Privacy Policy

LME Luxembourg Media Engineering S.à r.l.-S (“LME”, “we”, “us”, “our”) is committed to protecting your privacy and to processing your personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”), the Luxembourg Act of 1 August 2018 on the organisation of the National Commission for Data Protection and the general data protection framework, and the amended Luxembourg Act of 30 May 2005 on the protection of privacy in the electronic communications sector (transposing the ePrivacy Directive).

This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have. All data is processed on servers located within the European Union (primarily on Hetzner servers in Germany, with additional backups stored on our own server in Luxembourg).

LME has not appointed a Data Protection Officer. Following an internal assessment, our processing activities do not meet the criteria of Article 37 GDPR: we are not a public authority, our core activities do not consist of large-scale regular and systematic monitoring of data subjects, and we do not engage in large-scale processing of special categories of personal data. For any data protection enquiry or to exercise your rights, please contact us at contact@lme.lu.

We collect the following categories of personal data, depending on how you interact with our services:

•       Email correspondence — your email address, name, and the content of your message when you write to us, so that we can answer your request and follow up on it.

•       Client data — if you become a client: your name, company, contact details, and billing details, needed to conclude and perform our contract and to invoice our services.

•       Project information — details you share with us in the course of a project (business requirements, content, materials, etc.).

•       IP address — for security, fraud prevention, and server diagnostics.

•       Browser and device information (user agent) — for technical compatibility and troubleshooting.

•       Server logs — timestamps, requested URLs, response codes, and IP addresses.

•       Cookie data — essential cookies are set automatically; non-essential (analytics) cookies are only set with your consent (see Section 7).

•       Consent records — confirmation of any consent you give, with a timestamp, to demonstrate compliance with Article 7 GDPR.

In the course of delivering our services, we may receive personal data about you from a source other than yourself — typically from one of our clients who provides us with information about their staff, customers, contacts, or end users in connection with a project we are delivering for them (for example, content to be published on a website, contact lists to be imported into a system, or test data).

In this situation, our client, as the data controller, is responsible for informing you about the processing of your data (Articles 13 and 14 GDPR). For transparency, we summarise below how we handle such data:

•       Source of the data: our client (the data controller), who is responsible for ensuring they have a valid legal basis to share your data with us.

•       Categories of data: typically limited to names, professional contact details, and any project-related information our client provides.

•       Purpose: processing is strictly limited to delivering the contracted service to our client.

•       Our role: in this context, we act as a processor on behalf of our client (the controller), under a written Data Processing Agreement in accordance with Article 28 GDPR.

•       Retention: we retain the data only for as long as necessary to deliver the project, plus any additional period agreed with the client or required by law, after which the data is returned to the client or securely deleted.

•       Onward transfers: we do not use this data for our own purposes, and we do not share it with anyone other than as instructed by our client.

If you wish to exercise your GDPR rights in respect of data that one of our clients has shared with us about you, please contact the relevant client directly, as they are the data controller. We will support the client in responding to your request as required by Article 28 GDPR. If you cannot identify or reach the client, you may contact us at contact@lme.lu and we will assist where we are legally permitted to do so.

Providing personal data is not required to visit our website. If you become a client, your contact and billing details are necessary for the conclusion and performance of our contract (Article 13(2)(e) GDPR); if you choose not to provide them, we will be unable to deliver our services or invoice you. Other data is either provided at your discretion (such as the content of your emails or project information) or collected automatically as a technical necessity for using our website (such as your IP address, browser information, and server logs). In each case, the data is used only for the purposes described in this policy.

We process your personal data on one or more of the following legal grounds:

This is the primary basis for processing data relating to our clients. Processing is necessary to:

•       Deliver our web design, development, and related services

•       Provide technical support and service-related communications

•       Process payments where applicable

•       Respond to enquiries and requests for quotes sent to us by email (steps taken at your request prior to entering into a contract)

For activities that go beyond strict contract performance, we rely on our legitimate interests, including:

•       Securing our platform against fraud, abuse, and unauthorised access

•       Maintaining server logs for technical, diagnostic, and security purposes

•       Improving the quality, reliability, and performance of our services

•       Keeping email enquiries after we have answered them, so that we can continue the conversation if you come back to us, keep a record of what was requested or offered in case of a later dispute, and detect spam or abusive messages

Where we rely on legitimate interest, we have conducted a balancing test:

•       Purpose: to operate our services securely, prevent fraud, and improve our offering.

•       Necessity: processing is limited to what is strictly necessary; we collect minimal data and do not repurpose it.

•       Balancing: the impact on your privacy is minimal — no sensitive data, no profiling, no automated decision-making with legal effects. You may object at any time under Article 21 GDPR.

•       Safeguards: data is stored securely within the EU, access is restricted to authorised personnel, and retention is limited (see Section 5).

