keep it only for as long as the retention periods in section 10 require;
• protect it with appropriate technical and organisational measures, and be able to demonstrate that we do so.

Data you provide to us. When you submit an enquiry, request a quotation or product documentation, or contact us by e-mail or telephone, we process your name, professional contact details (business e-mail address, telephone number, organisation and job title), country and the content of your message.

Data collected automatically. When you visit this website, our server logs your IP address, browser type and version, device and operating system, the page that referred you, the pages you view, and the date and time of each request. We use this information to operate the site securely and to understand in aggregate which content is useful.

Data relating to a product you have bought or enquired about. If you contact us about a device, we may process the product reference, batch or lot number and details of the enquiry so that we can answer it and meet our traceability and vigilance obligations as a medical device manufacturer.

We do not collect special categories of personal data through this website, and we ask that you do not send us patient information or other health data through the enquiry forms. See section 6.

Under Article 6(1) GDPR we may process personal data only if one of the listed legal bases applies. The table below sets out why we process your data and the basis we rely on for each purpose.

Where we rely on legitimate interests, we have carried out a balancing assessment to confirm that our interests are not overridden by your rights and freedoms. You may object to this processing at any time — see section 11.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew it. Refusing or withdrawing consent for marketing or analytics does not affect your ability to use this website or to contact us.

This website is not designed to collect data concerning health, and we do not seek it. Do not include patient details, medical records or any other special category data listed in Article 9 GDPR in an enquiry submitted through this site.

If you are contacting us professionally about the clinical performance of a device, please share only the information necessary to answer your question and contact us at citec@citec-group.com before sending it.

We use cookies and similar technologies only as described below. Cookies that are not strictly necessary are set only after you consent, in line with Article 6(1)(a) GDPR and the ePrivacy Directive.

This website serves its fonts, stylesheets and scripts from our own domain, so no third-party font provider or content delivery network receives your IP address simply because you visited. Where an embedded video or map from a third party is loaded, that provider may set its own cookies once you start the player; we ask for your consent before loading such embeds where it is required.

You can change or withdraw your cookie consent at any time through the cookie settings link in the footer of every page, and you can also block or delete cookies in your browser. Blocking strictly necessary cookies may prevent parts of the site from working.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We disclose it only to the following recipients:

• Processors acting on our instructions — website hosting and IT support, business e-mail services, and customer relationship management. Each is bound by a data processing agreement under Article 28 GDPR and may use your data only to provide the service to us.
• Authorised distributors — where your enquiry concerns a territory served by one of our distributors, we may share your contact details and enquiry with that distributor so it can respond. We share only what is necessary for that purpose.
• Notified bodies, certification and testing organisations — where necessary to maintain the certification of a device you have enquired about or bought.
• Competent authorities and professional advisers — regulators, customs, courts and our legal or insurance advisers, where the law requires disclosure or it is necessary to establish, exercise or defend a legal claim.
• A successor entity — if our business is sold, merged or reorganised, personal data may transfer to the acquiring entity, which will remain bound by this policy.

We do not transfer personal data to any other third party for its own marketing purposes.

CITEC is established in the People's Republic of China, and our processors and distributors are located in several countries. If you contact us from the European Economic Area, the United Kingdom or Switzerland, your personal data will be transferred to and processed in China and possibly in other countries outside those areas.

Where we transfer personal data out of the EEA or the UK, we put one of the following safeguards in place before the transfer, as required by Chapter V GDPR:

• the European Commission's Standard Contractual Clauses (Article 46(2)(c)) or the UK International Data Transfer Addendum;
• where the clauses are relied on, a transfer impact assessment covering the laws of the destination country;
• supplementary technical measures, including encryption in transit and at rest, access control and contractual confidentiality obligations.

You may request a copy of the safeguards we rely on for a specific transfer by writing to citec@citec-group.com. We may redact commercially sensitive information from the copy we provide.

We keep personal data only as long as necessary for the purpose it was collected for, applying the storage limitation principle in Article 5(1)(e) GDPR. Our standard periods are:

• Enquiries that do not lead to a business relationship — 24 months from our last contact with you.
• Customer and distributor records — for the duration of the relationship, then 6 years to meet contractual, tax and commercial record-keeping requirements.
• Device traceability and vigilance records — for the period required by applicable medical device regulation, which may extend beyond 10 years after the device is placed on the market.
• Server logs — 12 months, then deleted or anonymised.
• Marketing consent records — until you withdraw consent, plus 3 years to demonstrate that consent was given.

