Skip to main content

Legal

Privacy Policy

Last updated: 7 March 2026

1. Introduction

Jewellery Boutique Luxembourg (hereinafter "we", "us", "our", or "the Collective") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website at myjewellery.boutique (the "Website") and interact with our services.

We process personal data in compliance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), the Luxembourg law of 1 August 2018 on the organisation of the Commission Nationale pour la Protection des Données (CNPD) and implementing the GDPR, and all other applicable data protection legislation.

2. Data Controller

The data controller responsible for the processing of your personal data is:

Jewellery Boutique Luxembourg
Grand Rue
1661 Luxembourg City
Grand Duchy of Luxembourg
Email: [email protected]

For any questions or requests regarding this Privacy Policy or the processing of your personal data, please contact us at the email address above.

3. Personal Data We Collect

We collect personal data in the following ways:

3.1 Information You Provide Directly

  • Newsletter subscription: email address, first name (optional)
  • Contact form: first name, last name, email address, subject of enquiry, message content
  • Artisan application: first name, last name, email address, phone number (optional), location, professional speciality, years of experience, portfolio URL (optional), description of work, motivation statement

3.2 Information Collected Automatically

When you visit our Website, we may automatically collect certain technical data, including:

  • IP address (anonymised where possible)
  • Browser type and version
  • Operating system
  • Pages visited, date and time of visits
  • Referring website
  • Device type and screen resolution

This data is collected via cookies and similar technologies as described in Section 7 below.

4. Purposes and Legal Bases for Processing

We process your personal data for the following purposes and on the following legal bases under Article 6(1) of the GDPR:

Purpose Data Processed Legal Basis
Sending newsletters and marketing communications Email address, first name Consent (Art. 6(1)(a)) — You can withdraw consent at any time
Responding to contact enquiries Name, email, enquiry content Legitimate interest (Art. 6(1)(f)) — To respond to your request
Processing artisan applications Application form data Pre-contractual measures (Art. 6(1)(b)) — To evaluate your application prior to potential partnership
Website analytics and performance Technical and usage data Consent (Art. 6(1)(a)) — Via cookie consent management
Ensuring website security and preventing fraud Technical data, IP address Legitimate interest (Art. 6(1)(f)) — To protect our Website and users

5. Third-Party Service Providers

We use the following third-party services to operate our Website and process data:

5.1 Google Tag Manager

We use Google Tag Manager (provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to manage website tags and tracking scripts. Google Tag Manager itself does not collect personal data, but it enables other tools (such as analytics) that may do so. These tools are only activated with your consent via our cookie management solution.

Google's Privacy Policy: https://policies.google.com/privacy

5.2 Mailchimp

We use Mailchimp (provided by The Rocket Science Group LLC d/b/a Intuit Mailchimp, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA) to manage our newsletter mailing list and send email communications.

When you subscribe to our newsletter, your email address and first name are transferred to Mailchimp's servers in the United States. Mailchimp is certified under the EU-US Data Privacy Framework, providing adequate safeguards for the transfer of personal data from the EU to the US in accordance with Article 45 of the GDPR.

Mailchimp may collect data on how you interact with our emails (e.g., open rates, click-through rates) to help us improve our communications.

Mailchimp's Privacy Policy: https://www.intuit.com/privacy/statement/

5.3 OpenStreetMap

Our contact page uses map tiles from OpenStreetMap (operated by the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). When the map loads, your browser makes requests to OpenStreetMap's tile servers, which may log your IP address.

OpenStreetMap's Privacy Policy: https://wiki.osmfoundation.org/wiki/Privacy_Policy

5.4 Cloudflare

Our Website is served through Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA), which provides content delivery network (CDN), DNS, and security services. Form submissions on our Website (contact enquiries and artisan applications) are processed through a Cloudflare Worker, a serverless compute function.

When you visit our Website, Cloudflare may automatically collect and process certain technical data, including your IP address and request metadata, for the purposes of security, performance optimisation, and bot management. Cloudflare may also set strictly necessary cookies (such as __cf_bm and cf_clearance) for bot management purposes.

International transfers to the USA are safeguarded by EU Standard Contractual Clauses and Cloudflare's Data Processing Addendum.

