Privacy Policy
Last Updated: 18 January 2026 · Effective Date: 18 January 2026
Cinnabar is committed to handling personal data with care and transparency. This policy explains what data we collect, how we use it, and how you can exercise your rights. If you have any questions, please contact us at [email protected].
1. Introduction
This Privacy Policy applies to Cinnabar ("we," "our," "us"), operating from 29 Bonham Strand, Sheung Wan, Hong Kong. We act as data controller for personal data collected through our website and client engagements. We process personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO") and, where applicable, other data protection regulations relevant to our international clients.
2. Data We Collect
We collect the following categories of personal data:
Contact information: Name, email address, and telephone number — provided when you complete the contact form on our website, send us an email, or engage us for services.
Communication records: The content of messages you send us, whether by form, email, or telephone.
Usage data: Information about how you interact with our website, including pages visited and approximate location (country level), collected via analytics cookies where you have consented.
Project data: For client engagements, we may process business data provided to us in the course of delivering services. This is governed by separate engagement terms and data processing agreements.
3. Legal Basis and Purpose
We process personal data on the following bases:
Enquiry handling: Where you contact us with a question or request, we process your data to respond — on the basis of your consent in initiating contact.
Service delivery: Where we enter an engagement, personal data is processed as necessary to perform the contract.
Analytics: Website usage data is processed on the basis of your consent to analytics cookies.
Legitimate interest: We may retain contact records for a reasonable period after an enquiry to provide continuity of service.
4. Data Retention
Enquiry records are retained for up to 24 months from the date of last contact, after which they are deleted. Client engagement records are retained for 7 years from engagement completion to meet legal and professional obligations. Analytics data, where collected, is aggregated and retained for up to 26 months.
5. Data Sharing
We do not sell personal data. We may share data with:
Service providers: Third-party tools used in our operations (e.g., website hosting, analytics). These providers are bound by data processing agreements.
Analytics services: If you consent to analytics cookies, data may be shared with Google Analytics. You can withdraw this consent via the Cookie Policy page.
Legal obligations: We may disclose data where required by law or a valid regulatory request.
6. Data Protection Measures
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include secure server infrastructure, access controls limited to authorised staff, and regular review of our data handling procedures. In the event of a breach affecting your personal data, we will notify you in accordance with applicable requirements.
7. Cookies
Our website uses cookies. Essential cookies are required for basic functionality and cannot be disabled. Optional analytics and preference cookies are only placed with your consent. Full information is available in our Cookie Policy.
8. Your Rights
Under the PDPO and, where applicable, GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request erasure of your data (subject to legal retention obligations)
- Object to certain processing activities
- Request data portability (where applicable under GDPR)
- Withdraw consent at any time (where processing is based on consent)
- Lodge a complaint with the Office of the Privacy Commissioner for Personal Data (Hong Kong)
To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.
9. Third-Party Links
Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.
10. Children's Privacy
Our services are directed at business clients and not at individuals under the age of 18. We do not knowingly collect personal data from minors.
11. Policy Updates
We may update this policy from time to time. Where changes are material, we will indicate the updated date at the top of this page. Continued use of our website following an update constitutes acceptance of the revised policy.
12. Contact
Data controller: Cinnabar
Address: 29 Bonham Strand, Sheung Wan, Hong Kong
Email: [email protected]
Phone: +852 2873 5416