Legal
Legal notice
- Provider
- EQSE SARL-S (société à responsabilité limitée simplifiée), 32, rue des Frênes, L-7384 Lorentzweiler, Luxembourg
- Represented by
- Andreas Schernus, Managing Director (gérant)
- Contact
- phone +352 2 629 6976 · email info@eqse.lu
- Register and VAT
- RCS Luxembourg B254915 · VAT identification number LU33059751 · business permit (autorisation d’établissement) no. 10129037/0
- Competent authority
- Ministère de l’Économie – Service des autorisations d’établissement, B.P. 535, L-2937 Luxembourg, info.pme@eco.etat.lu
- Responsible for content
- Andreas Schernus, address as above
Liability for content
The content of this website has been prepared with care. However, we cannot guarantee that it is complete, accurate or up to date. It is provided for general information and does not replace advice on individual cases.
Copyright
The texts, images and design of this website are protected by copyright. Any use beyond the limits permitted by law requires our prior consent. The logos of the MLQE and the “Made in Luxembourg” label are the property of their respective owners and are used with their permission.
Image credits: Photos by Andreas Schernus; other images: Shutterstock.com.
Privacy policy
This policy informs you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), about the personal data we process when you visit this website or contact us. “We” refers to EQSE SARL-S.
1. Controller
EQSE SARL-S, represented by Andreas Schernus, Managing Director, 32, rue des Frênes, L-7384 Lorentzweiler, Luxembourg · phone +352 2 629 6976 · info@eqse.lu
2. Data Protection Officer
Our company is not legally required to appoint a Data Protection Officer (Art. 37 GDPR) and has therefore not done so. For any questions about data protection, please contact info@eqse.lu.
3. Key points at a glance
This website is deliberately designed to collect as little data as possible. It uses no cookies and no local browser storage, no analytics, tracking or advertising tools, no JavaScript and no contact form, and no fonts, images, maps, videos or social media elements from third-party servers; all content is delivered from our own web space. Personal data is only processed when your browser technically retrieves the website (section 4) or when you contact us by email or phone (section 5). When you open eqse.lu, the server forwards you to the German, French or English version based on your browser’s language setting; this information is not stored for that purpose.
4. Visiting the website (server log files)
- Data
- IP address, date and time of access, page requested, amount of data transferred, status code, referring page, browser and operating system.
- Purpose
- delivering the website, ensuring stability and security, preventing and investigating attacks.
- Legal basis
- Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of the website.
- Recipients
- Hostinger Operations, UAB, Švitrigailos g. 34, 03230 Vilnius, Lithuania, as processor under Art. 28 GDPR. The servers are located in France.
- Retention
- Log files are stored by the hosting provider according to its own rules and deleted automatically; the provider does not specify a fixed period. We do not analyse the log files and only access them to investigate a specific security incident.
5. Contact by email or phone
- Data
- name, contact details, company, the content of your message and the metadata of the communication.
- Purpose
- handling your enquiry and preparing a possible collaboration.
- Legal basis
- Art. 6(1)(b) GDPR where your enquiry relates to entering into a contract; otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in responding to enquiries.
- Recipients
- Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as processor under Art. 28 GDPR (Microsoft 365 email service).
- Retention
- Enquiries that do not lead to a collaboration are deleted 12 months after the last message. If the enquiry leads to an engagement, the retention periods in section 6 apply.
6. Business contacts and engagements
- Data
- contact details of your representatives and information needed to carry out an engagement – for example roles and responsibilities, training attendance records, findings from inspections, audits and risk assessments, and information on workplace accidents.
- Source
- We usually receive this data from our client or directly from the data subjects in the course of the engagement.
- Purpose and legal basis
- performance of the contract (Art. 6(1)(b) GDPR), compliance with legal obligations, in particular tax and commercial retention requirements (Art. 6(1)(c) GDPR), and our legitimate interest in managing engagements properly (Art. 6(1)(f) GDPR). Where we process personal data on behalf of a client, for example as an external Data Protection Officer, the agreement concluded with that client also applies.
- Recipients
- We do not disclose engagement data to third parties unless the client instructs us to (for example to a certification body) or we are legally required to (for example towards authorities). Invoicing data is shared with our accountants in Luxembourg; payment data is processed by our bank as part of payment transactions. The following are engaged as processors: Microsoft Ireland Operations Limited, Dublin, Ireland – Microsoft 365 (email, OneDrive, Teams video conferencing) – and Billdu Ltd, London, United Kingdom – invoicing. To synchronise working notes, we use iCloud provided by Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland; the notes are end-to-end encrypted, so Apple has no access to their content. We only use AI tools with content that contains no personal data; no personal data of our clients is entered into them. Backups are kept in Microsoft 365 and as local copies on our own systems in Luxembourg.
- Retention
- Accounting records and business documents are kept for ten years (Art. 16 of the Luxembourg Commercial Code). Other engagement documents are deleted or returned no later than three years after the engagement ends, unless a longer period has been agreed or is required by law. For engagements as external Data Protection Officer, the periods agreed with the client apply.
7. Transfers to third countries
Website hosting and local backups take place exclusively within the EU. Microsoft 365 stores our account data (email, OneDrive, SharePoint and Teams) in data centres in the EU or EFTA and processes it within the EU Data Boundary. In individual cases, however, Microsoft may grant access to sub-processors in the United States, in particular Microsoft Corporation. Such transfers are based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, under which Microsoft is certified, and on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in Microsoft’s Data Protection Addendum. The same applies to Apple: Apple may transfer data to Apple Inc. in the United States on the basis of the EU-US Data Privacy Framework, under which Apple is certified, and the EU Standard Contractual Clauses. Billdu Ltd is based in the United Kingdom, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).
8. Link to LinkedIn
This website links to our LinkedIn profile. The link is a simple reference: no data is transmitted to LinkedIn when you visit this website. LinkedIn’s privacy policy only applies once you click the link.
9. No obligation to provide data, no automated decisions
You are not obliged to provide us with personal data. Without your contact details, however, we cannot respond to your enquiry. No automated decision-making, including profiling (Art. 22 GDPR), takes place.
10. Your rights
Under the GDPR you have the right of access to your data (Art. 15), to rectification of inaccurate data (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20).
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation.
To exercise your rights, simply send a message to info@eqse.lu. We will respond within one month (Art. 12(3) GDPR).
Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority. In Luxembourg, this is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu.
11. Data security
The website is delivered exclusively over an encrypted HTTPS connection and is protected by strict server security policies. Emails are encrypted in transit where your provider supports this. For confidential documents, we are happy to agree on a secure transfer method with you.
12. Version
Version of this privacy policy: November 2026. We update it when the website, our service providers or the legal framework change.