Privacy policy.

This Privacy Policy explains how ACJ Lux (“we”, “us”) processes personal data when you visit https://acjlux.lu, use our contact flows, AI assistant, newsletter, or book a visit. It is drafted in concise, transparent, intelligible and easily accessible form (Art. 12 GDPR). Each processing activity below is linked to a lawful basis under Art. 6 GDPR (and, where relevant, the ePrivacy rules for cookies and similar technologies). Trading / brand name: ACJ Lux Legal entity acting as controller: ACJ Lux

1. Who is the Data Controller?

The Data Controller of your personal data is: Legal entity: ACJ Lux Brand: ACJ Lux Registered address: 5-7, rue d'Esch, L-4440 Soleuvre, Luxembourg Luxembourg RCS: B345678 VAT number: LU34567890 Data protection contact: [email protected] Phone: +352 26 19 09 42 Website: https://acjlux.lu We have not appointed a Data Protection Officer (DPO), as this is not mandatory for our processing activities under Art. 37 GDPR. For any privacy request, contact [email protected].

2. What Data We Collect, Why, and on What Lawful Basis

We process only data that is adequate, relevant and limited to what is necessary (Art. 5(1)(c) GDPR). A. Contact and project enquiry data — identity and contact details (name, email, phone), company name if provided, project description, location/commune, preferred language, appointment preferences, and optional file attachments (plans, photos, estimates). Purpose: respond to your request, technical qualification, quotes, scheduling and follow-up. Lawful basis: Art. 6(1)(b) GDPR (pre-contractual steps / contract); Art. 6(1)(f) where needed for fraud prevention and operational security. B. Session, booking and assistant data — conversation content with the on-site assistant, secure session/resume tokens, language preference, and booking slot metadata. Purpose: operate the assistant and booking flow, preserve continuity, prevent abuse. Lawful basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR. Note: assistant replies may be generated with the help of AI models. We do not use these interactions to make solely automated decisions producing legal or similarly significant effects about you (Art. 22 GDPR). C. Technical and security data — IP address, approximate location derived from network signals where provided by the infrastructure, browser/device metadata, request logs, error diagnostics and cookie identifiers. Purpose: security, availability, debugging, traffic integrity. Lawful basis: Art. 6(1)(f) GDPR (legitimate interest in securing and operating the Website). D. Analytics and marketing measurement (only with consent) — aggregated/pseudonymous usage metrics via tools such as Google Analytics / Google Tag Manager when enabled. Purpose: understand Website performance and improve content. Lawful basis: Art. 6(1)(a) GDPR (consent) and ePrivacy consent requirements. E. Newsletter data — email address and subscription preferences. Purpose: send updates you requested. Lawful basis: Art. 6(1)(a) GDPR (consent). You may unsubscribe at any time. F. Communication channel data — if you contact us via email, phone or messaging tools used by our team (for example business messaging), we process the content needed to handle your request. Lawful basis: Art. 6(1)(b) and/or Art. 6(1)(f) GDPR. G. Payment data — not collected through this Website’s public forms. If a separate commercial agreement is signed, invoicing and accounting records may be processed under Art. 6(1)(b) and Art. 6(1)(c) GDPR. We do not intentionally collect special categories of data (Art. 9 GDPR). Please do not upload health data or other sensitive data unless we expressly request it for a contract and provide a specific notice.

3. Cookies and Similar Technologies

We use cookies and similar technologies as follows: — Strictly necessary: security, load balancing, session continuity, storing your cookie choices. These do not require consent. — Analytics / measurement: only after you accept via our cookie banner or preference centre. — Marketing tags (if configured for the site): only after consent. You can accept, refuse or customise non-essential cookies at any time via the cookie controls on the Website. Withdrawing consent does not affect the lawfulness of processing before withdrawal. Cookie preference records may be stored locally (for example in your browser) and/or logged as needed to demonstrate consent.

4. Recipients and Processors

We do not sell your personal data. We share data only with trusted providers acting as processors under Art. 28 GDPR (or as independent controllers where the law so requires), including where used for this Website: — Cloudflare — hosting, CDN, DNS, Worker edge runtime, D1 database and R2 object storage for optional uploads. — Email delivery providers (for example Resend) — transactional messages (confirmations, follow-ups). — Google services — Workspace / email / calendar for enquiry handling; Google Analytics / Tag Manager only with consent. — AI model providers (for example Google Gemini) — to generate assistant replies and internal project summaries from the content you submit. — Messaging providers used by our operations team (where configured) — to alert staff about new leads. Staff and authorised contractors of ACJ Lux / ACJ Lux may access data on a need-to-know basis under confidentiality duties. Each processor is bound by instructions, confidentiality and security obligations. A current list of main processors can be requested at [email protected].

5. International Transfers

Primary hosting and databases are operated with Cloudflare infrastructure with processing oriented to the EEA where available. Some providers (analytics, email, AI, productivity tools) may process data in the United States or other third countries. Where a transfer outside the EEA/UK occurs, we rely on appropriate safeguards such as: — European Commission adequacy decisions (including the EU–US Data Privacy Framework where the recipient is certified); — Standard Contractual Clauses (SCCs); and — supplementary technical and organisational measures where required. You may request information about the safeguards applicable to a specific transfer by contacting [email protected].

6. Retention

We keep personal data only as long as necessary for the purposes stated, then delete or anonymise it, unless a longer period is required by law: — Active enquiries / leads: for the commercial relationship and typically up to 5 years afterwards for evidence, accounting and legal claims (subject to local limitation rules). — Booking and session tokens: for the lifetime of the booking flow / session, then deleted or rotated. — Uploaded files: while the enquiry is active and for the same commercial retention window unless you ask us to delete them earlier and no legal hold applies. — Newsletter: until you unsubscribe or we close the list. — Security / server logs: ordinarily up to 12 months, longer if needed for an incident investigation. — Cookie consent evidence: for the period needed to demonstrate compliance. Exact periods may vary slightly by market accounting rules; contact [email protected] for details about your case.

7. Security Measures

We implement appropriate technical and organisational measures (Art. 32 GDPR), including access controls, encrypted transport (HTTPS/TLS), least-privilege staff access, monitoring of abnormal traffic, and contractual security obligations for processors. No method of transmission or storage is perfectly secure. If we become aware of a personal data breach likely to result in a risk to your rights, we will notify the competent supervisory authority and, where legally required, affected individuals.

8. Your Rights

Subject to GDPR conditions and exceptions, you may exercise the following rights by emailing [email protected]. We will respond within one month of receipt (extendable by two further months for complex requests, with notice). — Access (Art. 15) — Rectification (Art. 16) — Erasure (Art. 17) — Restriction (Art. 18) — Portability (Art. 20) — Objection to processing based on legitimate interests or to direct marketing (Art. 21) — Withdraw consent at any time (Art. 7(3)) where processing is consent-based — Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Art. 22) — we do not carry out such decision-making on this Website We may need to verify your identity before fulfilling a request. If requests are manifestly unfounded or excessive, we may charge a reasonable fee or refuse (Art. 12(5) GDPR).

9. Complaints to a Supervisory Authority

If you believe our processing infringes the GDPR, you may lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. In Luxembourg, the supervisory authority is the Commission nationale pour la protection des données (CNPD): https://cnpd.public.lu/. EU authority directory: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

10. Updates

The current version of this Privacy Policy is always published on this page (date: 2026-11-05 10:35:57). We may update it when our processing or legal requirements change. Material changes will be highlighted on the Website and, where appropriate, communicated by email.