Privacy Policy
This policy describes how Original Real Estate sàrl-s ("ORE") collects, uses and protects personal data processed in the course of its business and in connection with the operation of the website www.originalrealestate.lu, in accordance with Regulation (EU) 2016/679 (the "GDPR") and the Luxembourg Act of 1 August 2018 on the protection of natural persons with regard to the processing of personal data.
1. Data Controller
Original Real Estate sàrl-s
21, rue Glesener, L-1631 Luxembourg
RCS Luxembourg B295371 — VAT LU36504354
Email: laurent.pedrini@originalrealestate.lu
2. Personal Data Contact Point
Any question, request or claim regarding the processing of your personal data must be sent
in writing, by postal letter to:
Mr Laurent Pedrini — Original Real Estate sàrl-s
21, rue Glesener, L-1631 Luxembourg
As a small business that does not carry out large-scale data processing activities within the meaning of Article 37 of the GDPR, ORE is not required to appoint a Data Protection Officer. A dedicated contact point is however made available to data subjects.
3. Data Collected and Purposes
| Category of data subject | Data processed | Purposes | Legal basis |
|---|---|---|---|
| Website visitors | IP address and server logs (security, technical logging). No non-strictly-necessary cookies. | Website operation and security | Legitimate interest (IT security) |
| Prospects and clients (owners, landlords, buyers, tenants) | First and last name, company, contact details, correspondence history (emails, SMS or iMessage), documents exchanged under the assignment | Management of assignments (letting, sale, opinion of property value, tenant representation, lease restructuring, lease assignment), advice, commercial follow-up | Performance of a contract / pre-contractual measures |
| Companies occupying office buildings targeted by a property search, and the people working there | Company name, activity, address, business phone number and website as published by the company (Google Maps listing); name and job title of a business contact where published (company website, professional directories); status and notes of exchanges | Identify office space available for sub-letting or about to become vacant, on behalf of a client looking for premises, and contact the company | Legitimate interest (finding premises for a client and developing ORE's business) |
| Contacts via email, SMS or iMessage | Name, email, phone number, message | Response to enquiries and follow-up of exchanges linked to a file | Consent / legitimate interest |
| AML / KYC obligations | Identity document, address, beneficial owners, source of funds | Compliance with anti-money-laundering obligations (Luxembourg Act of 12 November 2004, as amended) | Legal obligation |
| Suppliers and service providers | Professional contact details, billing data | Supplier relationship management, accounting | Performance of a contract / legal obligation |
For companies occupying an office area, the data is not collected from you but from publicly accessible sources: the company's Google Maps listing, Géoportail addresses, the company's website and professional directories. You may object at any time to being contacted by ORE for these purposes (see § 7).
4. Recipients of the Data
Your data is processed by ORE and may, where strictly necessary, be shared with:
- counterparties required for the performance of an assignment (owner or tenant, notary, property manager, expert, public authority);
- ORE's technical service providers acting as processors (hosting, email, productivity tools, accounting), subject to contractual commitments compliant with the GDPR;
- public authorities where required by law.
ORE does not sell or rent your personal data to third parties for marketing purposes.
4.1 List of Technical Sub-Processors
ORE relies on the following service providers, each bound by contractual commitments compliant with the GDPR (Data Processing Agreement):
| Sub-processor | Service | Country / Jurisdiction | Safeguards |
|---|---|---|---|
| EuroDNS S.A. | Hosting of the website www.originalrealestate.lu (Plesk Shared Hosting plan) and management of ORE domain names | Luxembourg (EU) | Luxembourg-owned company; datacenter located in Luxembourg; ISO 27001:2022 certified (cert. no. 202838/B/0013/UK/En, URS/UKAS) |
| Google Ireland Ltd | Google Workspace — professional Gmail, Google Drive, Google Calendar, as well as storage of ORE business backups encrypted end-to-end on the client side (AES-256-CBC, key under the exclusive control of ORE) | Ireland (EU) | Google DPA; region for data at rest set to “Europe” (Google setting, covering certain core Google Workspace services); certified under the EU-US Data Privacy Framework for any transfers to its US entities; for backups, client-side encryption renders the data unreadable by Google even upon judicial subpoena (key is never transmitted to the sub-processor) |
| Anthropic PBC | Claude — internal AI assistance for drafting, classification and generation of professional documents, for the analysis of professional correspondence (emails, SMS or iMessage) in order to link it to a file, for public-source research as part of AML/KYC checks, and for hosting private working pages (sector prospecting maps), readable by ORE only | United States | EU Standard Contractual Clauses (SCC); zero-retention policy (prompts not stored beyond the session); no training on submitted data |
5. Transfers Outside the European Union
Some tools used by ORE (in particular hosting and productivity services) may involve a transfer of data to countries outside the European Economic Area. Such transfers are framed by appropriate safeguards within the meaning of Articles 44 et seq. of the GDPR (adequacy decisions, standard contractual clauses, certifications).
