Privacy Policy
This policy describes how Original Real Estate sàrl-s ("ORE") collects, uses and protects personal data processed in the course of its business and in connection with the operation of the website www.originalrealestate.lu, in accordance with Regulation (EU) 2016/679 (the "GDPR") and the Luxembourg Act of 1 August 2018 on the protection of natural persons with regard to the processing of personal data.
1. Data Controller
Original Real Estate sàrl-s
21, rue Glesener, L-1631 Luxembourg
RCS Luxembourg B295371 — VAT LU36504354
Email: laurent.pedrini@originalrealestate.lu
2. Personal Data Contact Point
Any question, request or claim regarding the processing of your personal data must be sent
in writing, by postal letter to:
Mr Laurent Pedrini — Original Real Estate sàrl-s
21, rue Glesener, L-1631 Luxembourg
As a small business that does not carry out large-scale data processing activities within the meaning of Article 37 of the GDPR, ORE is not required to appoint a Data Protection Officer. A dedicated contact point is however made available to data subjects.
3. Data Collected and Purposes
| Category of data subject | Data processed | Purposes | Legal basis |
|---|---|---|---|
| Website visitors | IP address and server logs (security, technical logging). No non-strictly-necessary cookies. | Website operation and security | Legitimate interest (IT security) |
| Prospects and clients (owners, landlords, buyers, tenants) | First and last name, company, contact details, correspondence history, documents exchanged under the assignment | Management of assignments (letting, sale, opinion of property value, tenant representation, lease restructuring, lease assignment), advice, commercial follow-up | Performance of a contract / pre-contractual measures |
| Contacts via email | Name, email, phone, message | Response to enquiries | Consent / legitimate interest |
| AML / KYC obligations | Identity document, address, beneficial owners, source of funds | Compliance with anti-money-laundering obligations (Luxembourg Act of 12 November 2004, as amended) | Legal obligation |
| Suppliers and service providers | Professional contact details, billing data | Supplier relationship management, accounting | Performance of a contract / legal obligation |
4. Recipients of the Data
Your data is processed by ORE and may, where strictly necessary, be shared with:
- counterparties required for the performance of an assignment (owner or tenant, notary, property manager, expert, public authority);
- ORE's technical service providers acting as processors (hosting, email, productivity tools, accounting), subject to contractual commitments compliant with the GDPR;
- public authorities where required by law.
ORE does not sell or rent your personal data to third parties for marketing purposes.
4.1 List of Technical Sub-Processors
ORE relies on the following service providers, each bound by contractual commitments compliant with the GDPR (Data Processing Agreement):
| Sub-processor | Service | Country / Jurisdiction | Safeguards |
|---|---|---|---|
| EuroDNS S.A. | Hosting of the website www.originalrealestate.lu (Plesk Shared Hosting plan) and management of ORE domain names | Luxembourg (EU) | Luxembourg-owned company; datacenter located in Luxembourg; ISO 27001:2022 certified (cert. no. 202838/B/0013/UK/En, URS/UKAS) |
| Google Ireland Ltd | Google Workspace — professional Gmail, Google Drive, Google Calendar, as well as storage of ORE business backups encrypted end-to-end on the client side (AES-256-CBC, key under the exclusive control of ORE) | Ireland (EU) | Google DPA; certified under the EU-US Data Privacy Framework for any transfers to its US entities; for backups, client-side encryption renders the data unreadable by Google even upon judicial subpoena (key is never transmitted to the sub-processor) |
| Anthropic PBC | Claude — internal AI assistance for drafting, classification and generation of professional documents | United States | EU Standard Contractual Clauses (SCC); zero-retention policy (prompts not stored beyond the session); no training on submitted data |
5. Transfers Outside the European Union
Some tools used by ORE (in particular hosting and productivity services) may involve a transfer of data to countries outside the European Economic Area. Such transfers are framed by appropriate safeguards within the meaning of Articles 44 et seq. of the GDPR (adequacy decisions, standard contractual clauses, certifications).
By way of exception, data collected under AML/KYC obligations are subject to a stricter regime: they are stored exclusively on media located in the Grand Duchy of Luxembourg, without recourse to any extra-Luxembourg public cloud service and without any transfer outside the European Union, in accordance with ORE's internal anti-money-laundering procedure.
6. Retention Periods
- Prospects: 3 years from the last contact.
- Clients and assignment files: 10 years from the closing of the assignment, in line with statutory limitation periods and Luxembourg accounting obligations.
- AML/KYC data: minimum 5 years from the end of the business relationship or from the completion of the occasional transaction, in accordance with the Luxembourg Act of 12 November 2004, as amended.
- Invoices and accounting records: 10 years.
- Browsing logs (IP address, server logs): maximum 6 months.
- Data required for litigation: until the limitation period of the relevant legal action expires.
7. Your Rights
Pursuant to Articles 15 to 22 of the GDPR, you have the following rights:
- right of access to your data;
- right to rectification;
- right to erasure ("right to be forgotten");
- right to restriction of processing;
- right to object to processing based on legitimate interest;
- right to data portability;
- right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing prior to the withdrawal;
- right to give directions on the fate of your data after your death.
These rights may be exercised at any time by written request sent by postal letter to: Original Real Estate sàrl-s, for the attention of Mr Laurent Pedrini, 21, rue Glesener, L-1631 Luxembourg. ORE may request proof of identity.
If you consider that the processing of your data is not compliant with applicable regulations, you have the right to lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD) — 15, boulevard du Jazz, L-4370 Belvaux — cnpd.public.lu.
8. Security
ORE implements appropriate technical and organisational measures to ensure a level of security appropriate to the risks: access controls, passwords, encryption of communications, backups, and selection of compliant service providers.
9. Cookies
The Website does not use any cookie other than those strictly necessary for its operation. No audience measurement, advertising profiling or third-party tracking tool is deployed. No consent banner is therefore required under Article 5(3) of the ePrivacy Directive (transposed into Luxembourg law at Article 4 of the amended Law of 30 May 2005).
Should ORE later decide to set a non-strictly-necessary cookie (analytics, personalisation, etc.), a compliant consent banner will be implemented and this policy updated before any such cookie is set.
10. Links to Third-Party Websites
The Website may contain links to third-party websites whose privacy policies are beyond ORE's control. You are invited to consult the policies of those websites.
11. Changes to this Policy
ORE may amend this policy to reflect regulatory changes or changes in its practices. The date of the last update appears at the top of the document.