PRIVACY POLICY

Alzette sàrl, 3, Côte d’Eich, L-1450 Luxembourg, RCS Luxembourg B308795, is responsible for the processing described here: website visits, proposal requests, correspondence and calls. Contact: [email protected]; telephone: +352 27 63 68 68.

The Alzette One resident app has its own privacy policy: alzette.lu/en/alzette-one/privacy.

We process the contact details supplied, your role, building name and address, number of units, reported issues, proposed timing, questionnaire answers and correspondence to assess your request and prepare a proposal.

Required fields are identified in the form. Without them we cannot prepare the requested response. Additional details are optional. Do not send sensitive information or documents about other people unless necessary for your request.

For pre-contractual steps you request on your own behalf, the basis is Article 6(1)(b) GDPR. If you represent a co-ownership or another person, we rely on our legitimate interest in assessing the request and communicating with its representative (Article 6(1)(f)).

Emails about our method and news require a separate choice and your consent (Article 6(1)(a)). Submitting an enquiry does not subscribe you. If you select this option, an email lets you confirm your subscription. Withdraw consent through the unsubscribe link or at [email protected].

We use IP addresses, technical logs and delivery information to secure the site, prevent abuse and deliver requests, based on our legitimate interest in service security and reliability. Records subject to accounting or tax obligations are processed under the relevant legal obligation (Article 6(1)(c)).

With analytics consent, Google Analytics receives navigation events and browser identifiers to produce statistics. With marketing consent, Meta Pixel and server conversion events measure visits, interactions and requests arising from campaigns.

Conversion data may include the event and time, page, language, IP address, browser type, _fbp and _fbc identifiers and a hash of your email address for matching. Hashes and pseudonymous identifiers remain personal data. Free-text answers and building details are not included in the Meta conversion event.

Storage of campaign origins and advertising identifiers requires marketing consent. Refuse these uses or change your choice through “Manage my cookies” without preventing us from handling your enquiry. The cookie policy describes the technologies. Advertising matching may associate visits with a Meta profile. The form makes no automated decision accepting a mandate or producing legal effects concerning you.

Campaign parameters without consent: when you submit a request through the questionnaire, the campaign parameters in the page address (utm_source, utm_medium, utm_campaign, utm_term, utm_content, campaign, ad set and ad IDs, placement and source) accompany the request even without cookie consent, so that we know which campaign produced it. They are neither stored on your device nor sent to Meta, and they include neither the ad click ID nor the referring page. Legal basis: our legitimate interest in measuring where incoming requests come from (Article 6(1)(f) GDPR).

Optional ad-measurement checkbox: the request form offers a separate checkbox, unticked by default and shown when you have not accepted marketing, to report the submission of your request to Meta so that we can measure our ads. If you tick it, our server sends a single “Lead” event with a hash of your email, the IP address, browser, page and language and, where available, the ad click ID in the page address (fbclid, sent as _fbc) and existing _fbc and _fbp identifiers. Legal basis: your consent (Article 6(1)(a) GDPR). Without this checkbox or marketing consent, nothing is sent to Meta apart from the form-start event described below. You can withdraw this consent at [email protected]; withdrawal applies to the future; an event already sent is not recalled from Meta.

Form start: when you begin filling in the proposal form on a landing page of our ads, our server sends Meta a “proposal_start” event, even without marketing consent and even if you have refused cookies. It contains the time, the page (without address parameters), the language, the IP address, the browser and, where present in the page address, the ad click ID (fbclid, sent as _fbc); with your marketing consent, existing _fbp and _fbc identifiers are added. It contains neither your name, your email nor your answers, it is neither kept by us nor linked to your request, and it sets no cookie. Purpose: measuring and optimising our ads. Legal basis: our legitimate interest (Article 6(1)(f) GDPR); you can object at any time at [email protected]. An event already sent is not recalled from Meta.

Aggregate counters: on the request pages and our campaign landing pages we count, without cookies, without storage on your device and without identifiers, page views, display of the cookie banner, the type of choice made or the absence of a choice, clicks on landing-page buttons, and forms started, steps completed, errors and submissions. Each counter may specify the page, language, page variant, step, button position, the ad angle derived from the utm_content parameter (reduced to a known value), the cookie choice at the time of submission and whether the ad-measurement checkbox was ticked. Only daily totals are kept; no time of day, IP address, cookie or individual data is recorded in these counters. Legal basis: our legitimate interest in checking that the form, banner and campaign pages work (Article 6(1)(f) GDPR).

