Privacy Policy | Cinnabar Arc

1. Introduction

Cinnabar Arc ("we", "us", "our") is committed to handling personal data responsibly and in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO"). This Privacy Policy explains how we collect, use, store, and protect personal data in connection with our business advisory services and our website at cinnabar.pro.

If you have any questions about this policy or about how your personal data is handled, please contact us at [email protected].

2. Data We Collect

Information you provide directly

Name and contact details (email address, phone number)
Business name, role, and relevant professional context
Information shared during introductory conversations or advisory engagements
Messages submitted through our website contact form

Information collected automatically

IP address and browser type
Pages visited on our website and time spent on each
Referring website or source
Cookie identifiers where cookies are accepted (see our Cookie Policy)

3. How We Use Your Data

To respond to enquiries and provide the advisory services you have requested
To manage and administer our engagement with you
To send information relevant to your engagement, including scheduling, documentation, and follow-up
To improve our website and understand how visitors engage with our content
To comply with legal and regulatory obligations applicable to our advisory practice

We do not sell personal data to third parties. We do not use personal data for automated decision-making or profiling that produces legal or significant effects.

4. Legal Basis for Processing

We process personal data on the following bases:

Contractual necessity: Processing required to deliver advisory services under an engagement agreement
Legitimate interests: Processing necessary for our legitimate business interests, including responding to enquiries and improving our services, where these interests are not overridden by your data protection rights
Consent: Where you have explicitly consented to specific processing, such as the use of optional cookies
Legal obligation: Processing required to comply with applicable laws and regulations in Hong Kong

5. Data Retention

We retain personal data for as long as necessary for the purposes for which it was collected, subject to applicable legal requirements. As a general guide:

Enquiries that do not proceed to engagement: deleted within 12 months of last contact
Engagement records: retained for seven years following the close of an engagement, in line with standard professional practice and potential legal requirements
Website analytics data: retained in aggregated form, with identifiable data deleted within 26 months

6. Data Sharing

We do not share personal data with third parties except in the following circumstances:

Where sharing is necessary to provide the services you have requested (e.g., sharing engagement documents with other advisors you have authorised)
Where required by law, court order, or regulatory authority in Hong Kong
With our professional advisors (lawyers, accountants) where necessary and under appropriate confidentiality obligations
With service providers who assist with website hosting and analytics, under data processing agreements that limit their use of the data

7. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

Encrypted storage and transmission of personal data
Access controls limiting data access to those who require it for their role
Regular review of data handling practices
Secure disposal of data that is no longer required

In the event of a data breach that creates a risk to individuals, we will notify affected parties and relevant authorities as required under applicable law.

8. Cookies

Our website uses cookies to understand how visitors engage with our content. For full details of the cookies we use and how to manage your preferences, please see our Cookie Policy.

9. Your Rights Under Hong Kong Law

Under the Personal Data (Privacy) Ordinance (Cap. 486), you have the following rights in relation to personal data we hold about you:

Right of access: To request confirmation of whether we hold personal data about you and to obtain a copy of that data
Right of correction: To request correction of inaccurate personal data
Right to object: To object to certain processing of your personal data
Right to withdraw consent: Where processing is based on consent, to withdraw that consent at any time

To exercise any of these rights, please contact us at [email protected]. We will respond within 40 days as required under the PDPO.

If you have concerns about how we handle your personal data, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data Hong Kong at www.pcpd.org.hk.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies before providing any personal data.

11. Children's Privacy

Our services are intended for business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. Where changes are material, we will take reasonable steps to inform relevant parties. Continued use of our website or services following an update constitutes acceptance of the revised policy.

13. Contact

For any queries relating to this Privacy Policy or to the handling of your personal data, please contact:

Cinnabar Arc
Unit 08, 17th Floor, Emerald Place
62 Hoi Wan Street, Quarry Bay, Hong Kong
Email: [email protected]
Phone: +852 5049 8091