Privacy policy

This page explains what personal data the alpex.lu website collects, why, how long we keep it and what you can ask us at any time. It is written in accordance with the General Data Protection Regulation (Regulation EU 2016/679, the “GDPR”) and the Luxembourg law of 1 August 2018. This page is an English translation; in case of any discrepancy, the French version prevails.

One important point up front: this site sets a single, strictly necessary cookie, which remembers your choice on the cookie notice. It uses no advertising tracker. No audience measurement tool is installed. You can browse the site, and even get an estimate from the grant calculator, without sending us any form data at all. Nothing you type reaches us until you submit a form yourself. The details are in our cookie policy.

1. Who is responsible for your data

The data controller is the company that decides on these processing activities and the one you can contact:

Company: Alpex S.à r.l.
Registered office: 12, rue de Bastogne, L-1217 Luxembourg, Grand Duchy of Luxembourg
Email: contact@alpex.lu
Telephone: [To be completed: telephone number]

Given its size and the nature of its activity, Alpex is not required to appoint a data protection officer. Questions about your data are handled by the management, at contact@alpex.lu.

2. The data we collect

The site has exactly two forms. Apart from them, and from the technical items described further down, no personal data is collected by the site itself.

The contact form

your name;
your email address;
your telephone number (optional);
your municipality (optional);
the subject of your enquiry, chosen from a list;
the free text describing the building and the project;
the site language you used, so that we reply in the right language.

The free text field is yours: please write only what is useful for the study. There is no need to mention sensitive information (health, family situation, detailed financial situation) in order to get an answer.

Only your name and email address are indispensable: without them we cannot reply. The other fields are optional. Neither the law nor a contract requires you to give us this data.

The grant calculator

The calculator runs in five steps. The first four stay entirely inside your browser: the calculation is performed on your own device, in JavaScript, and nothing is sent to Alpex. If you close the page at that stage, nothing remains with us.

Only at the last step, if you ask for the detailed calculation, is the following information sent to us:

your name and email address;
your telephone number (optional);
the type of property indicated (single family house, apartment building, other);
the types of work selected;
the material chosen (conventional or bio-based);
the surface areas you entered for each item (roof, walls, floor, windows);
the type of heat pump considered, where applicable;
your municipality, if you entered it;
the construction period of the building;
the number of dwellings, for an apartment building;
the estimate produced, its item by item breakdown and the reference scale used;
the site language you used.

The estimate is then recomputed on our server from those entries, so that the figure we receive matches the data sent. These elements describe a building and a renovation project. None of them is sensitive data within the meaning of the GDPR.

Technical data when a form is submitted

To screen out automated submissions, three measures apply at the moment you submit a form:

an invisible field traps robots; it records nothing about you;
the time taken to fill in the form is checked, a near-instant submission being the mark of a robot;
the number of submissions per IP address is limited. For this purpose your IP address is held in the server’s memory for ten minutes. It is never written to disk nor linked to your enquiry.

The site language

The site exists in French, English and German. On your first visit to the root address of the site, our server reads the language preference sent by your browser in order to redirect you to the right version. Nothing is stored for this.

Cookies

The site sets a single cookie, alpex_consent, kept for six months. It is set by the site itself and only records your choice on the cookie notice. It contains no identifier that could be used to follow you.

To find out more, see our cookie policy.

What we do not collect

this site places no cookie on your device other than the necessary alpex_consent cookie;
no statistics or audience measurement tool is installed;
no advertising tracker, no social network pixel, no profiling;
nothing is loaded from a third party service: the typefaces are served from our own server, and your browser contacts neither Google nor any other third party when displaying the site;
no automated decision is taken about you: the calculator’s estimate is a simple calculation that we then review by hand.

3. Why we process it, and on what basis

Answering your enquiry: Getting back to you, assessing whether a grant application holds up, preparing a quotation or a detailed calculation. Legal basis: your consent, given by ticking the box before submitting the form. You can withdraw it at any time.
Carrying out an assignment: If we work together, the data is used to set up and follow the contract. Legal basis: performance of the contract, or pre-contractual steps taken at your request.
Running and securing the site: Keeping the site working, directing you to the right language and protecting the site against automated submissions (invisible field, check on how quickly the form was filled in, limit on the number of submissions per IP address). Legal basis: our legitimate interest in a reliable site and in limiting abuse.
Remembering your cookie choice: The alpex_consent cookie saves us from asking you the question again on every page. Being strictly necessary for that purpose, it is exempt from consent. Legal basis: our legitimate interest in respecting your choice and being able to demonstrate it.
Keeping accounting records: Quotations, invoices and supporting documents relating to an assignment. Legal basis: our legal obligations, in particular accounting and tax obligations in Luxembourg.
Evidencing our exchanges: Keeping a record of an enquiry and of the answer given, in case of a dispute, including through the backup copy kept on our server. Legal basis: our legitimate interest in losing no enquiry and in defending our rights.