A call may be handled by an AI voice assistant. Processing may include your number, voice, request, a transcript, a summary, technical metadata and follow-up actions. Voice processing during the call, storage of a transcript or summary, and any storage of an audio file are distinct operations.

For the real-time calls described here, audio is transmitted during the call to enable the exchange; call logs may store a transcript, summary and metadata, without providing for storage of an audio file. Processing and follow-up of the request rely, depending on the context, on requested pre-contractual steps or our legitimate interest in handling and securing the communication. If a separate audio recording is enabled, its purpose and legal basis are explained at the start of the call.

If you do not wish to continue an exchange that is transcribed or recorded, you may use another channel by writing to [email protected] or using the website form. This notice is not consent to recording and does not replace the information given before it.

Authorised Alzette personnel access information relevant to their work. Hetzner Online GmbH hosts our infrastructure. Our email service providers receive enquiries and deliver correspondence, confirmations and optional emails. Twilio provides telephony and audio transport; depending on the line, OpenAI Realtime or xAI Realtime provides the voice assistant, and OpenAI may also process the transcription. ElevenLabs may provide the assistant configuration or synchronise voice-conversation data when it is used.

Google Ireland Limited (Google Analytics) and Meta Platforms Ireland Limited (Pixel and conversions) participate in the purposes subject to your choices above. Their role depends on the operation: collection and transmission of Meta data may involve joint controllership; the provider’s subsequent own processing is governed by its policy.

A WhatsApp link takes you to a service of WhatsApp Ireland Limited. Information you send there is also subject to its privacy terms. Legally entitled recipients, advisers or authorities receive information only where the matter or applicable law justifies it.

International communication, AI and measurement services may involve recipients or access outside the European Economic Area, including the United States. European hosting does not mean that all provider access and processing remain in the EEA.

Transfers may rely on an adequacy decision or standard contractual clauses where that mechanism applies to the recipient and processing concerned. Ask [email protected] for the recipients concerned and a copy of the safeguards applicable to your matter. Transfer safeguards do not replace consent required for tracking.

Commercial enquiries and correspondence data are retained for as long as necessary to review the enquiry, respond and manage the relationship. They are then erased or anonymised unless an active request, mandate, legal obligation or identified evidential need justifies continued retention. A website visit alone does not extend this retention.

Call transcripts and summaries are retained for as long as necessary to handle the request, follow up actions and maintain security, then erased or anonymised when that purpose ends. Longer retention is limited to material needed for an active matter, a legal obligation or establishing, exercising or defending a right, with restricted access. If a separate audio file is enabled, its retention follows the purpose and information given before recording.

Optional-email data are used until consent is withdrawn or their purpose ends. Minimal consent or objection evidence may be kept separately to demonstrate and respect your choice and prevent inappropriate re-enrolment. Logs, delivery copies and backups are governed by their security or recovery need; retaining them does not justify using the data for a new purpose.

If a representative or another contact supplies your data, we use the contact details, role and case information needed to handle the matter. Unless a legal exception applies, we inform you of the source and processing within the Article 14 GDPR deadline, no later than the first contact or intended disclosure.

Subject to the GDPR conditions, you may request access, correction, erasure, restriction and portability, or object to legitimate-interest processing. You may object to direct marketing at any time. Withdrawal of consent does not affect the lawfulness of earlier processing.

Send requests to [email protected]. We normally respond within one month and explain any necessary statutory extension. You may complain to the CNPD (https://cnpd.public.lu) or another competent authority and use the judicial remedies provided by the GDPR. This notice imposes no exclusive court jurisdiction.

We apply access controls, communication security and case-protection measures appropriate to the risks. Personal-data breaches are assessed under Articles 33 and 34 GDPR: authority notification unless a risk is unlikely, and communication to affected people where there is a high risk, subject to statutory exceptions.

The date above identifies this version. Material changes are communicated by an appropriate means and fresh consent is requested where necessary. A new version does not retrospectively make earlier processing lawful.