Privacy Policy
1. Controller
The controller responsible for the processing of personal data described in this Privacy Policy is:
LUKSOM S.à r.l.
30, route de Luxembourg
L-7372 Lorentzweiler
Luxembourg
Telephone: +352 26 77 00 39
Email: info@luksom.com
Luxembourg Trade and Companies Register: RCS Luxembourg B300991
2. Scope of this Privacy Policy
This Privacy Policy applies to the processing of personal data in connection with:– visits to the LUKSOM website;– contact requests;– non-binding appointment requests;– the transmission of vehicle and modification information;– the upload of registration or technical documents;– communications relating to a requested appointment;– a subsequent service where the contract is concluded on site.This website is not used to conclude a contract or to make an online payment.Submitting an appointment request or receiving an appointment proposal does not create a contract. Unless expressly agreed otherwise in a separately signed written agreement, a contract is concluded only when the customer or an authorised representative appears at the agreed location and LUKSOM accepts the vehicle and the requested service.
3. Personal data we process
3.1 Website and technical data
When the website is accessed, the following technical information may be processed:– IP address;– date and time of access;– page or file requested;– referring page;– browser type and version;– operating system and device information;– language setting;– data volume transferred;– server response and error messages;– security-related events.
3.2 Contact and appointment-request data
When you contact LUKSOM or submit an appointment request, we may process:– first name and surname;– company name, business function and department;– postal address, where provided;– email address;– telephone number;– preferred language;– requested appointment date or period;– contents of your message;– previous and subsequent correspondence.
3.3 Vehicle and technical data
Depending on the request, we may process:– vehicle make, model and type;– registration number;– vehicle identification number, where contained in the information or documents provided;– vehicle registration information;– information about modifications or intended modifications;– technical specifications;– documents, certificates and supporting information provided by you;– information required to assess whether the requested service can be prepared or performed.Vehicle-related information may constitute personal data where it can be linked to an identified or identifiable person.
3.4 Uploaded documentsYou may be asked to upload vehicle registration documents or other technical documents required for the initial review of your request.Please provide only information that is relevant to the request. Do not upload sensitive personal information that LUKSOM has not specifically requested.
3.5 Contractual and service dataIf a contract is subsequently concluded on site, LUKSOM may additionally process:
– service-order and contract information;
– appointment and attendance information;
– technical observations and results;
– reports and related correspondence;
– invoice and payment information;
– information required to handle complaints, appeals or legal claims. No payment-card information is collected through this website.
4. Sources of personal data
We normally receive personal data directly from:
– the person submitting the request;
– the vehicle owner;– an authorised representative;
– an employee or contact person acting for a business customer;
– documents supplied for the requested service.Where you provide personal data relating to another person, you must be authorised to do so and must ensure that the person is appropriately informed about the processing.
5. Purposes and legal bases
5.1 Operation and security of the website
Purposes:– delivering the website;– maintaining technical stability;– preventing and detecting misuse;– protecting systems and information;– investigating technical errors or security incidents.Legal basis:Article 6(1)(f) GDPR.LUKSOM’s legitimate interest is the secure, stable and efficient operation of its website and information systems.
5.2 Responding to enquiries and arranging appointments
Purposes:– responding to your request;– assessing the requested service at a preliminary level;– reviewing the information and documents supplied;– proposing or coordinating an appointment;– communicating preparatory information.Legal bases:– Article 6(1)(b) GDPR where processing is necessary to take steps at your request before a possible contract;– Article 6(1)(f) GDPR where you act as an employee, representative or contact person for a business customer.LUKSOM’s legitimate interest is the proper administration of business communications and service requests.
5.3 Performance of an service
Where a contract is concluded on site, personal data may be processed in order to:– perform and document the requested service;– communicate with the customer;– prepare and issue agreed technical documents;– invoice and record the service;– comply with contractual obligations.Legal basis:Article 6(1)(b) GDPR.5.4 Compliance with legal obligationsLUKSOM may process and retain data where this is necessary to comply with legal, accounting, tax, regulatory or official requirements.Legal basis:Article 6(1)(c) GDPR.
5.5 Establishment, exercise or defence of legal claims
LUKSOM may retain and use relevant information to document transactions, handle disputes and establish, exercise or defend legal claims.Legal basis:Article 6(1)(f) GDPR.LUKSOM’s legitimate interest is the protection and enforcement of its legal rights and the proper defence against claims.
5.6 MarketingLUKSOM does not use information submitted through appointment or contact process for electronic direct marketing unless the recipient has separately and expressly consented or another specific legal basis applies.
6. Required information
Fields identified as mandatory are required to process the request or assess whether an appointment can be proposed.Without the required information, LUKSOM may be unable to evaluate the request, arrange an appointment or perform the requested service.The provision of optional information is voluntary.
