Data & security
Company details, processors, storage and retention as published in our policies. Plus a DPA template for your contract.
For your supplier file
Company
Lux Photo Pro S.à r.l.-S — a société à responsabilité limitée simplifiée incorporated in Luxembourg.
- Registered office: 13 Avenue Gaston Diderich, L-1420 Luxembourg
- Trade and Companies Register (RCS Luxembourg): B290472
- VAT identification number: LU36089387
- Business permit (autorisation d'établissement): 10172448/6
- Email: [email protected] · Phone: +352 691 773 777
- Publication director / Managing Director: Andrii Mitin
Where data lives and for how long
Quoted from our Privacy Policy. Full Privacy Policy →
4. How form data is handled
Data submitted through the quote / contact form is stored in our database (Supabase, EU / Frankfurt region) and pushed to our CRM (Bitrix24) so our team can respond, prepare a proposal and manage the engagement. Attribution parameters are forwarded with the enquiry.
5. Processors and recipients
We act as controller; the following processors act on our instructions under data-processing agreements, EU regions selected where available:
- Cloudflare — hosting, CDN and our content system (EU edge, Frankfurt)
- Supabase — database / storage (EU, Frankfurt)
- Bitrix24 — CRM (leads, deals)
- Google Workspace — email and file storage (Google Drive)
- Stripe — payments
- Resend — transactional email
- Mailchimp — marketing email (consent)
- Pixieset — client galleries for projects delivered before October 2026
- Cal.com — call booking
- Wazzup — WhatsApp messaging linked to our CRM
- n8n — workflow automation between the systems above
- Telegram — internal notifications to our team about new requests
- Google (Analytics / Ads) — analytics and advertising (advertising pixels load only after you accept; the Google tag also runs before that in restricted, cookieless mode — see section 7)
- Microsoft Clarity · Mouseflow — heatmaps and session replay, with form-field contents masked (loaded only after consent)
Some of our photographers, videographers and editors are contractors, including outside the EEA (e.g. United Kingdom, Switzerland, Ukraine), bound by confidentiality. Other recipients: accountants, legal advisers, tax authorities and, where relevant, a business successor.
6. International transfers
Where data is processed outside the EEA, transfers rely on an adequacy decision (e.g. UK, Switzerland) or EU Standard Contractual Clauses with supplementary measures.
8. Retention
| Data | Retention |
|---|---|
| Unanswered quote requests | 3 years from last contact |
| Active client data | Relationship + 3 years |
| Invoices / accounting | 10 years (Luxembourg law) |
| RAW photo files | ~2 months after delivery |
| Edited deliverables | At least 1 year |
| Portfolio / social images | Until consent is withdrawn |
| Newsletter subscribers | Until unsubscribe or 3 years inactivity |
| Analytics (GA4) | 14 months |
| Cookie-consent records | 12 months |
11. Security
We use HTTPS encryption, access controls on a need-to-know basis, contractor agreements, regular backups and periodic reviews. Breaches affecting your rights are notified to the CNPD within 72 hours and to affected individuals where required.
Confidentiality
We sign NDAs on request and work NDA-friendly by default; galleries are password-protected; behind-the-scenes capture happens only with your approval. Where people are photographed, the client is responsible for obtaining the necessary consents unless agreed otherwise.
Tenders and RFPs: [email protected], reply within one business day.