Data collected under AML/KYC obligations are subject to enhanced protection measures: they are stored on an encrypted workstation, in a folder kept separate from commercial files, and their backups are encrypted before transfer and hosted by Google Workspace (see section 4.1). The service providers involved in their processing are those listed in section 4, under the conditions and with the safeguards described there, in accordance with ORE's internal anti-money-laundering procedure.
6. Retention Periods
- Prospects: 3 years from the last contact.
- Companies occupying an office area (prospecting): 12 months from the date the data was gathered if there has been no contact; 3 years from the last contact otherwise. Immediate erasure on objection.
- Clients and assignment files: 10 years from the closing of the assignment, in line with statutory limitation periods and Luxembourg accounting obligations.
- Message excerpts (SMS or iMessage) added to a file: the retention period of the file to which they are linked, as set out above. ORE does not copy the messages themselves, which remain in the Messages application of its device.
- AML/KYC data: minimum 5 years from the end of the business relationship or from the completion of the occasional transaction, in accordance with the Luxembourg Act of 12 November 2004, as amended.
- Invoices and accounting records: 10 years.
- Browsing logs (IP address, server logs): maximum 6 months.
- Data required for litigation: until the limitation period of the relevant legal action expires.
7. Your Rights
Pursuant to Articles 15 to 22 of the GDPR, you have the following rights:
- right of access to your data;
- right to rectification;
- right to erasure ("right to be forgotten");
- right to restriction of processing;
- right to object to processing based on legitimate interest;
- right to data portability;
- right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing prior to the withdrawal;
- right to give directions on the fate of your data after your death.
These rights may be exercised at any time by written request sent by postal letter to: Original Real Estate sàrl-s, for the attention of Mr Laurent Pedrini, 21, rue Glesener, L-1631 Luxembourg. ORE may request proof of identity.
Objection to prospecting. You may object at any time to being contacted for prospecting purposes, without any formality: by saying so during a call, or by a simple email to laurent.pedrini@originalrealestate.lu. Your request is taken into account without delay and your contact details are deleted from the prospecting database.
If you consider that the processing of your data is not compliant with applicable regulations, you have the right to lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD) — 15, boulevard du Jazz, L-4370 Belvaux — cnpd.public.lu.
8. Security
ORE implements appropriate technical and organisational measures to ensure a level of security appropriate to the risks: access controls, passwords, encryption of communications, backups, and selection of compliant service providers.
9. Cookies
The Website does not use any cookie other than those strictly necessary for its operation. No audience measurement, advertising profiling or third-party tracking tool is deployed. No consent banner is therefore required under Article 5(3) of the ePrivacy Directive (transposed into Luxembourg law at Article 4 of the amended Law of 30 May 2005).
Should ORE later decide to set a non-strictly-necessary cookie (analytics, personalisation, etc.), a compliant consent banner will be implemented and this policy updated before any such cookie is set.
10. Links to Third-Party Websites
The Website may contain links to third-party websites whose privacy policies are beyond ORE's control. You are invited to consult the policies of those websites.
11. Changes to this Policy
ORE may amend this policy to reflect regulatory changes or changes in its practices. The date of the last update appears at the top of the document.