When a period ends we delete or irreversibly anonymise the data, unless we are legally required to keep it longer or need it for the establishment, exercise or defence of legal claims.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the following rights under Articles 15 to 22 GDPR:

• Right of access (Article 15) — to obtain confirmation of whether we process your data, and a copy of it together with information about how we use it.
• Right to rectification (Article 16) — to have inaccurate or incomplete data corrected.
• Right to erasure (Article 17) — to have your data deleted where we no longer need it, where you withdraw consent, or where you successfully object. This right is not absolute: we may need to keep data to comply with a legal obligation, particularly in relation to medical device traceability.
• Right to restriction (Article 18) — to ask us to stop using your data while a question about its accuracy, lawfulness or our legitimate interests is resolved.
• Right to object (Article 21) — to object to processing based on our legitimate interests, and to object at any time to the use of your data for direct marketing, after which we will stop.
• Right to data portability (Article 20) — to receive data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller, where the processing is based on consent or contract and is carried out by automated means.
• Right to withdraw consent (Article 7(3)) — at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Rights relating to automated decisions (Article 22) — see section 13.

Your right to complain. If you believe we have handled your data unlawfully you have the right to lodge a complaint with a supervisory authority under Article 77 GDPR, in the country where you live, work, or where the alleged infringement took place. We would appreciate the opportunity to address your concern first, so please consider contacting our Data Protection Officer before escalating.

To exercise any of the rights in section 11, write to our Data Protection Officer at citec@citec-group.com, or by post to the address in section 1. Please describe the right you wish to exercise and give us enough information to identify you.

We will respond without undue delay and in any event within one month of receiving your request. Where a request is complex or you have made several requests, we may extend this by a further two months and will tell you within the first month if we need to, together with our reasons.

Requests are free of charge. We may charge a reasonable fee, or refuse a request, where it is manifestly unfounded or excessive, in particular because it is repetitive.

To protect your data we will ask you to confirm your identity before we act. Where we have reasonable doubts about your identity we may ask for additional information; we will not use that information for any other purpose. If we are unable to identify you from the data we hold, we will tell you so.

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you within the meaning of Article 22 GDPR. Enquiries are reviewed by our staff.

If we ever introduce such processing, this policy will be updated before it begins, and we will tell you about the logic involved, the significance and consequences of the decision, and provide a way to obtain human intervention, express your point of view and contest the decision.

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration and unauthorised disclosure or access, taking into account the state of the art and the risks involved. These measures include encrypted connections (HTTPS) for this website, encryption of data at rest, role-based access control limited to staff who need the data, confidentiality obligations for employees and processors, logging, and regular review of our security practices.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by Article 33 GDPR. Where the breach is likely to result in a high risk to you, we will also inform you directly without undue delay, telling you what happened and what we are doing about it, as required by Article 34.

This website is a business-to-business site intended for healthcare professionals, distributors and institutional buyers. It is not directed at children, and we do not knowingly collect personal data concerning children. If you believe that a child has provided us with personal data, please contact our Data Protection Officer at citec@citec-group.com and we will delete it without undue delay.

This website links to external sites, including our social media channels, video platforms and the websites of certification bodies and distributors. We do not control those sites and are not responsible for their content or their handling of personal data. When you follow a link, the privacy policy of the site you reach applies, so please read it before providing any personal data.

We review this policy regularly and may update it to reflect changes in our processing, our products or the law. The current version is always published on this page, with the revision date shown at the top and in the sidebar.

Where a change is material — for example, a new purpose for processing, a new category of recipient, or a change to your rights — we will bring it to your attention by a prominent notice on this website and, where we hold your contact details and the change affects you directly, by e-mail, before the change takes effect. Where the law requires it, we will ask for your consent again.

For any question about this policy, or to exercise a right, please contact our Data Protection Officer:

• Data Protection Officer: citec@citec-group.com
• General enquiries: citec@citec-group.com
• Telephone: 0086 519 86803329
• Postal address: No. 20 Floor, Huajing Building, No. 1 Hejing Garden, Zhonglou District, Changzhou 213000, Jiangsu, P.R. China

You can also reach us through the enquiry form on our Contact Us page. Please use the Data Protection Officer address above for anything relating to data protection, so that your request reaches the right team.