Privacy policy

Controller

Grossfeld Immobilière S.A.
RCS Luxembourg: B85508
VAT: LU19142777
Registered office: 17, rue de la Poudrerie, L-3364 Leudelange

Contact: info@promobe.lu.

Data processed and purposes

• Viewing or information request: first name, last name, email, phone, message, residence concerned — basis: pre-contractual steps (Art. 6(1)(b) GDPR); kept 3 years after last contact.
• Project updates: email — basis: consent (Art. 6(1)(a)), withdrawable at any time; kept until withdrawal.
• Technical and security logs: truncated IP — basis: legitimate interest; kept 12 months maximum.

Audience measurement

Vercel Web Analytics measures page views and estimates visitor numbers without analytics cookies. An identifier derived from the request is discarded after 24 hours. URL query parameters are removed before sending; unsubscribe pages and editor visits are excluded.

Internal counters also record apartment views, downloads and searches without visitor identifiers or stored IP addresses. These daily totals are retained for 36 months. Your browser’s Do Not Track signal disables these counters and Vercel Web Analytics events.

Recipients and processors

• Vercel Inc. — site hosting, processing in the EU region; US company, transfers covered by standard contractual clauses.
• Supabase — database, authentication and document storage, eu-west-1 region (Ireland).
• Winova — design, maintenance and support, Luxembourg; processor within the meaning of Art. 28.

No data is sold, rented or shared for advertising. The list above is kept current; each processor is bound by a data-processing agreement.

Your rights

You have the right of access, rectification, erasure, restriction of processing, portability and objection. Write to info@promobe.lu: we reply within one month and log every request. To stop receiving project updates, the unsubscribe link in every email works immediately, with no need to contact us.

Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out beforehand. You may lodge a complaint with the CNPD (Luxembourg's data protection authority).

Security

Encryption in transit and at rest; access partitioned by row-level security policies in the database; named accounts, never shared; an immutable audit trail of price and status changes; strict security headers (CSP, HSTS); documents held in private storage reachable only through short-lived signed links.

In the event of a data breach, the CNPD is notified within 72 hours of becoming aware, and affected individuals are informed where the risk to their rights is high.

Changes

Any change to this policy is published on this page. The version of the text accepted when a form is submitted is stored with the enquiry, so we can evidence exactly what was agreed to.