Data protection

Privacy policy

FIL processes your personal data with transparency, proportionality and security, in accordance with Regulation (EU) 2016/679 (GDPR) and the Luxembourg law of 1 August 2018.

Key points

Your data is used solely to answer your enquiries, review your application and run the Federation.
Your supporting documents (ID, criminal record, etc.) stay private, accessible only to authorised staff, and are never published.
No data is sold or used for advertising.
You can exercise your rights at any time by writing to contact@federation-immobiliere.lu.

1. Data controller

Fédération Immobilière du Luxembourg A.s.b.l., 2, rue Jean Engling, L-1466 Luxembourg, Luxembourg Trade Register F15111 — contact@federation-immobiliere.lu. This address is the single point of contact for any data protection question.

2. Data processed

Visitors: data sent via the contact or complaint forms (name, email, phone, message).
Applicants: identity and contact details of the manager, company data (name, RCS, business permit), supporting documents, electronic signature and application history.
Members: account data, directory listing, documents, invoices and fee payments, messages with the Federation, sign-in logs.
Professionals contacted: public business contact details (agency name, business email, website) used to present the Federation.
Technical data: security logs needed to operate and protect the website.

3. Purposes and legal bases

Purpose	Legal basis (Art. 6 GDPR)
Answering enquiries and complaints	Legitimate interest / pre-contractual steps
Reviewing applications, good repute and professional permit	Pre-contractual steps and legitimate interest in upholding the Code of Ethics
Managing membership, the member area, fees and invoicing	Performance of the membership contract and legal accounting obligations
Publishing the member directory	Performance of the membership contract; members control their listing
Informing industry professionals about the Federation	Legitimate interest, with a right to object at any time
Website security	Legitimate interest

4. Recipients

Data is accessible only to authorised Federation staff on a need-to-know basis. Sensitive documents are reserved for staff and never visible from a shared member account.

Technical processors (hosting, email delivery, electronic signature, online payment) act on FIL's instructions and are bound under Article 28 GDPR.

Only business details voluntarily published in the directory are public. No data is sold.

5. Transfers outside the EU

Where a provider processes data outside the EEA, the transfer relies on a European Commission adequacy decision or standard contractual clauses, supplemented by additional measures where needed.

6. Retention periods

Data	Period
Contact enquiries	3 years after the last exchange
Incomplete or rejected applications	12 months after the decision, then deleted
Members' supporting documents	Duration of membership, then 12 months
Membership data and directory listing	Duration of membership; listing removed when it ends
Invoices and accounting records	10 years (legal obligation)
Contact details for Federation information	3 years after the last contact, or until objection
Security logs	12 months maximum

7. Security

FIL applies appropriate technical and organisational measures: encrypted transmission (HTTPS), private document storage, server-enforced role-based access control, single-use invitation and upload links, access logging. In the event of a data breach likely to cause a risk, the CNPD and, where required, the persons concerned are notified within the legal deadlines.

8. Cookies and local storage

The website uses no advertising cookies, no commercial audience measurement and no embedded social networks. Only strictly necessary elements are used: the member area session, language preference and the membership form draft kept on your own device. These do not require consent.

9. Your rights

Right of access, rectification and erasure.
Right to restriction of processing and to data portability.
Right to object, in particular to information about the Federation.
Right to withdraw consent where processing is based on it.
To exercise your rights: contact@federation-immobiliere.lu. You will receive a reply within one month; proof of identity may be requested in case of reasonable doubt.
Right to lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15, boulevard du Jazz, L-4370 Belvaux — www.cnpd.lu.

10. Automated decisions

No decision producing legal effects is based solely on automated processing. Automated checks (document completeness, permit verification) assist the review; admission is always decided by the Federation.

11. Changes

This policy may be updated to reflect changes in services or regulation. The last update date appears below; members are informed of any substantial change.

Last updated: 12 October 2026.