Privacy policy
Data collected, purposes, retention periods, recipients and your rights: how R-Lab SARL processes your personal data.
Contents
1. Who is the controller
The controller of the data collected through this website is:
- R-Lab SARL, 38 Parc d'activités de Capellen, L-8308 Capellen, Grand Duchy of Luxembourg
- Luxembourg Trade and Companies Register: B310542
- Contact for any question relating to personal data: pmroche@rcarre.com
The address above is the single point of contact for any request relating to your personal data.
2. What this policy covers
This policy describes the processing of personal data that R-Lab SARL collects as a controller: browsing this website, the contact form, commercial exchanges, the client relationship and prospecting within a business context.
It does not cover data that R-Lab SARL processes on behalf of its clients in operating the Angèle platform. In that case the client is the controller and R-Lab SARL acts as a processor: the terms are then set out in a data processing agreement compliant with Article 28 of the GDPR. See section 11.
3. Data collected
3.1 Data you provide
When you use the contact form or write to us, we collect: the subject of your request, your first and last name, your company, your role, your professional e-mail address, your telephone number if you provide it, your sector if you provide it, and the content of your message.
Telephone and sector are optional. The other fields are necessary to handle your request.
3.2 Data collected automatically
The server hosting this website records, in its technical logs, the connecting IP address, the date and time of the request, the page requested, the response code and the information sent by your browser. These logs are used solely to ensure the operation, security and diagnosis of the website.
3.3 What we do not collect
This website contains no analytics tool, no advertising pixel, no embedded social media button and no third-party tracker. We carry out no profiling and no automated decision-making producing legal effects concerning you. We collect no special categories of data within the meaning of Article 9 of the GDPR.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to your contact, demonstration or information request | Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) |
| Managing the commercial relationship and following up exchanges | Legitimate interest of R-Lab SARL in developing and monitoring its business (Art. 6(1)(f) GDPR) |
| Performing a contract concluded with you or your organisation | Performance of a contract (Art. 6(1)(b) GDPR) |
| Sending you information about our services, events or publications | Legitimate interest in a business context, or consent where required (Art. 6(1)(f) or 6(1)(a) GDPR) |
| Ensuring the security, availability and technical diagnosis of the website | Legitimate interest in protecting our systems (Art. 6(1)(f) GDPR) |
| Complying with our legal, accounting and tax obligations | Legal obligation (Art. 6(1)(c) GDPR) |
Where processing is based on our legitimate interest, you have a right to object, which you may exercise at any time under the conditions described in section 9.
5. Retention periods
- Contact request with no follow-up: retained for three years from the last exchange, then deleted.
- Prospect in ongoing discussion: retained for three years from your last contact.
- Client: for the duration of the contractual relationship, then for the period necessary to comply with our legal obligations and to defend our rights.
- Accounting records and supporting documents: ten years, in accordance with Luxembourg commercial law.
- Server technical logs: twelve months at most.
6. Recipients
Your data is accessible only to those people at R-Lab SARL whose duties justify it, limited to what is necessary to handle your request.
It may be shared with processors acting on our instructions and bound by contractual confidentiality and security obligations: website host, e-mail provider, customer relationship management tool. It may also be passed to a partner of the Angèle ecosystem where objectively necessary to handle your request — for example a question relating to infrastructure or cybersecurity. In that case only the necessary information is shared, and you are informed.
We do not sell, rent or exchange your data with any third party for commercial purposes.
Finally, your data may be disclosed to an administrative or judicial authority where the law requires it.
7. Transfers outside the European Union
We favour providers established in the European Union and processing carried out within the European Economic Area.
Where a transfer outside the European Economic Area is nevertheless necessary, it takes place only under an appropriate legal framework within the meaning of Chapter V of the GDPR: an adequacy decision of the European Commission, standard contractual clauses, or any other recognised mechanism, accompanied where necessary by supplementary measures. You may obtain details of the applicable safeguards by writing to pmroche@rcarre.com.
8. Security
R-Lab SARL implements appropriate technical and organisational measures to protect your data against unauthorised destruction, loss, alteration, disclosure or access: encryption of communications, access control on a least-privilege basis, strong authentication of sensitive accounts, access logging, backups and staff awareness.
As no system is infallible, we cannot guarantee absolute security. In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you in accordance with Articles 33 and 34 of the GDPR.
9. Your rights
Under the GDPR you have the following rights over your data:
- Access: obtain confirmation that your data is processed and receive a copy.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: request deletion of your data, in the cases provided by the regulation.
- Restriction: request that processing be temporarily frozen.
- Objection: object to processing based on our legitimate interest, and at any time to prospecting.
- Portability: receive the data you provided in a structured, commonly used format.
- Withdrawal of consent: where processing is based on your consent, withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise these rights, write to pmroche@rcarre.com. We may ask for proof of identity in the event of reasonable doubt. We respond within one month of receiving your request, extendable by two months for complex requests, in which case you are informed.
If you consider your rights are not being respected, you may lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15 boulevard du Jazz, L-4370 Belvaux, Grand Duchy of Luxembourg, or with the supervisory authority of your place of residence.
10. Cookies and local storage
This website uses no analytics, advertising, personalisation or behavioural tracking cookies. No consent is therefore required on that basis.
A single item is stored locally in your browser: your display preference between the light and dark theme. This information is strictly technical, stays on your device, is never sent to a server and can be erased at any time by clearing your browser's site data.
11. Data processed within the Angèle platform
When a client organisation uses the Angèle platform, the data it connects and the content processed are its own responsibility: it is the controller. R-Lab SARL and its partners act as processors, on the client's instructions.
In that context, a data processing agreement compliant with Article 28 of the GDPR sets out in particular: the subject matter and duration of the processing, the categories of data and data subjects, the security measures, the location of processing, any use of sub-processors, the assistance provided to the client in responding to rights requests, incident notification arrangements, and the fate of the data at the end of the contract.
If you are a user of an Angèle platform deployed by your employer or by an organisation whose client you are, requests to exercise your rights must be addressed to that organisation, which is responsible for them. We assist it in handling such requests.
12. Changes
This policy may be updated to reflect legal, technical or organisational developments. The date of the last update appears at the top of the page. In the event of a substantial change affecting your rights, we will inform you by an appropriate means.
13. Contact
For any question relating to this policy or to the processing of your data: pmroche@rcarre.com, or by post to R-Lab SARL, 38 Parc d'activités de Capellen, L-8308 Capellen, Grand Duchy of Luxembourg.