Privacy Policy

Privacy notice

Last update: April 2026

This notice describes how the personal data of users visiting the Lextray website is processed. The notice is provided under EU Regulation 2016/679 (GDPR) and applicable Luxembourg data protection legislation.

1. Data controller

The data controllers are the two Lextray group companies listed below, each acting as an autonomous controller for the processing carried out under its remit:

• Lextray Legal S.àr.l., with registered office at 70 Grand-Rue, L-1660 Luxembourg — RCS Luxembourg no. B205082, enrolled with the Barreau du Luxembourg (Liste V);
• Lextray Corporate and Tax S.àr.l., with registered office at 85-87 Grand-Rue, L-1660 Luxembourg — RCS Luxembourg no. B161492.

For any request regarding the processing of personal data, to exercise the rights under arts. 15-22 GDPR or to contact the privacy officer, please write to .

2. Categories of data collected

This website collects the following categories of data:

• Navigation data: IP addresses, browser type, operating system, pages visited, access times (technical logs).
• Data voluntarily provided: name, surname, email address and message sent through the contact form.
• Technical cookies: used for the proper operation of the site (see Cookie Policy).

3. Purposes of processing

Data are processed for the following purposes:

• to reply to requests sent through the contact form;
• to ensure the security of the website and prevent abuse;
• to comply with legal and regulatory obligations;
• to improve the browsing experience of the site.

4. Legal basis

The legal bases of processing are: the data subject's consent (art. 6(1)(a) GDPR) for sending communications through the form; pre-contractual measures (art. 6(1)(b) GDPR); the legitimate interest of the controller in the security of the website (art. 6(1)(f) GDPR); and compliance with legal obligations (art. 6(1)(c) GDPR).

5. Processing and retention

Data are processed with electronic tools, with technical and organisational measures suitable to prevent unauthorised access, loss or destruction. Data collected through the contact form are retained for the time strictly necessary to provide a reply and, in any case, no longer than 24 months from receipt, unless longer retention periods are required by law. System logs are retained for a maximum of 12 months.

6. Communication and transfer of data

Data are not disclosed and may be communicated to third parties only where necessary to provide the requested service (e.g. hosting providers, email services) or to comply with legal obligations. These parties act as data processors under art. 28 GDPR. Data are not transferred outside the European Economic Area.

7. Data subject rights

Users may exercise at any time the rights set out in arts. 15-22 GDPR:

• right of access to their data;
• right to rectification of inaccurate data;
• right to erasure (right to be forgotten);
• right to restriction of processing;
• right to data portability;
• right to object to processing;
• right to withdraw consent at any time;
• right to lodge a complaint with the competent supervisory authority. For the processing activities carried out by Lextray, the competent authority is the Commission Nationale pour la Protection des Données (CNPD), 15 Boulevard du Jazz, L-4370 Belvaux, Grand Duchy of Luxembourg — www.cnpd.lu.

Requests may be sent to . Replies are provided without undue delay and in any event within one month.

8. Data security

The website uses the HTTPS protocol to encrypt communications and adopts organisational and technical security measures to protect data from unauthorised access, alteration, disclosure or destruction.

9. Changes to this notice

The controller reserves the right to amend, update or supplement this notice, also to reflect legislative changes. Any amendments will be published on this page and the last update date will be updated accordingly.