This policy explains how FERMÉ-LUX Sàrl collects and uses your personal data when you visit the website www.fermelux.lu or contact us through it. It has been drawn up in accordance with the General Data Protection Regulation (GDPR — EU 2016/679) and the Luxembourg law of 1 August 2018 on the organisation of the Commission nationale pour la protection des données.
1. Controller
FERMÉ-LUX Sàrl
Zone Industrielle Rolach, Hall 1
L-5280 Sandweiler — Luxembourg
RCS Luxembourg B134632
Telephone: +352 35 53 78
Emergency repair mobile, 7 days a week: +352 691 545 407
E-mail: info@fermelux.lu
For any questions about your personal data, write to info@fermelux.lu or to the postal address above.
2. Data collected and purposes
2.1 Browsing the website
On each visit, our hosting provider Vercel automatically records certain technical data in its technical logs: IP address, date and time of connection, pages viewed, referring page, browser type and version, operating system. This data is used to ensure the proper functioning and security of the website and to diagnose errors.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
2.2 Quote and project requests
The forms on our product pages (garage doors, gates, doors, windows, shutters and blinds), on the “Request a quote” page and the website’s request assistant allow you to send us a request. Through the forms, we collect your first name, last name, telephone number, email address and the address of the job (all required), whether you are a private or business customer, the product concerned and your answers to the form’s questions (type of project, dimensions, etc.), your message (optional) and, where applicable, the photos you attach (5 maximum), as well as the page and language from which the request was sent. Through the assistant, we collect the same contact details (first name, last name, telephone, email and address of the job, all required), your answers and the text of the conversation. This data is used exclusively to assess your request, to get back to you and to prepare a quote or arrange an appointment.
Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
2.3 Repair, emergency and maintenance requests
The forms on the “Repair” and “Request a call-out” pages collect the same information as above (first name, last name, telephone, email and address of the job, all required; private or business customer, product, type of fault, urgency, brand, message and any photos), and the request assistant the same information as for a project, in order to organise the call-out.
Legal basis: pre-contractual steps or performance of the contract (Art. 6(1)(b) GDPR).
2.4 Contact by telephone and email
When you call us or write to us directly at info@fermelux.lu, we keep your contact details and your message in order to process and respond to your request.
Legal basis: legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR) or pre-contractual steps (Art. 6(1)(b) GDPR).
2.5 Job applications
Applications reach us by email, in response to a vacancy on the “Jobs” page or as a speculative application. We use your contact details and the documents you send (CV, cover letter, etc.) solely to assess your application.
Legal basis: pre-contractual steps (Art. 6(1)(b) GDPR).
2.6 Customers
If you become a customer, your data is used to fulfil the order, carry out the installation or repair visit, provide after-sales service and comply with our accounting and tax obligations.
Legal basis: performance of the contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c) GDPR).
2.7 Audience measurement and advertising
Only if you accept it in the cookie banner, we measure website traffic with Google Analytics and how well our ads perform with Google Ads, Meta (Facebook, Instagram), Pinterest, Microsoft Advertising (Bing) and TikTok. The following is then processed: cookie identifiers, pages viewed, device and browser type, an approximate location derived from the IP address, the identifier of the ad you clicked and whether you sent a request.
With the same consent, when you send a request, your email, phone number, first and last name, town and country are shared with these platforms in encrypted (hashed) form to link the request to the ad, and the source of your visit (ad or campaign) is recorded with your request. These platforms also use the data for their own purposes, under their own responsibility; for the collection and transmission from our website, we may be joint controllers with them (Art. 26 GDPR). Details are given in our Cookie policy.
Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the “Manage cookies” link at the bottom of every page.
We do not sell or rent your data to third parties, and we do not make any decisions based solely on automated processing.
3. Cookies and trackers
The website uses cookies necessary for it to work (storing your cookie choice) and, only with the consent you give in the consent banner, audience measurement cookies (Google Analytics) and advertising cookies (Google Ads, Meta, Pinterest, Microsoft Advertising, TikTok). Refusing has no effect on your use of the website. Fonts are hosted on the website itself.
