GDPR & data rights

Scope and responsibility

ORINE LABS, registration number 202603239711 (003887566-X), Malaysia. Contact hello@orinelabs.com or WhatsApp +60 13-765 8905. We work from Malaysia and welcome European clients. This page supplements our privacy policy where the EU GDPR, EEA data-protection rules or UK GDPR apply to a processing activity. It is not a certification or a claim that every project meets every regulatory requirement.

Why we process information

Depending on the activity and applicable law, we rely on steps you request before entering a contract and performance of a contract; legitimate interests in answering business correspondence, protecting systems and managing business relationships, balanced against your rights; legal obligations for required records; or consent where a particular activity requires it. We do not rely on a general website visit as consent to marketing.

Your rights

Subject to the conditions and exceptions in applicable law, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You can object to direct marketing at any time and withdraw consent without affecting earlier lawful processing. This website does not make decisions with legal or similarly significant effects about you through automated profiling.

Send requests to hello@orinelabs.com with enough context to locate the information. We may ask for proportionate identity verification. For requests governed by GDPR, we respond without undue delay and normally within one month; where a permitted extension is needed, we explain it within that first month. A refusal or limitation will be explained with the available complaint route.

International transfers and client projects

Contacting Orine Labs involves a business operating in Malaysia. Providers may also process information outside your country. Before a regulated transfer of client personal data, the parties need to establish their controller/processor roles, instructions, security requirements, retention, subprocessors and a valid transfer mechanism where required. Depending on the circumstances, this may include standard contractual clauses, an applicable UK transfer instrument and an assessment of the transfer.

We do not claim that Malaysia has EU adequacy status or that merely accepting these website policies authorises all transfers. Ask about these arrangements before sending customer or employee datasets. A data-processing agreement and any required representative arrangements must be settled for the relevant engagement; no EU or UK representative is currently identified on this website.

Complaints and further information

You can complain to the competent data-protection authority, including in the EEA country of your habitual residence, workplace or alleged infringement, or to the UK Information Commissioner where relevant. You do not need to contact us first to exercise that right.

Find an EEA supervisory authority · UK ICO complaints · European Commission: GDPR scope