Privacy Policy

Last updated: 1 October 2026

We take the protection of your personal data seriously. In accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Luxembourg data protection law, this privacy policy explains which data we process when you visit our website www.fkieffer.com or contact us, for what purposes and on which legal bases, and what rights you have.

1. Data controller

François Kieffer sarl
32, rue d’Oetrange
L-5333 Moutfort
Luxembourg
Phone: +352 35 95 12-1
Email:
RCS Luxembourg: B 57218 · VAT no.: LU16921627

For any questions about data protection and to exercise your rights, please contact us at or at the postal address above.

2. Hosting and server log files

Our website is hosted by Host Europe GmbH (Cologne, Germany). Whenever the website is accessed, the web server processes technical data automatically sent by your browser: IP address, date and time of access, page requested, referrer URL, browser type and operating system. This data is needed to deliver the website and to ensure its stability and security.

The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR). A data processing agreement (Art. 28 GDPR) is in place with the hosting provider. Log data is stored for a limited period only and then deleted.

3. Website security

To protect our website against attacks, spam and misuse, we use the following security tools, which run on our own server:

• Wordfence (firewall and malware scanner): processes, among other things, IP addresses, requested URLs, browser identifiers and failed login attempts in order to detect and block attacks. To update its security rules and check against known malicious IP addresses, Wordfence exchanges data with its provider Defiant, Inc. (USA).
• Sucuri Security: file integrity monitoring and logging of login attempts (IP address, username, time).
• WP Activity Log: logging of logins and changes in the administration area (IP address, time, action).
• iQ Block Country: blocking of access from certain countries based on the IP address.

The legal basis is our legitimate interest in keeping our website secure and defending it against attacks (Art. 6(1)(f) GDPR). Security logs are kept for a maximum of six months, unless they are needed for longer to investigate a specific security incident.

4. Cookies and consent management

Cookies are small text files stored on your device. We use strictly necessary cookies that are required for the website to work, for example:

• pll_language – stores the language you selected (duration: 1 year);
• cmplz_* – store your cookie choice (duration: 1 year);
• cookies for information pop-ups, so that a notice you have closed does not appear again;
• login and security cookies, for logged-in administrators only.

The legal basis for strictly necessary cookies is Article 4(3)(e) of the Luxembourg Law of 30 May 2005 on the protection of privacy in the electronic communications sector, in conjunction with Art. 6(1)(f) GDPR. For all non-essential cookies and services, we ask for your consent (Art. 6(1)(a) GDPR).

To manage your consent, we use the Complianz plugin. It runs entirely on our own server; no data is sent to its developer or any other third party. Your choice is stored only in the cookies listed above, in your browser. Services that require consent (Google Maps and our Instagram feed) are only loaded after you agree; until then, you see a placeholder. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, we treat it as a refusal. You can withdraw or change your consent at any time using the “Manage consent” button at the edge of the screen or on our Cookie Policy page.

5. Contact forms and contact by email or phone

When you contact us using a contact form, by email or by phone, we process the data you provide (e.g. first name, last name, email address, phone number, project of interest and your message) in order to handle and answer your enquiry.

The legal basis is the performance of pre-contractual measures or of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Form data is sent to us by email via our own mail server. In addition, we store messages received through our forms in our website database using the Flamingo plugin, so that no enquiry is lost. We delete your enquiry once it has been fully dealt with, and at the latest three years after our last contact, unless a contractual relationship results from it. If a contract is concluded, we keep the documents in line with statutory retention obligations (in Luxembourg, generally 10 years for commercial and tax records).

6. Spam protection

To protect our forms against automated submissions (spam bots), we use the WP Armour plugin. It works with a form field that is invisible to humans (a “honeypot”) and is only filled in by bots. WP Armour runs exclusively on our server, sets no cookies and does not transmit any data to third parties. The legal basis is our legitimate interest in protecting our website against misuse (Art. 6(1)(f) GDPR).

7. Job applications

When you apply to us – via an application form, by email or in response to a job listing on our website – we process your application data (e.g. contact details, CV, certificates, cover letter) solely for the purpose of the recruitment process.

The legal basis is the preparation of an employment relationship (Art. 6(1)(b) GDPR). If you are not hired, we delete your application documents no later than six months after the end of the process, unless you have consented to us keeping them longer for future vacancies (Art. 6(1)(a) GDPR).

8. Embedded third-party services

On some pages we embed content from external providers. This content is only loaded after you have given your consent via the cookie banner (category “Marketing”). Only then is your IP address transmitted to the provider concerned. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Google Maps

To show our location, we embed maps from Google Maps (Google Ireland Limited, Dublin, Ireland). Google may process data (including your IP address), transfer it to Google LLC in the USA and set cookies. The map is only loaded after you have given your consent (Art. 6(1)(a) GDPR).

Instagram feed (LightWidget)

To display images from our Instagram profile, we use the LightWidget service (lightwidget.com). The images come from Instagram, a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. When the widget loads, your IP address and technical browser data are transmitted to LightWidget and Instagram; this may involve a transfer to the USA. The widget is only loaded after you have given your consent (Art. 6(1)(a) GDPR).

Fonts and icons: The fonts and icons used on our website are loaded locally from our own server; no connection is made to Google Fonts, Font Awesome or any other external provider.

9. Sending of emails

Emails sent by our website (e.g. form messages) are sent via our own mail server. They are not passed on to any external email delivery service.

10. Backups

To protect against data loss, we create daily backups of the website, including its database, using the UpdraftPlus plugin. These backups may contain personal data (e.g. stored form messages) and are transmitted in encrypted form to Dropbox (Dropbox International Unlimited Company, One Park Place, Hatch Street Upper, Dublin 2, Ireland) and stored there; this may involve a transfer to Dropbox, Inc. in the USA. We keep the last seven backups; older backups are deleted automatically. The legal basis is our legitimate interest in data security (Art. 6(1)(f) GDPR).

11. No analytics or advertising trackers

We do not use any analytics, tracking or advertising services (such as Google Analytics or the Facebook pixel) on this website and do not create user profiles.

12. Transfers to third countries

Some of the providers mentioned are based in the USA or transfer data there. Such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

13. Recipients of your data

Within our company, your data is only accessible to the people who need it to handle your request. The only external recipients are the service providers named in this policy and, where applicable, public authorities if we are legally required to disclose data. We do not sell your data.

14. Your rights

Under the GDPR you have the following rights:

• access to the data we hold about you (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• objection to processing based on our legitimate interest (Art. 21 GDPR);
• withdrawal of any consent given, at any time and with effect for the future (Art. 7(3) GDPR).

To exercise your rights, simply send a message to .

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg, cnpd.public.lu.

15. Provision of data and no automated decision-making

Providing your data is voluntary. However, without the information marked as required in the form, we cannot process your enquiry. No automated decision-making, including profiling (Art. 22 GDPR), takes place.

16. Changes to this privacy policy

We update this privacy policy when our website or the legal requirements change. The version published on this page applies.