Privacy & Data Protection Policy

External privacy notice and internal data-handling principles

1. Who is responsible for your data?

LëtzMove is operated by Veronica Floridi as an independent trader in Luxembourg. For processing where LëtzMove determines the purposes and means, LëtzMove is the data controller.

Controller details

Business — LëtzMove - Veronica Floridi

Address — 29, rue du Commerce, L-3616 Kayl, Luxembourg

Email — contact@letzmoveportal.com

Website — letzmoveportal.com

VAT — LU37757537

Supervisory authority — Commission nationale pour la protection des données (CNPD), Luxembourg

2. Legal framework

This policy is designed around Regulation (EU) 2016/679 (GDPR), the Luxembourg law of 1 August 2018 organising the CNPD and implementing the general data-protection framework, and other applicable Luxembourg/EU privacy and electronic-communications rules.

3. Whose data may be processed?

- Private relocation/immigration clients and prospective clients.

- Employees/assignees of corporate clients and their spouses, partners, children or other family members involved in an assignment.

- Corporate HR/mobility contacts and business contacts.

- Landlords, agents, service providers and professional contacts involved in a case.

- Website/portal users and people who contact LëtzMove.

- Suppliers, advisers and other persons necessary for business administration.

4. What personal data may be collected?

- Identity and civil-status information: name, date/place of birth, nationality, marital/family information and copies of identity documents where necessary.

- Contact details: address, email, telephone number and preferred communication details.

- Employment and assignment information: employer, role, start date, work location and relocation details.

- Housing and settling-in information: budget, household size, preferred areas, property requirements, arrival dates, utilities and service setup information.

- Immigration/administrative documents: passport/ID, visas, residence/work documents, civil-status certificates, social-security/health-insurance information and tax/registration information where required for the instructed service.

- Financial/transaction information necessary for quotations, invoices, payments or service setup; LëtzMove does not need to retain full payment-card credentials.

- Correspondence, portal activity and case notes necessary to manage the assignment.

5. Special-category data

LëtzMove may occasionally need health or other special-category data when genuinely necessary for an instructed relocation/immigration purpose (for example, an accessibility requirement, schooling support or an authority requirement). Such data is minimised, access-restricted and processed only where an appropriate GDPR Article 9 condition applies. Identity documents may contain photographs or other sensitive attributes; they are handled as high-sensitivity documents even where they do not constitute biometric processing for unique identification.

6. Purposes and legal bases

Purpose — Typical legal basis

Provide quotations, onboarding and contracted relocation/immigration services — Steps at your request before a contract; performance of a contract.

Corporate employee assignments — Performance of the corporate services agreement and/or legitimate interests in delivering the instructed assignment; where LëtzMove acts only on the employer’s instructions, the corporate client may be controller and LëtzMove processor.

Administrative/immigration submissions and communications with authorities — Contract; legal obligations where applicable; explicit consent or another Article 9 condition where special-category data is required.

Invoicing, accounting, tax and record keeping — Legal obligation and legitimate interests in business administration.

Security, fraud prevention, claims and dispute management — Legitimate interests and, where relevant, establishment/exercise/defence of legal claims.

Responding to enquiries and maintaining business relationships — Legitimate interests or steps prior to contract.

Direct marketing to business contacts or clients — Legitimate interests or consent where required; recipients may object/unsubscribe at any time.

Website/portal operation and security — Legitimate interests; consent where required for non-essential cookies or similar technologies.

7. Where data comes from

Data may be collected directly from the person concerned, from a corporate client/HR contact, from an authorised family member or representative, from public authorities, landlords/agents or other providers involved in the assignment, and from information the person chooses to submit through the website or client portal.

8. Who may receive personal data?

Depending on the requested service, data may be shared only as necessary with competent Luxembourg or foreign authorities, communes, immigration bodies, social-security/health-insurance bodies, embassies/consulates, landlords and real-estate agents, insurers, banks, utilities/telecom providers, schools/childcare providers, transport/move providers, translators, legal/accounting advisers, IT/cloud/email/portal providers and other suppliers specifically required for the assignment.

