Privacy Policy

I. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation and other data protection provisions is:

Löffler S.A.
50, rue Gabriel Lippmann
L-6947 Niederanven
Luxembourg

Telephone: (+352) 310 555 – 1
Email: info@loeffler.lu
Website: www.loeffler.lu

II. General information on data processing

1. Scope of the processing of personal data

As a rule, we process our users’ personal data only insofar as this is necessary to provide a functioning website and our content and services. Our users’ personal data is generally processed only with the user’s consent. An exception applies where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

2. Legal basis for the processing of personal data

Where we obtain the data subject’s consent for the processing of personal data, Article 6(1)(a) of the General Data Protection Regulation (GDPR) serves as the legal basis.

Where personal data is processed in order to perform a contract to which the data subject is party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary in order to take steps prior to entering into a contract.

Where processing personal data is necessary to comply with a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis.

Where processing personal data is necessary in order to protect the vital interests of the data subject or another natural person, Article 6(1)(d) GDPR serves as the legal basis.

Where processing is necessary for the purposes of a legitimate interest pursued by our company or a third party and this interest is not overridden by the interests, fundamental rights and freedoms of the data subject, Article 6(1)(f) GDPR serves as the legal basis.

3. Erasure of data and storage period

The data subject’s personal data will be erased or blocked as soon as the purpose for which it was stored no longer applies. Data may be stored beyond this point where European or national legislation provides for this in Union regulations, laws or other provisions to which the controller is subject.

Data will also be blocked or erased when a storage period prescribed by the above provisions expires, unless further storage is required to enter into or perform a contract or to establish, exercise or defend legal claims.

III. Provision of the website and creation of log files

1. Description and scope of data processing

Whenever our website is accessed, the web server system automatically collects data and information from the computer system of the device accessing the website.

The following data may be collected:

• information about the browser type and version used
• the user’s operating system
• the user’s internet service provider
• the user’s IP address
• date and time of access
• websites from which the user’s system reaches our website
• websites accessed by the user’s system through our website
• name and URL of the file accessed
• notification as to whether access was successful

This data may be stored in the server log files. It is not combined with other personal data relating to the user.

2. Legal basis for data processing

Article 6(1)(f) GDPR is the legal basis for the temporary storage of data and log files.

3. Purpose of data processing

The system needs to store the IP address temporarily in order to deliver the website to the user’s device. The user’s IP address must therefore remain stored for the duration of the session.

Data is stored in log files to ensure the website functions correctly. The data also helps us optimise the website and ensure the security of our information technology systems.

These purposes constitute our legitimate interest in data processing under Article 6(1)(f) GDPR.

4. Storage period

The data is erased as soon as it is no longer required for the purpose for which it was collected. Where data is collected to provide the website, this is generally the case when the respective session ends.

Where data is stored in log files, it is erased as soon as it is no longer needed to ensure the operation and security of the website. Data may be stored for longer where this is necessary to investigate or defend against a specific security incident.

5. Right to object and options for removal

The collection of data to provide the website and the storage of necessary data in log files are essential for the operation of the website. Users therefore have no right to object.

IV. Use of cookies

1. Description and scope of data processing

Our website may use technically necessary cookies. Cookies are small text files stored in or by the internet browser on the user’s device.

Technically necessary cookies ensure the website’s basic functions, security and correct display. Data collected by technically necessary cookies is not used to create user profiles or analyse browsing behaviour.

External content such as Google Maps is loaded only after the user has consented to the associated data processing, unless it is provided merely through an external link.

2. Legal basis for data processing

Article 6(1)(f) GDPR is the legal basis for processing personal data using technically necessary cookies.

Where cookies or similar technologies are used only after consent has been obtained, Article 6(1)(a) GDPR is the legal basis. Consent may be withdrawn at any time with effect for the future.

3. Purpose of data processing

Technically necessary cookies are used to ensure the website’s basic functions, security and usability.

These purposes also constitute our legitimate interest in processing personal data under Article 6(1)(f) GDPR.

4. Storage period, right to object and options for removal

Cookies are stored on the user’s device. Users can disable or restrict the transmission of cookies by changing their browser settings. Cookies already stored may be deleted at any time, including automatically.

If technically necessary cookies are disabled, some website functions may no longer be fully available.

Consent already granted for external content can be withdrawn or amended at any time through the consent management settings used on the website.

V. Contact form and email contact

1. Description and scope of data processing

Our website contains a contact form that can be used to contact us electronically. If a user uses this option, the data entered in the form is transmitted to and stored by us.

Depending on the fields available in the contact form, the following data in particular may be processed:

• name
• email address
• telephone number
• subject
• message
• any other information provided voluntarily

The following data may also be processed when the message is sent:

• the user’s IP address
• date and time of transmission

Reference is made to this privacy policy during the submission process.

Alternatively, users may contact us using the email address or telephone number provided. In this case, personal data sent with the message or communicated during the conversation will be processed.

As a rule, data is not disclosed to third parties unless this is necessary to process the enquiry, required by law or authorised by the data subject.

