Privacy Policy

1. Controller. Luxxow S.à r.l.-S, 12, rue Treeschheck, L-3321 Berchem, Luxembourg. Contact: germain@delagardelle.lu.

2. Two roles. For your account and this website, Luxxow is the controller. For the business data your company enters — your customers, their addresses, your invoices — your company is the controller and Luxxow is a processor acting on your instructions, under the Data Processing Agreement.

3. What we process, and why.

• Account data (name, email, password hash, language, two-factor settings) — to operate your access. Legal basis: contract.
• Company data (legal identity, VAT number, IBAN) — printed on your documents. Legal basis: contract.
• Business data your company enters — processed only to provide the service, as processor.
• Audit and security logs (sign-ins, key actions, IP addresses) — to protect accounts and provide a who-did-what trail. Legal basis: legitimate interest.

4. Where. Everything is hosted on servers in the European Union, each company in its own separate database. Nightly encrypted backups include your ledger and issued PDFs.

5. Subprocessors. We use a small, listed set of service providers: Hostinger (server infrastructure, EU), MXroute (transactional email delivery), Recommand (Peppol access point, Belgium — receives the content of documents you send or receive over Peppol), and, once paid plans start, Stripe (payments — your card never touches our servers). We tell account holders before adding or replacing a subprocessor.

6. Retention. Account data: while the account exists. Audit trail: 12 months. Backups: rolling ~30 days. After account termination: 30 days to export, then deletion (see the Terms). Invoices you issued to Luxxow itself are kept as long as Luxembourg accounting law requires.

7. Cookies. Only strictly necessary cookies: the session and the CSRF token. No analytics, no advertising, no tracking, no third-party cookies.

8. Security. TLS everywhere, per-company database isolation, encrypted secrets at rest, optional two-factor authentication, signed webhooks, and an append-only audit trail.

9. Your rights. Access, rectification, erasure, restriction, portability and objection — write to the address above and we answer within a month. You can also complain to the Luxembourg supervisory authority, the CNPD (cnpd.public.lu). For data your company entered about its own customers, address requests to that company — we assist it as processor.