PRIVACY POLICY

LAST UPDATED: August 28, 2026

1. Scope and Identity

Welcome to LUX-LEET. We value your privacy and are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and relevant Dutch laws. This policy explains how we collect, store, and process your information when you use our website and services. Where we process personal data on behalf of a client (for example, data held in a system we build or host for them), we act as a processor and that processing is governed by our Data Processing Addendum and by Chapter 4 of our Terms of Service.

Identity: LUX-LEET — KVK 67287158 — VAT NL002264648B75 — Amsterdam, The Netherlands

Contact: info@lux-leet.com

2. Data We Collect

We may collect the following categories of personal data:

  • Identity Data: Full name, company name, KVK/VAT numbers.
  • Contact Data: Email address, physical address, phone number.
  • Financial Data: Billing information and payment history via our payment provider.
  • Technical & Usage Data: IP address (used transiently to serve and secure the request, not stored alongside your other data), browser type, referring page, the approximate country derived on our own server, and on-page behaviour such as scroll depth and time on the page. See Section 4.

3. How We Use Your Data

Your data is processed on the following legal grounds:

  • Contractual Necessity: To provide the software and hosting services you purchased.
  • Legal Obligation: For tax and financial reporting in the Netherlands.
  • Legitimate Interest: To secure our infrastructure, prevent fraudulent activity, and understand how our site is used through privacy-friendly measurement.
  • Consent: Where you contact us through a form or opt in to a mailing, for the specific purpose stated at the time. You can withdraw consent at any time.

4. Cookies & Analytics

We keep our site deliberately light on tracking. We do not use third-party advertising or analytics cookies, and we do not sell or share your data with ad networks.

  • Essential cookies: A single session cookie that keeps you signed in where relevant and protects forms against abuse, plus a stored choice of site language. These are required for the site to work and need no consent.
  • First-party analytics: Our own "LUX Insights" measurement records each page view with the URL, page title, referring page, browser type, chosen language, and an approximate country derived on our own server. It also records aggregate engagement such as scroll depth and time on the page. Visitors are counted using a daily one-way fingerprint that cannot be reversed to identify you, and no cross-site or advertising profile is built. Raw records are automatically deleted after 30 days; only anonymous daily totals are kept.

5. Who We Share Your Data With

We do not sell your personal data. We share it only with service providers who help us run our business, and only as far as they need it:

  • Payment and invoicing provider: To process payments and meet our accounting obligations.
  • Hosting and infrastructure provider: To run the servers on which our services and your data are hosted.
  • Email delivery provider: To send transactional email such as invoices, notifications, and replies.
  • Authorities: Where we are legally required to disclose information.

International transfers: Our providers are based in the EU/EEA where possible. Where a provider processes data outside the EEA, we rely on an adequacy decision or on Standard Contractual Clauses approved by the European Commission, so your data keeps an equivalent level of protection.

6. Data Retention

We keep personal data only as long as needed for the purpose it was collected for:

  • Invoicing and financial records: Seven years, as required by the Dutch Tax Administration.
  • Client account and project data: For the duration of our agreement, then deleted 30 days after it ends unless a longer statutory retention applies (see Terms of Service, Chapter 21).
  • Contact-form messages: Kept while we handle your enquiry and for a reasonable follow-up period, then deleted.
  • Analytics records: Raw page-view records are deleted after 30 days; only anonymous daily totals are retained.

7. Your Rights

Under the GDPR you have the right to access, rectify, and erase your personal data; to restrict or object to processing; to data portability; and, where processing is based on consent, to withdraw that consent at any time without affecting processing already carried out. To exercise any of these, email info@lux-leet.com and we will respond within one month.

You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), if you believe we have not handled your data properly.

8. Security

We protect your data with encryption in transit (TLS) and encryption at rest, strict access controls on a need-to-know basis, isolated client environments, and regular security reviews.

9. Changes to This Policy

We may update this policy as our services or the law change. Material changes will be announced by email or through the client portal. The date at the top of this page always reflects the current version.