We rely on consent only for processing that is genuinely optional, namely:

•       Setting non-essential (analytics) cookies, requested through our cookie banner

•       Any future direct marketing communications (none are currently sent)

You may withdraw consent at any time, as easily as it was given. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, nor does it affect processing based on other legal grounds (e.g. processing necessary to deliver services you have contracted for).

We process your data where we are legally required to do so — for example, to retain accounting and invoicing records under Luxembourg commercial and tax law, or to respond to lawful requests from competent authorities.

Your data is used exclusively for the following purposes:

•       Managing our relationship with our clients

•       Delivering and maintaining our web design and development services

•       Sending service-related communications (e.g. project updates, security notices, invoices)

•       Security monitoring and fraud prevention

•       Improving the quality and performance of our services

•       Answering enquiries you send us by email

•       Complying with our legal and regulatory obligations

We do NOT:

•       Sell your data to any third party

•       Use your data for advertising or marketing to third parties

•       Share your data with any third party, except as described in Section 8

•       Transfer your data outside the European Economic Area (see Section 15)

Primary data is stored on servers operated by Hetzner Online GmbH in Germany (EU). Backups are stored on Hetzner servers in Germany (EU) and on a server owned and operated by LME itself, located at our own premises in Luxembourg (EU). All data remains within the European Union.

•       Encrypted database and transport connections (SSL)

•       Encryption at rest for stored data

•       Strict access controls, authentication, and the principle of least privilege

•       Regular security updates and vulnerability monitoring

•       Rate limiting and fraud prevention mechanisms

•       Protection against SQL injection

•       Protection against cross-site scripting (XSS)

•       Regular backups, stored exclusively within the EU

We retain personal data only for as long as necessary for the purposes for which it was collected, in accordance with the principle of storage limitation (Art. 5(1)(e) GDPR):

•       Client data: retained for the duration of our business relationship, plus up to 12 months after it ends by default. This period may be extended where Section 12 applies — for example, where retention is necessary for the establishment, exercise, or defence of legal claims, or where we are required to retain the data to comply with a legal obligation.

•       Server logs (including IP addresses): retained for a maximum of 12 months for security and diagnostic purposes.

•       Email enquiries: retained for up to 24 months from the date of last correspondence, unless a contract is concluded — in which case the data is retained as client data.

•       Accounting and invoicing records: retained for 10 years as required by Luxembourg commercial and tax law.

•       Consent records: retained for as long as the consent is active, plus 3 years after withdrawal, to demonstrate compliance with Article 7 GDPR.

When you request deletion, when the applicable retention period expires, or when the data is no longer necessary, we delete it from our active databases without undue delay. Copies held in backups are removed as part of our regular backup rotation within 30 days. Where we are legally required to keep certain data (for example invoices and accounting records, see the retention periods above) or where it is needed for the establishment, exercise, or defence of legal claims (see Section 12), we keep only that specific data, restrict access to it, and delete it once the obligation or need ends, in accordance with Article 17(3) GDPR. If this applies to your deletion request, we will tell you which data we must keep and why. Aggregated, fully anonymised statistics that cannot be linked back to you may be retained indefinitely.

Under the GDPR, you have the following rights with respect to your personal data:

You may request confirmation of whether we process your data and obtain a copy of it, together with information about the processing.

You may request the correction of inaccurate or incomplete personal data.

You may request the deletion of your personal data where one of the grounds set out in Article 17 applies.

You may request that we limit the processing of your data, for example while the accuracy of data is being verified or while an objection is being assessed.

You may request your personal data in a structured, commonly used, and machine-readable format (e.g. JSON or CSV), or have it transmitted directly to another controller where technically feasible.

You may object at any time to processing based on our legitimate interest. Where you object, we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Where processing is based on consent, you may withdraw it at any time, as easily as it was given. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. As stated in Section 11, we do not engage in such automated decision-making.

You have the right to lodge a complaint with the Luxembourg supervisory authority (CNPD) or with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement (see Section 14).

To exercise any of these rights, contact us at contact@lme.lu. We will respond within one month of receiving your request, as required by Article 12(3) GDPR. This period may be extended by up to two further months for complex or numerous requests, in which case we will inform you within the first month. There is no charge for exercising your rights, unless requests are manifestly unfounded or excessive (Art. 12(5) GDPR).

To protect your data, we may need to verify your identity before processing your request.

In accordance with Article 4(3)(e) of the amended Luxembourg Act of 30 May 2005 (which transposes the ePrivacy Directive 2002/58/EC) and the CNPD’s Guidelines on cookies and other tracking devices (October 2021), we distinguish between essential and non-essential cookies.

Essential cookies are strictly necessary for our website to function — for example, remembering your cookie preferences, security tokens, or load balancing. These cookies do not require your consent and cannot be disabled without affecting site functionality.

We use first-party analytics cookies on lme.lu to understand how visitors interact with our content. These cookies are processed on our own server infrastructure and are not shared with any third party.

Non-essential cookies are only set after you provide explicit, informed, freely given, and unambiguous consent through our cookie banner, in accordance with Article 4(3)(e) of the amended Act of 30 May 2005. Refusing non-essential cookies will not affect your ability to use our services.

