Legal
What personal data we collect from trade accounts, why, how long we keep it, and how to exercise your rights.
Last updated: 8 September 2026
The data controller is CORLEONE LIMITED, a Hong Kong company registered under number 79284031, RM11, 13/F, BLK C, WONG KING IND. BLD., 192-198 CHOI HUNG RD, SAN PO KONG, Hong Kong, trading as Maison Dino. Contact: sonia@maisondino.com.
No representative in the European Union has been appointed to date. Requests from persons located in the European Union are handled at the address above.
Data are processed in accordance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) and, for persons located in the European Union or the United Kingdom, the General Data Protection Regulation (GDPR) and the UK GDPR. Persons located in other countries benefit from the rights recognised by their local legislation.
This policy applies to the website maisondino.com, professional account creation, quote requests, contact forms, the conversational assistant and the resulting exchanges by e-mail, phone or WhatsApp.
Professional account: surname, first name, business e-mail address, company, country, position, password (hashed), time-stamped professional-status declaration, time-stamped acceptance of the Terms.
Quotes and orders: selected products, quantities, delivery address, shipping and import information, quote history, correspondence.
Contact: name, e-mail, message, company.
Conversational assistant: content of exchanges, products viewed.
Technical data: IP address, browser type, pages viewed, timestamps, session identifier.
Payment: card data are entered and processed exclusively by the payment provider; the Seller never stores them.
Account creation and management, access to trade prices: performance of the contract.
Preparation, follow-up and performance of quotes and orders, invoicing, delivery: performance of the contract.
Replying to contact requests and support: pre-contractual measures and legitimate interest.
Conversational assistant: legitimate interest (product search assistance).
Website security, fraud prevention, technical logs: legitimate interest and legal obligation.
Newsletter and B2B commercial prospecting: consent, or legitimate interest for existing clients, with the option to unsubscribe at any time.
Accounting and tax obligations: legal obligation.
Active professional account: duration of the business relationship.
Inactive account: deletion or anonymisation after three (3) years without login.
Quote request not followed by an order: three (3) years.
Accepted quotes, invoices and order documents: seven (7) years (Hong Kong accounting obligations).
Contact messages: two (2) years.
Newsletter: until unsubscription, then three (3) years as evidence.
Assistant conversations: twelve (12) months.
Technical logs: twelve (12) months.
Data are accessible to authorised staff of CORLEONE LIMITED and to its processors: Shopify (website hosting, catalogue and account management; Canada, Ireland, United States), Airtable (professional account and quote management; United States), e-mail delivery provider (Brevo, France, or Resend, United States), payment provider (Airwallex, Hong Kong, or any provider stated on the quote), language-model provider for the assistant (OpenAI or Anthropic, United States), carriers and freight forwarders for delivery.
As CORLEONE LIMITED is established in Hong Kong, data of persons located in the European Union are transferred outside the Union. These transfers are governed by the European Commission's standard contractual clauses concluded with each processor, or by an adequacy decision where one exists (Canada for Shopify Inc.). A copy of the safeguards may be requested at sonia@maisondino.com.
Data are never sold or rented.
The conversational assistant helps with product search. Exchanges are transmitted to the language-model provider to generate replies and are not used to train its models under the applicable contractual terms. Do not enter sensitive data in the assistant.
The Seller implements appropriate technical and organisational measures: encrypted connections (HTTPS), hashed passwords, brute-force lockout, restricted data access, logging, backups, no storage of payment data.
Every person has the right of access, rectification, erasure, restriction, objection and portability regarding their data, and the right to withdraw consent at any time where processing relies on it.
Requests are sent to sonia@maisondino.com. The Seller replies within forty (40) days in accordance with Hong Kong law, and within one (1) month for persons located in the European Union.
Complaints: Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk). Persons located in the European Union may lodge a complaint with the supervisory authority of their country of residence (France: CNIL, www.cnil.fr; Spain: AEPD, www.aepd.es).
In the event of a data breach likely to result in a risk to the rights and freedoms of individuals, CORLEONE LIMITED notifies the competent authority within seventy-two (72) hours for persons located in the European Union, and informs the persons concerned where the risk is high. The notification decision is taken by the management of CORLEONE LIMITED.
The website uses only cookies strictly necessary for its operation (session, security, language and currency preferences). No advertising or third-party tracking cookie is set. See the cookie policy.
This policy may be amended at any time. The version in force is the one published on the website with its date. Material changes are notified by e-mail to account holders.