2. Legal basis for data processing

Where consent has been obtained, Article 6(1)(a) GDPR is the legal basis for processing the data.

Article 6(1)(f) GDPR is the legal basis for processing data transmitted when contacting us by email, telephone or contact form.

Where the purpose of the contact is to enter into or perform a contract, Article 6(1)(b) GDPR provides an additional legal basis for processing.

3. Purpose of data processing

Personal data is processed solely to handle the contact and the associated matter.

Additional personal data processed during submission is used to prevent misuse of the contact form and ensure the security of our information technology systems.

4. Storage period

The data is erased as soon as it is no longer required for the purpose for which it was collected.

For personal data from the contact form and data transmitted by email or telephone, this is generally the case once the respective conversation has ended and the underlying matter has been conclusively resolved.

This does not affect statutory retention obligations or storage required to establish, exercise or defend legal claims.

5. Right to object and options for removal

Users may withdraw consent to the processing of personal data at any time with effect for the future.

Where processing is based on Article 6(1)(f) GDPR, users may object to processing on grounds relating to their particular situation.

Consent may be withdrawn or an objection submitted by sending a message to info@loeffler.lu.

If the matter cannot or may not be processed further without the data concerned, communication will be discontinued. Statutory retention obligations remain unaffected.

VI. Disclosure of personal data to third parties

Google Maps

1. Description and scope of data processing

The Google Maps service may be embedded on our website. The provider for users in the European Economic Area is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Maps displays geographical information and makes it easier to locate our company.

When Google Maps is loaded, a connection is established to Google’s servers. In particular, the user’s IP address, technical information about the device and browser used, the date and time of access and information on the use of the map function may be transmitted to Google.

Google Maps Platform logs requests and may process information including the IP address of the requesting device.

If the user is signed in to a Google account, Google may associate the use of the map service with that user account. We have no control over Google’s further processing of the data.

The transfer of data to companies or servers within the Google Group outside the European Economic Area, particularly in the United States, cannot be ruled out.

2. Legal basis for data processing

Google Maps is loaded only with the user’s prior consent. Article 6(1)(a) GDPR is the legal basis for processing personal data.

Consent can be withdrawn at any time with effect for the future through the consent management settings used on the website.

3. Purpose of data processing

Google Maps is used to present geographical information clearly and help users locate our company.

4. Storage period

We have no control over how long Google stores the data it processes. Google provides information on storage periods and the erasure of personal data in its privacy information.

5. Further information

Further information on Google’s processing of personal data is available at:

Google Privacy Policy
Additional Terms of Service for Google Maps and Google Earth

VII. Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR. You have the following rights in relation to the controller:

1. Right of access

You may ask the controller to confirm whether personal data concerning you is being processed.

Where such processing takes place, you may request information on:

• the purposes for which the personal data is processed
• the categories of personal data processed
• the recipients or categories of recipients to whom personal data concerning you has been or will be disclosed
• the envisaged storage period or, where specific information is not possible, the criteria used to determine that period
• the existence of a right to rectification or erasure of personal data concerning you
• the existence of a right to restriction of processing or a right to object
• the right to lodge a complaint with a supervisory authority
• all available information on the source of the data where the personal data was not collected from you
• the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR

You have the right to request information as to whether personal data concerning you is transferred to a third country or international organisation. In this context, you may request information about the appropriate safeguards pursuant to Article 46 GDPR.

2. Right to rectification

You have the right to obtain rectification and completion from the controller where personal data concerning you is inaccurate or incomplete.

3. Right to restriction of processing

Under the conditions laid down by law, you may request restriction of the processing of personal data concerning you.

Where processing has been restricted, such data may, with the exception of storage, generally be processed only with your consent, for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person or for reasons of important public interest.

4. Right to erasure

You may request that the controller erase personal data concerning you without undue delay where the legal requirements of Article 17 GDPR are met.

The right to erasure does not apply in particular where processing is necessary:

• for exercising the right of freedom of expression and information
• for compliance with a legal obligation
• for reasons of public interest in the area of public health
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
• for the establishment, exercise or defence of legal claims

5. Right to notification

If you have exercised your right to rectification, erasure or restriction of processing, the controller must communicate this rectification, erasure or restriction to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort.

You have the right to be informed by the controller about those recipients.

6. Right to data portability

You have the right to receive personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format.

You also have the right to transmit this data to another controller without hindrance from the current controller where the legal requirements of Article 20 GDPR are met.

7. Right to object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you based on Article 6(1)(e) or (f) GDPR.

The controller will then cease processing personal data concerning you unless it demonstrates compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time.

8. Right to withdraw consent under data protection law

You have the right to withdraw your consent under data protection law at any time with effect for the future.

Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.

No such automated decision-making takes place on our website.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of personal data concerning you infringes the GDPR.

The data protection supervisory authority responsible for us is:

Commission nationale pour la protection des données
15, boulevard du Jazz
L-4370 Belvaux
Luxembourg

Telephone: (+352) 26 10 60 – 1
Website: cnpd.public.lu

Privacy policy last updated: 24 July 2026