7. Recipients
Personal data may be accessed or received by the following categories of recipients where necessary:– authorised LUKSOM employees and management;– the Odoo platform and hosting environment used for the website and appointment process;– IT, maintenance, security, email and backup service providers acting for LUKSOM;– external technical experts or service providers, where their involvement is necessary for the requested service;– accounting, insurance, legal or professional advisers;– public authorities, courts or other legally authorised recipients, where disclosure is required or permitted by law.Service providers acting as processors are contractually required to process personal data only on documented instructions and to apply appropriate safeguards.LUKSOM does not sell personal data.
8. International transfers
Some technical service providers or their approved sub-processors may process personal data outside the European Economic Area.Where such a transfer takes place, LUKSOM ensures that an appropriate transfer mechanism is in place, such as:– an adequacy decision of the European Commission;– European Commission Standard Contractual Clauses;– another legally recognised safeguard.Further information concerning an applicable transfer mechanism or a copy of the relevant safeguards may be requested using the contact details stated above.
9. Retention periods
LUKSOM retains personal data only for as long as necessary for the relevant purpose or as required by law.The following retention rules apply to the website process:– technical and security logs are normally retained for no longer than 90 days, unless a longer period is required to investigate a security incident or technical problem;– general enquiries and non-binding appointment requests that do not result in a contract, including associated uploaded documents, are normally deleted or anonymised 12 months after the last substantive communication;– where a contract is concluded, contractual and technical records are retained for the period required to perform and document the service and for any applicable statutory or contractual limitation period;– accounting documents and personal data contained in accounting records may be retained for 10 years from the end of the financial year to which they relate;– complaint, appeal and dispute files are retained until the matter has been concluded and for the period required for the establishment, exercise or defence of legal claims;– data contained in backups is deleted when the relevant backup is overwritten in accordance with the applicable backup cycle.Where more than one retention rule applies, the data is retained only for the purpose that continues to justify the storage.After expiry of the applicable period, personal data is deleted or irreversibly anonymised unless a further legal basis requires continued retention.
10. Cookies and local storage
The website is intended to use only technologies that are strictly necessary for the operation, security and requested functions of the website.No optional analytics, advertising or marketing technologies are intended to be active.Further information is available in the Cookie Policy.
11. Your rights
Subject to the conditions of the GDPR, you may have the right to:– obtain confirmation as to whether LUKSOM processes personal data concerning you;– request access to your personal data;– request correction of inaccurate or incomplete data;– request deletion of your personal data;– request restriction of processing;– object to processing based on legitimate interests;– receive data you provided in a structured, commonly used and machine-readable format where the right to data portability applies;– request transmission of such data to another controller where technically feasible;– withdraw consent at any time where processing is based on consent;– lodge a complaint with a data-protection supervisory authority.Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.Legal obligations and the rights of other persons may limit the exercise of individual rights in particular cases.
12. Right to object
Where LUKSOM processes personal data on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right to object on grounds relating to your particular situation.LUKSOM will stop the processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms or the processing is required for the establishment, exercise or defence of legal claims.You may object to processing for direct-marketing purposes at any time and without giving reasons.
13. Exercising your rights
Requests concerning your personal data may be sent to:LUKSOM S.à r.l.30, route de LuxembourgL-7372 LorentzweilerLuxembourgTelephone: +352 26 77 00 39
Email: info@luksom.com
LUKSOM may request information reasonably necessary to verify the identity of the person making the request.
14. Complaint to the supervisory authority
You have the right to lodge a complaint with:
Commission nationale pour la protection des données – CNPD
15, Boulevard du Jazz
L-4370 BelvauxLuxembourg
Telephone: +352 26 10 60-1
You may also contact another competent supervisory authority, particularly in the EU Member State of your habitual residence or place of work.
15. Automated decision-making
LUKSOM does not use solely automated decision-making, including profiling, that produces legal effects concerning website users or similarly significantly affects them.A preliminary technical assessment of an appointment request may involve professional judgement by LUKSOM personnel. It is not an exclusively automated decision.
16. Data security
LUKSOM applies appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.These measures may include access controls, role-based permissions, secure transmission, system monitoring, backups and internal confidentiality requirements. No internet-based transmission or information system can be guaranteed to be completely secure. Users should therefore submit only information necessary for their request.
17. ChildrenThe website and services are not directed at children.
LUKSOM does not knowingly request personal data directly from children through the website.
18. Changes to this Privacy Policy
LUKSOM may update this Privacy Policy where its processing activities, service providers, website functions or legal obligations change.Last updated:
20 August 2026 - Version 1.0