Recipients such as public authorities, landlords, banks, insurers and other independent service providers may act as separate controllers under their own privacy rules.

9. Service providers and processors

LëtzMove uses selected technology and professional service providers. Core services currently include Proton services for business communications and secure storage/sharing where used, and Lovable-related services for the website/client portal. The operational provider register should be kept updated with any underlying hosting/database, e-signature, CRM, accounting or automation provider that receives personal data.

10. International transfers

Where data is transferred outside the EEA, LëtzMove will use a lawful transfer mechanism where required, such as an adequacy decision or Standard Contractual Clauses with appropriate supplementary measures. Some relocation/immigration cases necessarily involve a foreign authority, embassy, consulate or service provider in the destination/origin country; such disclosures will be limited to what is necessary and legally permitted.

11. Retention

Personal data is not kept longer than necessary. Case files should be reviewed after completion and retained only for a documented business/legal period. Accounting and tax records are retained for the period required by Luxembourg law. Identity and immigration documents should be deleted earlier where they are no longer needed, unless retention is required for an ongoing case, legal obligation or defence of claims. LëtzMove should maintain a separate retention schedule specifying concrete periods by record category.

12. Security

- Need-to-know access and confidentiality.

- Strong passwords and multi-factor authentication where available.

- Secure business email/cloud tools and encrypted transmission/storage where supported.

- Recipient verification before sending passports, civil-status documents or other sensitive records.

- Minimal local storage and secure deletion when no longer needed.

- Updated devices, access locking and appropriate security software.

- Incident reporting and response procedures.

- Periodic review of processors, sharing permissions and retention.

13. Your GDPR rights

Subject to applicable conditions and exceptions, you may request access to your personal data, rectification, erasure, restriction, data portability, and object to processing based on legitimate interests or to direct marketing. Where processing is based on consent, you may withdraw consent at any time without affecting earlier lawful processing. You also have rights relating to certain solely automated decisions; LëtzMove does not currently intend to make decisions producing legal or similarly significant effects solely by automated means.

Requests may be sent to contact@letzmoveportal.com. LëtzMove may need to verify identity before disclosing data. Requests will be handled within the GDPR time limits.

14. Complaints

You may contact LëtzMove first so that concerns can be addressed. You also have the right to lodge a complaint with the Commission nationale pour la protection des données (CNPD) in Luxembourg or, where applicable, another competent EEA supervisory authority.

15. Children

Relocation assignments may require data about children, for example for residence, commune, school, childcare, family-benefit or insurance procedures. Such data will be limited to the relevant service and handled with particular care. Communications and instructions should normally be managed through the parent/legal representative unless law or the relevant authority requires otherwise.

16. Website, portal and cookies

The website/client portal should display a privacy notice at or before collection of personal data. If analytics, advertising or other non-essential cookies/trackers are used, a compliant consent mechanism and cookie notice should be implemented where required. The live website/portal configuration should be checked against this policy whenever new forms, integrations or tracking tools are added.

17. Data breaches

Suspected loss, unauthorised access, misdirected disclosure or other personal-data incident must be assessed promptly. Where GDPR thresholds are met, LëtzMove will notify the CNPD without undue delay and, where feasible, within 72 hours after becoming aware of a reportable breach, and will inform affected individuals where the GDPR requires it.

18. Internal handling rules

- Collect only data necessary for a defined purpose.

- Do not share client documents through unapproved personal accounts or public links.

- Use secure links or protected channels for sensitive files where practicable.

- Do not leave printed or displayed personal data accessible to unauthorised persons.

- Keep case information accurate and correct known inaccuracies.

- Review access rights and delete obsolete copies.

- Escalate privacy questions or incidents to the business owner before taking action.

19. Updates

This policy should be reviewed at least annually and whenever LëtzMove materially changes its services, portal, providers, data flows or legal requirements. The version published or supplied at the relevant time applies to the processing described in it.

Document control

Version — 1.0 - LëtzMove

Effective date — October 2026

Owner — Veronica Floridi / LëtzMove

Next review — October 2027 or earlier if services/providers change