Privacy
Privacy policy
What happens to your data, who receives it, how long it stays — and how you get rid of it.
Controller
The controller for the processing of personal data on this site is:
DAUMEDIA S.A.R.L.- S
13, rue de la Fontaine
L-3768 Tétange
Luxemburg
Michael Ferreira Rodrigues
For any question about data protection and to exercise any right below: support@daumedia.lu
What is processed
Each processing on its own, with its purpose, legal basis, categories of data and retention period.
Serving the website
When you open a page, the server that runs daumedia.lu processes your IP address, the time, the address requested and your browser identification. That is what serving the page requires, and access logs arise in the process.
- Legal basis
- Art. 6(1)(f) GDPR — legitimate interest in technical operation
- Retention
- 7 days
Newsletter
If you sign up, your email address is stored together with the time.
- Legal basis
- Art. 6(1)(a) GDPR — your consent
- Retention
- until withdrawal, at most 24 months without a mailing
To unsubscribe, send an email to the address above. There is no link for it and no screen — your address is removed by hand.
Enquiries by email
Whatever you send to the contact address sits in a mailbox and is read and answered there. That includes your name, your address and everything else you write yourself.
- Legal basis
- Art. 6(1)(b) and (f) GDPR — steps prior to a contract, otherwise legitimate interest in replying
- Retention
- 24 months after the last contact, unless it becomes an engagement
Error tracking
When the application hits an error, a report goes to Sentry (Functional Software, Inc., San Francisco, USA). The report is built from an allow-list and masked beforehand; visitors' personal data is by design not sent along.
Reports go to Sentry's DE region; the contract does not guarantee that storage stays in the EU.
- Legal basis
- Art. 6(1)(f) GDPR — legitimate interest in a working service
- Retention
- 30 days at Sentry
Client quotations
The homepage carries quotations from clients, with name and role. They are there because that person agreed to it.
- Legal basis
- Art. 6(1)(a) GDPR — consent
- Retention
- until withdrawal
A withdrawal goes to the address above; the quotation then leaves the page.
Viewing and accepting a quote
If you receive a quote, you open it through an address carrying a token. When you accept it, that is recorded as evidence: your name, the time, your IP address, your browser identification and a checksum of the document you were shown.
- Legal basis
- Art. 6(1)(b) GDPR — contract
- Retention
- name, time and checksum 10 years; IP address and browser identification 12 months
Client and invoice data
Issuing an invoice processes name, address, VAT number where applicable and the individual line items, and archives them as a record.
- Legal basis
- Art. 6(1)(b) and (c) GDPR — contract and legal obligation
- Retention
- 10 years
Checking a VAT number
If a VAT number is given, it is checked against the European Commission's VIES service. The number itself leaves the house for that, nothing else.
- Legal basis
- Art. 6(1)(c) GDPR — legal obligation
- Retention
- the answer is kept as a record for 10 years
Payment
A payment through the payment provider Mollie (Mollie B.V., Amsterdam) runs through them; the payment details are collected there and not here.
Not active yet — there is no account with this provider.
- Legal basis
- Art. 6(1)(b) GDPR — contract
- Retention
- 10 years for the references that appear on an invoice
Back-office audit log
Every writing action in the billing area is recorded: who, when, what stood there before and what after. It exists so that movements on records can be traced.
- Legal basis
- Art. 6(1)(c) and (f) GDPR — traceability of records
- Retention
- 10 years
Administration accounts
The operator signs in with an email address and a password, optionally with a second factor. Stored are the address, the name and the moment the account was created.
- Legal basis
- Art. 6(1)(b) and (f) GDPR — running the application
- Retention
- for as long as the account exists
How we measure the use of this site
We measure with Umami, software we run ourselves on our own server in Germany. The data never leaves that server and is passed to nobody.
What is recorded: the path of the page without its query parameters, the domain of the link you arrived from, country, region and city, browser and device type, the language — and two events: a click on a contact route and a click on a portfolio filter.
To connect calls that belong together, Umami forms a session id as a hash of the website id, the host name, your IP address and your browser identification, with a salt that changes every month. We name it here openly, because it is formed from your IP address and your browser identification.
What is not recorded: no cookies, no stored IP address, no account, no form contents — and, because the query is cut off, no search term either.
The figures are kept indefinitely. The reason is the long view: a development over years cannot be read in twelve months.
If your browser sends „Do Not Track“ or „Global Privacy Control“, nothing at all is measured — without you having to do anything.
You can object to being measured in this browser:
Not available in this browser — storage is blocked.
The switch applies to this browser and all its tabs. If you clear your browser data, measurement starts again.
- Legal basis
- Art. 6(1)(f) GDPR — legitimate interest in knowing which pages are read
- Retention
- indefinite, with the reasoning given in the section itself
Who receives your data
Beyond the parties below, nobody receives anything. Data is not sold.
| Recipient | What for | Seat | Third country |
|---|---|---|---|
| Hostinger International Ltd. | Running the application, the database and the worker; plus the server the usage measurement runs on | Larnaca, Cyprus (EU) · servers in Germany | yes — via sub-processors, safeguarded by standard contractual clauses |
| Proton AG | Mailbox for the contact address | Plan-les-Ouates, Switzerland | yes — Switzerland, covered by an adequacy decision of the EU Commission |
| Functional Software, Inc. (Sentry) | Error reports | San Francisco, USA | yes — USA, covered by the EU-U.S. Data Privacy Framework (an adequacy decision of the EU Commission); the standard contractual clauses in the contract take effect only if that decision falls away |
| Mollie B.V. | Payments | Amsterdam, Netherlands (EU) | no |
| European Commission (VIES) | Checking VAT numbers | Brussels, Belgium (EU) | no |
How long things stay
Every period in one place, so it can be counted.
| What | How long |
|---|---|
| Serving the website (access log) | 7 days |
| Newsletter address | until withdrawal, at most 24 months without a mailing |
| Email enquiry without an engagement | 24 months after the last contact |
| Error reports | 30 days at Sentry |
| Acceptance evidence: name, time, document hash | 10 years |
| Acceptance evidence: IP address and browser identification | 12 months, then cleared |
| Invoices, client and payment data | 10 years |
| Back-office audit log | 10 years |
| Generated tax reports | 10 years |
| Payment-provider receipt rows and delivered webhooks | 10 years |
| Administration accounts | for as long as the account exists |
| Usage data | indefinite, with the reasoning given in the section itself |
Invoices and everything written on them are subject to a statutory ten-year retention obligation.
Your rights
In respect of your personal data you have these rights:
- Access — you may ask what is stored
- Rectification of inaccurate particulars
- Erasure
- Restriction of processing
- Data portability
- Objection to a processing based on a legitimate interest
- Withdrawal of a consent, with effect for the future
All of these are exercised through a single address: support@daumedia.lu. An answer comes within one month.
There is no screen through which you can do this yourself — no client account and no newsletter management. The single way is that address, and it is read.
You may also lodge a complaint with the supervisory authority: Commission nationale pour la protection des données, 15, Boulevard du Jazz · L-4370 Belvaux · Luxembourg.
When erasure is not possible
If invoices about you exist, the ten-year retention obligation takes precedence over the right to erasure (Art. 17(3)(b) GDPR). Affected by that are the record itself, the client snapshot on it and the archived PDF.
Those data are then restricted in processing (Art. 18 GDPR) — they stay unchanged and are used only to meet the retention obligation.
Everything outside the records is genuinely deleted: the account, the newsletter address, the quotation.
Last updated: 2026-09-18