Cloudflare's Privacy Policy: https://www.cloudflare.com/privacypolicy/

5.5 Mailgun

We use Mailgun (provided by Sinch Email, Lindhagensgatan 74, 112 18 Stockholm, Sweden) to deliver transactional emails. When you submit a contact enquiry or an artisan application, the data you provide (name, email address, and message/application content) is transmitted to Mailgun's EU region (api.eu.mailgun.net) for the sole purpose of delivering an email notification to us.

Mailgun processes this data solely to deliver the email and does not use it for marketing or any other purpose. Mailgun retains message logs for up to 30 days. As we use Mailgun's EU endpoint, your data is processed within the European Union.

Mailgun's Privacy Policy: https://www.mailgun.com/legal/privacy-policy/

6. International Data Transfers

Some of the third-party services we use may transfer your personal data outside the European Economic Area (EEA), specifically to the United States. Where such transfers occur, we ensure appropriate safeguards are in place:

  • Mailchimp / Intuit: Certified under the EU-US Data Privacy Framework (adequacy decision per Article 45 GDPR)
  • Google: EU Standard Contractual Clauses and Data Privacy Framework certification
  • Cloudflare: EU Standard Contractual Clauses and Cloudflare Data Processing Addendum
  • Mailgun / Sinch: EU region (api.eu.mailgun.net) is used; data remains within the EU

7. Cookies and Tracking Technologies

Our Website uses cookies and similar technologies. We use Tarteaucitron as our cookie consent management platform to give you control over which cookies are set on your device.

7.1 Types of Cookies

Category Purpose Consent Required
Strictly Necessary Essential for the Website to function (e.g., cookie consent preferences, Cloudflare bot management cookies such as __cf_bm and cf_clearance). These cannot be disabled. No
Analytics Help us understand how visitors interact with our Website (e.g., Google Analytics via GTM). Data is anonymised where possible. Yes
Marketing Used to deliver relevant advertisements and track campaign effectiveness. Yes

7.2 Managing Your Cookie Preferences

You can manage your cookie preferences at any time by clicking the "Cookie Settings" link in the footer of any page on our Website. You can also configure your browser to block or delete cookies, though this may affect your experience on the Website.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

  • Newsletter subscribers: Until you unsubscribe or withdraw consent. Unsubscribed addresses are retained in a suppression list to prevent re-sending.
  • Contact enquiries: Up to 12 months after the enquiry has been resolved, unless a longer retention period is required for legal purposes.
  • Artisan applications: Up to 24 months for unsuccessful applications (to reconsider for future openings, unless you request earlier deletion). Data of accepted artisans is retained for the duration of the partnership plus any statutory retention period.
  • Website analytics data: Anonymised and aggregated data may be retained indefinitely. Identifiable data is retained for up to 14 months.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  1. Right of access (Art. 15) — You can request a copy of the personal data we hold about you.
  2. Right to rectification (Art. 16) — You can ask us to correct inaccurate or incomplete data.
  3. Right to erasure (Art. 17) — You can request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
  4. Right to restriction of processing (Art. 18) — You can ask us to restrict the processing of your data in certain circumstances.
  5. Right to data portability (Art. 20) — You can request to receive your data in a structured, commonly used, machine-readable format.
  6. Right to object (Art. 21) — You can object to processing based on legitimate interests or for direct marketing purposes.
  7. Right to withdraw consent (Art. 7(3)) — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
  8. Right not to be subject to automated decision-making (Art. 22) — We do not use automated decision-making or profiling.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month, as required by the GDPR.

10. Right to Lodge a Complaint

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Luxembourg supervisory authority:

Commission Nationale pour la Protection des Données (CNPD)
15, Boulevard du Jazz
L-4370 Belvaux
Grand Duchy of Luxembourg
Phone: (+352) 26 10 60 - 1
Website: https://cnpd.public.lu/

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

  • SSL/TLS encryption for all data transmitted between your browser and our Website
  • Secure data storage with access controls
  • Regular review of data processing practices
  • Limiting access to personal data to authorised personnel only
  • Anti-spam measures on all forms (honeypot fields, submission timing validation)

12. Children's Privacy

Our Website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will take steps to delete such data.

13. Links to Third-Party Websites

Our Website may contain links to external websites. We are not responsible for the privacy practices or content of these third-party sites. We encourage you to read the privacy policies of any external websites you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically. For significant changes, we may notify you via email or a prominent notice on our Website.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

Jewellery Boutique Luxembourg
Email: [email protected]
Address: Grand Rue, 1661 Luxembourg City, Grand Duchy of Luxembourg