Privacy policy

Data controller

Paula Hahn, sole proprietorship trading as “Maison AC”, 85D, route de Thionville, L-2611 Luxembourg. For any question about your data: hello@encorebon.lu.

Data we collect

Customers: first name, email address, phone number (optional), reservation details (shop, bag, quantity, status, pickup code) and the date you accepted the terms. No account, no password, no bank details.

Shops: shop name and address, contact person’s name, email, phone, login details (the password is stored hashed) and history of published bags.

Why, and on what basis

Managing your reservation and sending your pickup code: performance of the service you requested (Art. 6(1)(b) GDPR).

Applying the no-show rule (2 no-shows within 60 days lead to a 30-day pause): legitimate interest in keeping bags available for everyone (Art. 6(1)(f)).

Producing shops’ monthly statements: legal accounting obligation (Art. 6(1)(c)).

We send no advertising, sell no data and use no advertising trackers.

Who has access

The shop you book with sees your first name, the quantity, your pickup code and your phone number if you gave it.

Our technical providers, only to run the service: hosting (Netlify, Inc., San Francisco (USA) — netlify.com), database and transactional email delivery. Where data is processed outside the European Union, the transfer is covered by the European Commission’s standard contractual clauses.

Retention periods

Customer reservations (first name, email, phone): automatically anonymised 12 months after the reservation. Only anonymous figures remain (number of bags collected).

No-show block: for the length of the block (30 days), then lifted automatically.

Log of emails sent: 90 days. Password reset links: valid for 1 hour, deleted after 24 hours. Login abuse-prevention log: 24 hours.

Shop accounts: for the whole partnership, then 3 years. Monthly statements (invoices): 10 years, as required by Luxembourg accounting law.

Cookies

The public website uses no analytics or advertising cookies. A single, strictly necessary technical cookie keeps shops logged in to their area.

WhatsApp groups

The regional WhatsApp groups are hosted by WhatsApp (Meta). When you join a group, the admins can see your number. Encore Bon neither copies nor stores members’ numbers.

Your rights

You can request access to, correction, erasure or portability of your data, or object to processing, by writing to hello@encorebon.lu. We reply within one month.

You can also lodge a complaint with the supervisory authority: Commission nationale pour la protection des données (CNPD), 15, boulevard du Jazz, L-4370 Belvaux — cnpd.public.lu.