GDPR · EU · Luxembourg
Privacy Policy
Last updated: June 2026 (Version 2026-06-lu)
1. Controller
See also our Legal notice.
2. What data we process
Contact / project request form: name, email, project type, budget estimate (optional), message, and privacy consent. Submissions are sent via Formspree to our email inbox.
Order tracking: status and quote information linked to your request ID (no account required).
Server logs: IP address, timestamp, and request metadata for security and rate limiting (typically short retention).
No profiling, no sale of data, no advertising trackers.
3. Purposes & legal basis (GDPR Art. 6)
- Handling your inquiry — Art. 6(1)(b) pre-contractual steps / Art. 6(1)(a) consent (checkbox on form)
- Project administration — Art. 6(1)(b) contract performance where a project proceeds
- Security & abuse prevention — Art. 6(1)(f) legitimate interest
- Email notifications (if SMTP configured) — Art. 6(1)(b) / Art. 6(1)(f)
4. Retention
- Inquiries not pursued: deleted on request or after 24 months of inactivity unless legal retention applies
- Active / completed projects: retained as required for accounting and contractual obligations (typically up to 10 years for tax-related records where applicable under Luxembourg law)
- Server logs: rotated automatically; not kept longer than necessary for security
5. Recipients & processors
Data is stored on our server (JSON database file). We do not sell data to third parties.
When you use our site, these providers may process technical data (e.g. IP address):
- Hosting / infrastructure provider (where the site is deployed)
- Google Fonts & Tailwind CDN (see Cookie Policy)
- Formspree (form delivery to our email — Formspree Privacy Policy)
- Payment provider (e.g. Stripe) only when you use a deposit link we send you
Transfers outside the EU/EEA: only where providers use appropriate safeguards (e.g. EU-US Data Privacy Framework, Standard Contractual Clauses).
6. Cookies & storage
Details in our Cookie Policy. Summary: essential local storage only; no analytics cookies.
7. Your rights
Under the GDPR you have the right to:
- Access your data (Art. 15)
- Rectification (Art. 16)
- Erasure (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time (Art. 7(3)) — without affecting prior lawful processing
- Lodge a complaint with a supervisory authority (Art. 77)
Luxembourg supervisory authority: Commission nationale pour la protection des données (CNPD) — cnpd.public.lu · 15, boulevard Jérôme Feder, L-1471 Luxembourg · info@cnpd.lu
Contact us first: —
8. Children
Our services are not directed at children under 16. We do not knowingly collect personal data from children.
9. Changes
We may update this policy. The version date at the top indicates the current revision. Material changes will be reflected on this page.