GDPR · Luxembourg

Privacy notice

Last updated: 17 October 2026

• No cookies, no trackers, no advertising. The website measures nothing about you.
• We collect what you type into the demo form, and what you give the app when you sign up. Nothing else.
• We never sell or rent personal data, and we send no marketing e-mails without your agreement.
• Dragoman works at company level. People appear only with a professional role, and anyone can opt out (see below).

1. Who is responsible

The controller of your personal data is [Company name and legal form], [registered address, Luxembourg], registered with the Luxembourg Trade and Companies Register (RCS) under number [RCS B……] ("Dragoman", "we").

For any question about your data or to exercise your rights, write to [privacy e-mail, e.g. privacy@dragoman.lu]. We do not have to appoint a data protection officer, so this address reaches the person in charge directly.

2. When you visit the website

The website is a static page hosted by Netlify. To deliver it and protect it from abuse, Netlify's servers process technical data about each request: your IP address, the date and time, the page requested, the referring page and your browser type. We do not use these logs to identify you, and Netlify keeps them only for a limited time under its own retention rules.

Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).

Cookies and local storage. The website sets no cookies and loads no analytics, advertising or social-media tools. Our fonts are served from our own site, so your browser contacts no third party. If you choose French or English, that choice is saved in your browser's local storage (dg-lang) so the next page opens in the same language. It never leaves your device and is strictly necessary for a feature you asked for, so it needs no consent. Clearing your browser data removes it.

3. When you request a demo or contact us

Data	Name, work e-mail, company (optional), your profile, the offer you are interested in, your message (optional), the language of the page, and the date of the request.
Purpose	To answer your request, organise the demo and, if you wish, discuss an offer.
Legal basis	Steps taken at your request before a possible contract (Article 6(1)(b) GDPR). For the follow-up of a business conversation you started, our legitimate interest (Article 6(1)(f)).
Who sees it	Only the Dragoman administrator. The request is stored in our database (Supabase) and a copy is sent to us as an e-mail notification through Netlify Forms.
How long	24 months after the request, then deleted automatically. If you become a customer, the data moves into the customer relationship (section 4).

We will not add you to a newsletter or send you marketing e-mails unless you ask for it. You can object to any further contact at any time.

4. When you use the Dragoman app

Sign-in	Your e-mail address, to send you a sign-in link and recognise your account (Supabase Auth).
Your account	Access level, sign-up and last-visit dates, and what you tell the onboarding: your company, website, role, offer, the problems it solves, target customers and price range.
Usage events	Sign-ins, analyses run, onboarding steps and access requests, with their date. We use them to run the service, support you and improve it, never for advertising.
Your documents	Files you upload (decks, brochures) are stored privately. Only you can open them; the administrator sees their name and size, never their content.
LinkedIn connections	If you import your LinkedIn export, it is read in your browser. Only counts per company are kept (for example "3 connections at company X"). Names of your connections are not stored.
Legal basis	Performance of the service you signed up for (Article 6(1)(b) GDPR). Usage statistics: our legitimate interest in running and improving it (Article 6(1)(f)).
How long	As long as your account exists. When you ask us to close it, your account, onboarding answers, usage events and documents are deleted within 30 days, except what we must keep by law (for example invoices, 10 years).

5. If you appear in Dragoman: information for business contacts

This section gives the information required by Article 14 GDPR to people whose data we did not collect from them directly.

Dragoman describes companies active in Luxembourg so that businesses can find the right customers. It works at company level. For some companies it also holds professional data about decision-makers:

• What: name, professional role or title, the company, and where it is published, professional contact details. No private address, no private phone number, no sensitive data.
• Where from: public registers (such as the Luxembourg Trade and Companies Register for managers and directors), the press, published professional directories and company websites.
• Why: to help companies identify who decides on a purchase at another company, so that business contacts are relevant and limited to the right person.
• Legal basis: legitimate interest (Article 6(1)(f) GDPR), ours and our customers', in business-to-business prospecting. We limit it to professional data that is already public, and we keep an opt-out register.
• Who sees it: only customers with full access, and only after they record a lawful-basis reference for the company concerned. A customer who then contacts you is responsible for that contact and must tell you where your data comes from.
• How long: 3 years from collection or the last update, then removed.
• Your right to object: you can ask at any time, without giving a reason, to be removed. Write to [privacy e-mail]. We add you to our opt-out register: you are then excluded from Dragoman, from every export and from the press headlines it shows.

6. Service providers and transfers outside the EU

Netlify, Inc. (USA)	Website hosting and the demo-form e-mail notification.
Supabase, Inc. (USA)	Database, sign-in and private file storage for the app and demo requests. Data hosted in [Supabase region, e.g. EU (Frankfurt)].

They act as processors under a data processing agreement and process data only on our instructions. Where data can be accessed from outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or, for certified companies, the EU-US Data Privacy Framework.

7. Your rights

You can ask us to access your data, correct it, delete it, restrict its use or receive it in a portable format, and you can object to its use based on legitimate interest (Articles 15 to 21 GDPR). Where you gave consent, you can withdraw it at any time. Dragoman scores companies, not people, and takes no decision about you with legal or similarly significant effects (Article 22).

Write to [privacy e-mail]. We answer within one month. We may ask for information to confirm your identity.

If you think we have not respected your rights, you can lodge a complaint with the Luxembourg data protection authority: Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu.

8. Security

All traffic is encrypted (HTTPS). In the database, row-level security means each user reads only their own data, and only the administrator reads demo requests. Visitors to the website can send a request but cannot read any.

9. Changes

We will update this notice when our processing changes and show the date at the top. For a significant change that affects app users, we will tell them in the app.