Privacy policy.

JD Capa (jdcapa.lu) processes your data when you request quotes, subscribe to our newsletter, or use the online project assistant. This policy explains what we collect, why, and your rights in Luxembourg and the EU.

1. Who is the Data Controller?

Data controller: JD Capa — info@jdcapa.lu — 7 rue d'Esch, L-4440 Soleuvre, Luxembourg. Tel. +352 26 53 43.

2. What Data We Collect, Why, and on What Lawful Basis

We collect: identity (name, email, phone), project description, optional file attachments, browsing data and cookie consent.

3. Cookies and Similar Technologies

We use cookies and similar technologies as follows: — Strictly necessary: security, load balancing, session continuity, storing your cookie choices. These do not require consent. — Analytics / measurement: only after you accept via our cookie banner or preference centre. — Marketing tags (if configured for the site): only after consent. You can accept, refuse or customise non-essential cookies at any time via the cookie controls on the Website. Withdrawing consent does not affect the lawfulness of processing before withdrawal. Cookie preference records may be stored locally (for example in your browser) and/or logged as needed to demonstrate consent.

4. Recipients and Processors

We do not sell your personal data. We share data only with trusted providers acting as processors under Art. 28 GDPR (or as independent controllers where the law so requires), including where used for this Website: — Cloudflare — hosting, CDN, DNS, Worker edge runtime, D1 database and R2 object storage for optional uploads. — Email delivery providers (for example Resend) — transactional messages (confirmations, follow-ups). — Google services — Workspace / email / calendar for enquiry handling; Google Analytics / Tag Manager only with consent. — AI model providers (for example Google Gemini) — to generate assistant replies and internal project summaries from the content you submit. — Messaging providers used by our operations team (where configured) — to alert staff about new leads. Staff and authorised contractors of JD Capa / JD Capa may access data on a need-to-know basis under confidentiality duties. Each processor is bound by instructions, confidentiality and security obligations. A current list of main processors can be requested at info@jdcapa.lu.

5. International Transfers

Primary hosting and databases are operated with Cloudflare infrastructure with processing oriented to the EEA where available. Some providers (analytics, email, AI, productivity tools) may process data in the United States or other third countries. Where a transfer outside the EEA/UK occurs, we rely on appropriate safeguards such as: — European Commission adequacy decisions (including the EU–US Data Privacy Framework where the recipient is certified); — Standard Contractual Clauses (SCCs); and — supplementary technical and organisational measures where required. You may request information about the safeguards applicable to a specific transfer by contacting info@jdcapa.lu.

6. Retention

We keep personal data only as long as necessary for the purposes stated, then delete or anonymise it, unless a longer period is required by law: — Active enquiries / leads: for the commercial relationship and typically up to 5 years afterwards for evidence, accounting and legal claims (subject to local limitation rules). — Booking and session tokens: for the lifetime of the booking flow / session, then deleted or rotated. — Uploaded files: while the enquiry is active and for the same commercial retention window unless you ask us to delete them earlier and no legal hold applies. — Newsletter: until you unsubscribe or we close the list. — Security / server logs: ordinarily up to 12 months, longer if needed for an incident investigation. — Cookie consent evidence: for the period needed to demonstrate compliance. Exact periods may vary slightly by market accounting rules; contact info@jdcapa.lu for details about your case.

7. Security Measures

We implement appropriate technical and organisational measures (Art. 32 GDPR), including access controls, encrypted transport (HTTPS/TLS), least-privilege staff access, monitoring of abnormal traffic, and contractual security obligations for processors. No method of transmission or storage is perfectly secure. If we become aware of a personal data breach likely to result in a risk to your rights, we will notify the competent supervisory authority and, where legally required, affected individuals.

8. Your Rights

You have rights of access, rectification, erasure, restriction, objection and portability. Contact: info@jdcapa.lu. You may lodge a complaint with the CNPD (Luxembourg).

9. Complaints to a Supervisory Authority

If you believe our processing infringes the GDPR, you may lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. In Luxembourg, the supervisory authority is the Commission nationale pour la protection des données (CNPD): https://cnpd.public.lu/. EU authority directory: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

10. Updates

The current version of this Privacy Policy is always published on this page (date: 2026-10-29 18:15:42). We may update it when our processing or legal requirements change. Material changes will be highlighted on the Website and, where appropriate, communicated by email.