Privacy Policy

HNWI Immobilière sàrl (“Xact”, “we”, “us” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you visit our website xact.lu and use our services.

We process your data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Luxembourg data protection law.

The controller responsible for your personal data is:

HNWI Immobilière sàrl
6, rue de Bettborn
L-8835 Folschette, Luxembourg
Email: info@xact.lu
Phone: +352 661 39 12 30
RCS Luxembourg: B236411
VAT: LU32133545

We collect information that you provide directly to us, including:

• Account information: name, email address, phone number and password when you create an account
• Property listings: property details, images and descriptions you submit
• Contact form: name, contact details and your message
• Valuation request: details of the property, your contact details and the photos you upload
• Property enquiry: your contact details and your message about a specific property
• Communications: messages sent through our platform

Automatically collected information:

• IP address and device information
• Browser type and settings
• Pages requested and date and time of access (server log data)
• Referring website address
• Cookies and similar technologies (see our Cookie Policy)

We use your personal data for the following purposes:

• To provide and maintain our services and your account
• To process and manage property listings
• Contact form: to answer your request
• Valuation request (including uploaded photos): to prepare and discuss the valuation you requested
• Property enquiry: to answer your enquiry about the property concerned
• To facilitate communication between users and property agents
• To send you service-related communications, such as confirmations of your requests
• To protect the website against spam and misuse
• To improve our services
• To comply with legal obligations
• To send marketing communications (only with your consent)

Data you submit through the contact form, the valuation request or a property enquiry is used solely to handle and answer your request.

We process your personal data on the following legal grounds:

• Contract and pre-contractual steps (Art. 6(1)(b) GDPR): to provide our services and answer your requests
• Legitimate interests (Art. 6(1)(f) GDPR): to improve our services and ensure security, including protection against spam and misuse
• Consent (Art. 6(1)(a) GDPR): for marketing communications and optional features
• Legal obligation (Art. 6(1)(c) GDPR): to comply with applicable laws and regulations

We only share your information where necessary:

• Property agents: when you contact an agent about a property
• Service providers: providers who help us operate the website (see below)
• Legal requirements: when required by law or to protect our rights
• Business transfers: in connection with a merger, acquisition or sale of assets

We use the following service providers to operate the website:

• Vercel: website hosting, which involves processing technical access data such as your IP address
• Supabase: database and image storage (for example property photos and photos submitted with valuation requests)
• Resend: sending emails, such as confirmations and notifications about your requests
• Cloudflare Turnstile: spam protection on our forms; technical data such as your IP address and browser information is processed
• Upstash: rate limiting to prevent misuse; only technical data such as your IP address is processed
• OpenFreeMap: map tiles; when you view a map, your browser loads the map tiles directly from tiles.openfreemap.org, which transmits your IP address to that provider

Fonts are served from our own server; no connection to Google Fonts is made when you visit the website.

We do not sell your personal data to third parties.

We retain your personal data only for as long as necessary for the purposes described in this policy:

• Requests (contact form, valuation request including photos, property enquiry): deleted once your request has been handled and no legal retention obligation applies
• Account data: until your account is deleted
• Property listings: for as long as the listing is active, plus a reasonable period for legal and business purposes

Under the GDPR, you have the following rights:

• Right of access: request a copy of your personal data
• Right to rectification: request correction of inaccurate data
• Right to erasure: request deletion of your personal data
• Right to restriction of processing: request that processing be restricted
• Right to data portability: receive your data in a structured, commonly used format
• Right to object: object to processing based on legitimate interests
• Right to withdraw consent: withdraw your consent at any time

To exercise these rights, please contact us at info@xact.lu.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction, including encrypted transmission (HTTPS).

Where data is processed outside the EU/EEA, this is done on the basis of the EU Standard Contractual Clauses or an adequacy decision of the European Commission.

We may update this Privacy Policy from time to time. We will inform you of any material changes by posting the new version on this page and updating the “Last updated” date.

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

Email: info@xact.lu
Phone: +352 661 39 12 30

You also have the right to lodge a complaint with the Luxembourg data protection authority, the Commission nationale pour la protection des données (CNPD): cnpd.public.lu.