•       Consent is requested via a cookie banner displayed on your first visit

•       You may accept all, reject all, or customise your preferences

•       You may withdraw or modify your consent at any time via the “Cookie preferences” link in the website footer

•       Consent is valid for a maximum of 12 months, after which we will request your consent again, in line with CNPD guidelines

•       We keep a time-stamped record of consent to demonstrate compliance with Article 7 GDPR

We do not use third-party advertising networks, retargeting pixels, social media plugins that set trackers, or any cross-site tracking technologies. A complete list of cookies used — with names, purposes, and durations — is available in the cookie banner and on our dedicated Cookie Policy page.

To deliver our services, we engage the following processor under a written Data Processing Agreement (DPA) in accordance with Article 28 GDPR:

Hetzner is bound by contractual obligations of confidentiality, security, and GDPR compliance. Hetzner does not access your personal data except as strictly necessary to provide hosting and infrastructure services.

In addition to Hetzner, we store backups on a server that LME owns and operates itself, located at our own premises in Luxembourg. This server is under our exclusive physical and technical control; no external party has access to it, and it is protected by the same security measures described in Section 5.

Your personal data stays with us. Apart from Hetzner as our hosting provider, no external company receives or has access to your data. In particular:

•       No selling or renting — we never sell, rent, or trade your personal data.

•       No external tools — we do not use third-party analytics services, advertising networks, social media plugins, external CRM or marketing platforms, or external payment processors.

•       No tracking by others — no third party places cookies or trackers through our websites (see Section 7).

•       Internal access only — within LME, access is limited to the personnel who need it to deliver our services, and only to the extent necessary.

The only exception is where we are required by law to disclose data to a competent public authority, as described in Section 12.

If we engage additional processors in the future (for example for payment processing or new application integrations), we will:

•       Update this privacy policy with full details of each new processor

•       Only engage processors that provide sufficient guarantees of GDPR compliance, under a written DPA

•       Announce the change on our website and inform our current clients in advance, where reasonably possible at least 30 days before the change

•       Ensure all processors are bound by confidentiality and security obligations

In the event of a personal data breach:

•       Notification to the supervisory authority (Art. 33 GDPR): where the breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the CNPD within 72 hours of becoming aware of the breach, via databreach@cnpd.lu.

•       Notification to affected individuals (Art. 34 GDPR): where the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in clear and plain language, describing the nature of the breach, its likely consequences, and the measures we have taken or propose to take.

•       Internal record: we maintain an internal log of all personal data breaches, regardless of severity, in accordance with Article 33(5) GDPR.

Our services are not directed at or intended for children under the age of 16. In Luxembourg, the digital age of consent is 16 years (the default age under Article 8 GDPR, which Luxembourg has not lowered). We do not knowingly collect personal data from children under this age. If you believe we have inadvertently collected data from a minor, please contact us at contact@lme.lu and we will delete it promptly.

We do not engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR. No decisions about you are made solely on the basis of automated processing.

We may retain and process your personal data in connection with the establishment, exercise, or defence of legal claims, on the basis of our legitimate interest under Article 6(1)(f) GDPR. Where this applies, we retain the relevant data for the duration of any applicable limitation period under Luxembourg law.

We may also disclose your personal data to competent public authorities — including courts, the Luxembourg State Prosecutor (procureur d’État), tax authorities, and law enforcement — where we are required to do so under a legal obligation (Article 6(1)(c) GDPR) or where disclosure is necessary to comply with a binding court order, subpoena, or other lawful request. We will only disclose data to the extent strictly necessary and, where legally permitted, will inform you of any such request.

You are not required to provide personal data specifically for the purposes described in this section.

We may update this privacy policy from time to time to reflect changes in our services, our processing activities, or our legal obligations. The current version is always available at https://lme.lu/privacy-policy with a revised “Last updated” date.

For material changes that affect how we process your data — such as the engagement of new processors, changes in legal basis, or new processing purposes — we will announce them on our website and inform our current clients in advance, where reasonably possible at least 30 days before the change, and, where required, request fresh consent before the change takes effect.

If you believe we are not handling your data in accordance with the GDPR, you have the right to lodge a complaint with the Luxembourg data protection authority:

If you reside in another EU Member State, you may also lodge a complaint with the supervisory authority of your country of residence, your place of work, or the place of the alleged infringement.

Your personal data does not leave the European Economic Area (EEA). Primary processing and storage take place on Hetzner infrastructure in Germany (EU); backups are stored on Hetzner infrastructure in Germany (EU) and on our own server in Luxembourg (EU).

We do not currently use any sub-processor or service that would involve a transfer of personal data outside the EEA. If this changes, we will:

•       Only use services with appropriate safeguards under Chapter V of the GDPR (Standard Contractual Clauses, adequacy decisions, or equivalent protections)

•       Update this policy and notify you in advance

•       Give you the opportunity to request deletion before any transfer occurs