Privacy Policy

1. Who we are

Lounbréck ("we", "us", "our") is a payroll compliance platform designed for SMEs operating in Luxembourg with cross-border (frontalier) employees.

Company: Lounbréck S.A.
Registered office: Luxembourg
Email: hello@lounbreck.com

Supervising Authority (CNPD): Commission nationale pour la protection des données (CNPD), Luxembourg. If you have concerns about how we handle your personal data, you may contact CNPD at cnpd.public.lu.

2. Data we collect

As a B2B payroll compliance platform, Lounbréck processes personal data on behalf of our business customers (employers). The categories of data include:

Employee Personal Data (Processed on behalf of employers)

Full name, date of birth, nationality, and country of residence
National identification number (e.g., national registration number, SSN)
Tax identification number and current tax class
Social security number and CCSS affiliation
Home address and country of residence (for treaty determination)
Employment contract details: start date, job title, salary
Work location and employer entity
Cross-border commuting patterns and WFH day records
Bank account details (for payroll processing)

Employer Account Data

Company name, registration number, and address
HR administrator name, email, and role
Billing and subscription information

Technical Data (Automated)

IP address, browser type, and device information
Pages visited and timestamps (analytics)
Cookie data as described in our Cookie Policy

3. How we use your data

We use personal data only for the following purposes:

Payroll compliance calculations: Computing tax class routing, treaty threshold tracking, WFH day counting, and CCSS declaration preparation
Compliance reporting: Generating reports required by Luxembourg ACD, CCSS, and bilateral treaty obligations
Account management: Creating and managing employer accounts, authentication, and billing
Platform operation: Hosting, security monitoring, error logging, and technical support
Communication: Sending service-related notifications, compliance reminders, and support responses
Analytics: Improving platform features and understanding usage patterns (aggregated, non-identifying where possible)

We do not sell employee personal data to third parties. We do not use personal data for marketing purposes without explicit consent.

4. Legal basis for processing (GDPR Article 6)

Our processing of personal data is conducted under the following lawful bases:

Data Category	Legal Basis	Explanation
Employee payroll data	Art. 6(1)(b) — Contract performance	Processing is necessary to perform our service contract with the employer
Legal compliance data	Art. 6(1)(c) — Legal obligation	Processing required by Luxembourg tax law, CCSS regulations, and EU treaty obligations
Employer account data	Art. 6(1)(b) — Contract performance	Processing necessary to provide and maintain the employer account
Technical/analytics data	Art. 6(1)(f) — Legitimate interests	Our legitimate interest in operating and improving a secure platform
Marketing communications	Art. 6(1)(a) — Consent	Where required, we obtain explicit consent before marketing use

Special category data (Art. 9 GDPR): Some employee data (e.g., nationality, union membership if applicable) may constitute special category data. We process such data only under Art. 9(2)(b) — legal obligation — or Art. 9(2)(f) — establishment/exercise of legal claims — as applicable.

5. Data retention

We retain personal data only as long as necessary for the purposes described above. Specific retention periods:

Data Category	Retention Period	Legal Basis
Employee payroll records	10 years after employment ends	Luxembourg commercial and tax law (Art. L.121-9 CTN)
CCSS declarations	10 years	CCSS regulatory requirements
WFH tracking records	7 years	Bilateral treaty documentation requirements
Employer account data	Duration of contract + 5 years	Contract and limitation periods
Technical logs (anonymized)	12 months	Operational security
Cookie data	As per Cookie Policy (/cookies)	Consent

After the retention period, data is securely deleted or anonymized. Where anonymization is used, data is altered so that individuals can no longer be identified, permitting use for aggregate compliance research.

6. Cross-border data transfers

Lounbréck operates across Luxembourg, France, Belgium, and Germany. Employee data may be accessed or processed in the following contexts:

EU/EEA transfers: Data processed within the EU/EEA is subject to GDPR Chapter V. No additional safeguards are required for intra-EU/EEA transfers.
Third-country transfers: If any data is transferred outside the EU/EEA, we rely on GDPR Art. 46 Standard Contractual Clauses or Art. 49 derogations as applicable.
Sub-processors: We use cloud infrastructure (data centers within the EU) and the following sub-processors for platform operation. All sub-processor agreements include GDPR-compliant data processing terms.

Data Controller vs. Processor: For employer-customer data (employee records), the employer is the data controller and Lounbréck acts as a data processor under their instructions. Our role and obligations are defined in our Data Processing Agreement (DPA), available upon request.

7. Data security

We implement appropriate technical and organizational security measures to protect personal data against unauthorized access, loss, or destruction:

Encryption: Data in transit (TLS 1.2+) and at rest (AES-256)
Access controls: Role-based access control (RBAC) with least-privilege principle
Audit logging: All access to employee records is logged with timestamp, user identity, and action
Infrastructure security: Cloud infrastructure hosted within EU data centers with ISO 27001-aligned security controls
Vulnerability management: Regular security reviews and patching of identified vulnerabilities
Incident response: GDPR Art. 33/34 compliant data breach notification procedure — CNPD notified within 72 hours of becoming aware of a breach; affected individuals notified where high risk

8. Your rights under GDPR

Depending on your jurisdiction and role, you may have the following rights. To exercise any right, contact us at hello@lounbreck.com.

Right	Description	Timeframe
Right of Access (Art. 15)	Request a copy of all personal data we hold about you	30 days
Right to Rectification (Art. 16)	Request correction of inaccurate personal data	30 days
Right to Erasure (Art. 17)	Request deletion of personal data (subject to legal retention obligations)	30 days
Right to Restriction (Art. 18)	Request limitation of processing pending correction or dispute resolution	30 days
Right to Portability (Art. 20)	Request transfer of your data in a structured, machine-readable format	30 days
Right to Object (Art. 21)	Object to processing based on legitimate interests or public tasks	30 days
Withdraw Consent (Art. 7(3))	Withdraw consent at any time where consent is the legal basis	Immediate
Lodge a Complaint (Art. 77)	File a complaint with CNPD or your local supervisory authority	Any time

Employee note: If you are an employee whose data is processed by Lounbréck on behalf of your employer, your primary point of contact is your employer's HR department. We act as a processor — your employer (controller) will fulfill data subject rights requests in most cases, with our technical assistance where needed.

9. Cookies

Please refer to our Cookie Policy for full details on what cookies we use, how we use them, and how you can manage your preferences.

Our cookie consent mechanism is displayed on your first visit to the platform. You may update your preferences at any time via the Cookie Settings link in our footer.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our platform, legal obligations, or regulatory guidance. Material changes will be communicated to registered employers via email at least 30 days before they take effect.

The "Last updated" date at the top of this page reflects the date of the most recent revision. We encourage you to review this policy periodically.

12. Disclaimer

This Privacy Policy was last updated on 14 April 2026. This document is provided as a general placeholder covering the essential elements of GDPR compliance for the Lounbréck platform. It does not constitute legal advice. Consult qualified legal counsel for jurisdiction-specific advice, particularly regarding your obligations as a data controller or processor under EU and Luxembourg data protection law.

Contents