We do not use your address for marketing unrelated to your enquiry, and we neither sell nor rent your data to anyone.

4. Who receives your data

Alpex

Your data is read by the partners and managers of Alpex who handle the enquiry, and by them alone.

Our own server, which delivers the forms

No third party form processor is involved. When you submit a form, its content is sent over HTTPS to the site’s own server, that is, the very application that serves you the pages, operated by Alpex on its hosting provider’s infrastructure. That server does two things:

it immediately relays your enquiry to us by email, to our business mailbox, where it is kept like ordinary correspondence;
it keeps a backup copy of each enquiry in a log file on the server, for 12 months, so that no enquiry is lost should an email fail to arrive. Only the managers of Alpex have access to it.

Our mailbox and our hosting provider

Enquiries are received and kept in our business mailbox, provided by OVH SAS (France).

The site runs on a virtual private server rented from OVH SAS (2 rue Kellermann, 59100 Roubaix, France), in a data centre located in France. OVH SAS provides the infrastructure; Alpex administers the server and the application itself. To keep the site secure and working, this server may record technical connection logs (IP address, date and time, page requested), kept for no more than 30 days. As operator of the infrastructure, OVH SAS may also keep its own technical network data, in line with the legal obligations that apply to it.

These providers act as our processors: they handle your data only on our behalf and on our instructions.

Other recipients

If you entrust us with an assignment, some information may be passed to the relevant administrations and assessing bodies (for example as part of a grant application), to our accountants for bookkeeping, or to a legal adviser in the event of a dispute. Such disclosures are limited to what is necessary and are governed by the contract or by law.

5. Transfers outside the European Union

The processing described on this page takes place within the European Union. Running the site involves no transfer of data outside the European Union. If that were to change, this policy would be updated and the transfer would be covered by the safeguards provided for in the GDPR.

6. How long we keep it

Enquiry with no follow-up: 12 months from the last exchange. That period allows for a project postponed from one building season to the next, without keeping abandoned enquiries indefinitely.
Backup copy on the server: 12 months from the submission of the form, after which the log file is deleted.
Prospect being followed up: 3 years from your last contact with us, the usual period for commercial follow-up. After that, the information is deleted.
Estimate from the calculator: 12 months, or the duration of the assignment if it leads to a signed quotation. Since grant scales are revised regularly, an old estimate loses all usefulness.
Client file: The duration of the assignment, then 10 years after it closes, the period during which our professional liability may be engaged and during which an administration may ask for the documents.
Accounting records: 10 years, in line with Luxembourg accounting and tax obligations.
IP address used to limit submissions: Ten minutes, in memory only, never written to disk.
The alpex_consent cookie: 6 months, after which you are asked the question again.
Server technical logs: No more than 30 days, for security purposes.

At the end of these periods the data is deleted, unless a legal obligation requires us to keep it longer.

7. Your rights

Regarding the data concerning you, you can ask for:

access: to know whether we hold data about you and to receive a copy of it;
rectification: to correct inaccurate or incomplete information;
erasure: to have your data deleted where there is no longer any reason to keep it;
restriction: to freeze the use of your data, for instance while a dispute is being checked;
objection: to object to processing based on our legitimate interest, on grounds relating to your situation;
portability: to receive the data you provided in a machine-readable format, or to have us send it to another provider;
withdrawal of your consent: at any time, without having to give a reason. Withdrawal does not affect what was done beforehand.

How to exercise these rights

Write to contact@alpex.lu, or by post to the registered office shown at the top of this page. One sentence is enough: tell us what you are asking for and from which email address you wrote to us, so that we can find your enquiry.

We reply within one month. That period may be extended by two months if the request is complex, in which case we will tell you. If there is serious doubt about your identity we may ask for proof: we only do so where necessary, and that proof is not kept.

Complaint to the supervisory authority

If our answer does not satisfy you, you can lodge a complaint with the Luxembourg data protection authority:

Authority: Commission nationale pour la protection des données (CNPD)
Address: 15, boulevard du Jazz, L-4370 Belvaux, Luxembourg
Website: cnpd.public.lu

If you live in another European Union country, you may also contact the data protection authority of your country of residence.

8. Security

The site is served over HTTPS: the data you enter in the forms travels encrypted. Submissions are handled by Alpex’s own server, without passing through any third party service. An invisible field and a limit on the number of submissions screen out automated submissions from robots. Access to the messages received and to the backup copy is limited to the people at Alpex who handle the enquiry, through individual access protected by authentication.

No measure makes a system invulnerable. If a data breach were likely to result in a high risk to your rights, we would inform you, and the CNPD, under the conditions set out in the GDPR.

9. Changes to this policy

This policy may change, for example if we add a service to the site. The version that applies is the one published on this page, with the update date shown on it. If a change is significant, we will inform the people concerned.

Last updated: October 12, 2026