- Request assistant: the current conversation is kept in your browser’s session storage during your visit, so that you find it again from page to page. It is cleared when you close the tab.
- Google Maps map: on the Contact and request pages, the map only loads if you click “Show the map”. Google may then set its own cookies.
For more information, including the list of cookies and how to manage your choices, see our Cookie policy.
4. Data recipients
Your data is intended for the staff of Fermé-Lux Sàrl, to the extent necessary for their duties. It may also be passed on to the following service providers, who act on our behalf and are contractually bound to protect it (Art. 28 GDPR):
- our hosting provider: Vercel Inc. (United States);
- Sanity AS (Oslo, Norway), which stores the website content and the requests received, including photos;
- Resend, Inc. (United States), for sending the emails notifying us of your requests;
- Leadgen.lu, the agency responsible for the design and technical maintenance of the website;
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), for Google Maps, only if you display the map;
- komoot GmbH (Potsdam, Germany), which operates the Photon address suggestion service, based on OpenStreetMap data: when you type the address of the job in a form or in the assistant, the characters you type are sent to it, together with your IP address as with any request on the Internet, so that addresses can be suggested to you;
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), for Google Tag Manager, Google Analytics and Google Ads, only with your consent;
- Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland), for measuring Facebook and Instagram ads, only with your consent;
- Pinterest Europe Limited (Palmerston House, Fenian Street, Dublin 2, Ireland), for measuring Pinterest ads, only with your consent;
- Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland), for measuring Microsoft Advertising (Bing) ads, only with your consent;
- TikTok Technology Limited (10 Earlsfort Terrace, Dublin 2, Ireland), for measuring TikTok ads, only with your consent;
- where applicable, our partner manufacturers, only when necessary to process an order or a warranty claim.
5. Transfers outside the European Union
Hosting the website with Vercel and sending emails with Resend involve a transfer of data to the United States, as does Google Maps if you display the map. If you accept audience measurement or advertising cookies, Google, Meta, Pinterest, Microsoft and TikTok may also transfer data to the United States or to other countries where companies of their group are located. These transfers are governed by the European Commission’s standard contractual clauses and, where the company is certified, by the EU-U.S. Data Privacy Framework. Sanity stores data in Norway, within the European Economic Area.
6. Retention periods
- Unsuccessful quote and contact requests: 3 years from the last exchange.
- Customer data: for the duration of the business relationship, then 10 years for accounting records, in accordance with the Luxembourg Commercial Code.
- Unsuccessful applications: 2 months after notification of the rejection, unless you agree to us keeping your file longer (2 years maximum) for future opportunities.
- Technical server logs: 12 months maximum.
- Cookie choice: 6 months.
- Audience measurement statistics (Google Analytics): 14 months; the durations of audience measurement and advertising cookies are given in the Cookie policy (13 months at most).
7. Your rights
In accordance with the GDPR, you have the following rights over your data:
- right of access and to obtain a copy;
- right to rectification;
- right to erasure (“right to be forgotten”);
- right to restriction of processing;
- right to data portability;
- right to object, in particular to any direct marketing;
- right to withdraw your consent at any time, without affecting processing already carried out.
To exercise these rights, write to info@fermelux.lu or by post to the address given in section 1. We will respond within one month. Proof of identity may be requested if there is reasonable doubt about your identity.
If you believe your rights are not being respected, you may lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15, boulevard du Jazz, L-4370 Belvaux — www.cnpd.lu.
8. Security
The website is served entirely over HTTPS: data exchanged between your browser and our servers is encrypted. Forms include a hidden field that filters out automated submissions by bots, and access to the website administration is restricted and secured. We apply appropriate technical and organisational measures (Art. 32 GDPR) and update them in line with the state of the art. As no transmission over the Internet is completely secure, we recommend that you do not send sensitive information by unencrypted email.
9. Changes
We may update this policy to reflect changes to the website or to regulations. The date of the last update appears at the top of this page.
