Personal data

Privacy policy.

Who collects your data when you visit this site, why, how long it is kept, and how to exercise your rights.

Data controller

The controller for the personal data collected through this site is Luxapps Sàrl, 2 rue de l'École, L-8376 Kahler, Luxembourg.

For any question regarding the processing of your data, you can contact our DPO at (group DPO function provided by Luxgap).

Purposes, data and legal bases

We only collect the data strictly necessary for the following purposes :

  1. Responding to your request via the contact form.
    Data collected : last name, first name, business email, company, phone (optional), subject, message.
    Legal basis : performance of pre-contractual measures at the data subject's request (Article 6.1.b GDPR).
    Retention : 3 years from the last contact, then 5 years' archiving for evidential purposes.
  2. Sending you our newsletter.
    Data collected : name, business email.
    Legal basis : express consent collected at sign-up (Article 6.1.a GDPR), revocable at any time via the unsubscribe link included in every mailing.
    Retention : until you unsubscribe.

When you browse the site, we operate an anonymous, cookieless audience measurement, using Matomo (self-hosted on stats.luxgap.com, configured without cookies and with IP-address anonymisation) complemented by a server-side count. We record : the page viewed, the referring domain (without URL parameters), your country (inferred from a local GeoIP database) and your language. Your IP address and user-agent are never stored in clear text : they are only used, at request time, to compute an ephemeral identifier via a daily-salted SHA-256 hash (the salt rotates daily, so your visits cannot be linked from one day to the next). Legal basis : the publisher's legitimate interest in measuring its site's audience (Article 6.1.f GDPR). Retention : 90 days against the ephemeral identifier, anonymous aggregates beyond that. No transfer outside the EU, no individual profiling, no third-party sharing. See the cookies policy for details.

Recipients

Your data is only shared with authorised staff within Luxapps Sàrl (sales, support and marketing teams) directly involved in the purpose.

We rely on strictly necessary processors : sovereign European hosting, a transactional email service and an in-house CRM. All operate under a contract compliant with Article 28 GDPR and within the European Economic Area.

None of the data we collect and process is transferred outside the European Union, nor is it assigned, rented or sold to third parties for commercial purposes. Loading third-party content (the OpenStreetMap map, the ?tweaks=1 design-mode CDN) may however transmit your IP address to servers located outside the EU ; details are in our cookies policy.

Security

Your data is protected by encryption in transit (TLS 1.3) and at rest (AES-256), with strict access controls and systematic logging. Luxapps operates an Information Security Management System (ISMS) aligned with the ISO/IEC 27001 standard (certification planned).

Your rights

In accordance with Articles 15 to 22 of the GDPR and the Luxembourg law of 1 August 2018, you have the following rights :

  • Access to your personal data.
  • Rectification of inaccurate or incomplete data.
  • Erasure (« right to be forgotten »).
  • Restriction of processing.
  • Portability of your data in a structured, machine-readable format.
  • Objection to processing, on grounds relating to your particular situation.
  • Withdrawal of consent, at any time and free of charge, for processing based on that basis.

Your data is not subject to any automated individual decision-making or profiling within the meaning of Article 22 GDPR.

To exercise your rights, write to us at , attaching if necessary a copy of an identity document (which will be destroyed after verification).

Complaint

If you consider that the processing of your data does not comply with the regulations, you may lodge a complaint with the Commission nationale pour la protection des données (CNPD), the Luxembourg supervisory authority.

Changes

This policy may be updated. The date of the last revision is shown below. For users subscribed to our newsletter, any substantial change will be notified to you by email.

Last updated: 16 June 2026.