Last updated: 15 September 2026

Dreyfus is committed to protecting personal data and respecting the privacy of website visitors, professional contacts, clients and fellow practitioners. This policy explains how the Dreyfus Asia website collects and uses personal data. It is intended to meet the requirements of the EU General Data Protection Regulation (GDPR) and, where applicable, the Personal Information Protection Law of the People’s Republic of China (PIPL).

1. Data controller and personal information processor

Dreyfus determines why and how personal data submitted through this website is processed. It is the data controller under the GDPR and, where the PIPL applies, the personal information processor.

Dreyfus is represented by Nathalie Dreyfus, its managing partner.

2. Personal data we collect

Depending on how you interact with the website and with Dreyfus, we may collect:

  • identity and professional information, including your name, organisation, position, professional role and country or region;
  • contact details, including your email address, telephone number and postal address;
  • information included in an enquiry, including relevant rights, territories, authorities, parties and procedural deadlines;
  • technical and security information, including your IP address, device, browser, pages viewed, form security data and consent choices;
  • communications exchanged with Dreyfus by email, telephone, post, WeChat or another authorised channel.

Please do not send confidential documents through a public form or WeChat before Dreyfus has completed the necessary conflict checks and confirmed an appropriate transmission method.

3. Purposes and legal bases

  • Enquiries and proposed instructions: to identify the sender, carry out an initial conflict check, assess and respond to the request, and prepare a scope of work, fee proposal or engagement documents. The GDPR bases are pre-contractual steps and Dreyfus’ legitimate interest in responding to professional enquiries.
  • Professional services: to provide intellectual property services and manage the relationship, based on contract performance and compliance with professional or legal obligations.
  • Website and form security: to protect the website and prevent misuse, based on Dreyfus’ legitimate interest in protecting its systems.
  • Communications: to communicate through the channel selected by the visitor, including email, contact form or WeChat. The applicable basis may include pre-contractual steps, contract performance or consent.
  • Compliance: to meet professional, regulatory, accounting and legal obligations.

Where the PIPL applies, processing relies on a legal basis permitted by that law, including separate consent for a cross-border transfer where required.

4. Recipients and service providers

Personal data is accessible only to authorised members of Dreyfus and providers that need it for the purposes described above. Services currently used may include:

  • OVH SAS, for hosting in France;
  • WordPress, Elementor and their technical components, for website operation and page display;
  • Quform, for contact and enquiry forms;
  • Postmark, operated by ActiveCampaign, for transactional email routing;
  • the website’s cookie consent tool, for recording cookie preferences;
  • Tencent and WeChat, when a visitor voluntarily scans the official account QR code, follows the account or sends a message through WeChat.

Dreyfus does not sell personal data. When WeChat is used, Tencent also processes account, device and communication information under its own terms and privacy documentation.

5. Transfers from mainland China to France

When a visitor located in mainland China submits the contact form, the information entered is transferred to Dreyfus in France.

  • Overseas recipient: Dreyfus, 78 avenue Raymond Poincaré, 75116 Paris, France, contact@dreyfus.fr.
  • Purposes: to identify the sender, carry out an initial conflict check, assess and respond to the enquiry, and prepare appropriate next steps.
  • Processing methods: collection through the form, secure routing by the website and transactional email provider, storage in systems used by Dreyfus, and review by authorised professionals.
  • Information: name, email address, professional context, message, voluntarily supplied matter information, technical security information and consent record.
  • Retention: for the periods stated in section 7 or as necessary for the stated purposes and legal obligations.
  • Rights: contact contact@dreyfus.fr as described in section 10.

The contact form requests separate consent for this cross-border transfer. Refusing the transfer does not prevent access to the public website, but Dreyfus cannot receive or respond to the form enquiry without the information being transferred to France.

6. Other international transfers

Depending on the service configuration, technical providers may process or access personal data outside the European Economic Area or the visitor’s country. Where required by the GDPR, Dreyfus relies on an adequacy decision, approved Standard Contractual Clauses or another recognised safeguard.

Before any change of hosting or service provider takes effect, Dreyfus will update this policy and reassess the relevant safeguards.

7. Retention periods

  • prospective contact data: up to three years after the last meaningful contact, unless legal obligations or legal claims justify another period;
  • client and matter data: for the professional relationship and the additional period required by professional and legal obligations;
  • contact form and transactional email data: for the time needed to route, protect and respond to the enquiry, subject to the rules above;
  • cookie preference data: for the period stated in the cookie consent tool;
  • technical security logs: for the period reasonably needed to protect the website and investigate incidents.

8. Cookies

The website uses only the strictly necessary cookies and technical data required to operate and secure the website and remember cookie choices. No audience measurement, advertising or session-recording technology is active. This policy and the consent mechanism must be updated before any non-essential technology is enabled.

Use of the WeChat contact feature is voluntary and opens a service operated by Tencent.

9. Security, confidentiality and automated decisions

Dreyfus applies appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction. No online system can be guaranteed to be completely secure.

The website does not make decisions producing legal or similarly significant effects solely through automated processing of information submitted in the contact form.

10. Your rights

Subject to applicable law, you may request access, rectification or completion, erasure, restriction, portability or object to processing. You may withdraw consent at any time without affecting earlier processing. Where the PIPL applies, you may also request an explanation of the processing rules and exercise the rights granted under that law.

Send requests to contact@dreyfus.fr or by post to Dreyfus, 78 avenue Raymond Poincaré, 75116 Paris, France. Please identify the website and subject of your request. Reasonable proof of identity may be requested where necessary.

You may also lodge a complaint with the French data protection authority, the CNIL: www.cnil.fr. Individuals in mainland China may also contact the competent personal information protection authority where applicable.

11. Children

This professional website is not intended for children, and Dreyfus does not knowingly collect children’s personal data through the contact form.

12. Policy updates

This policy may be updated to reflect changes to the website, providers, hosting, processing practices or applicable law. The date shown at the top identifies the latest version.