Skip to content

Privacy Policy

Last updated: 14 September 2026

Who we are

Luxembourg For Family Office a.s.b.l. (“LFFO”, “we”) is a non-profit association governed by Luxembourg law, registered with the Luxembourg Trade and Companies Register under number F8558, with its registered office at 33, boulevard Prince Henri, L-1724 Luxembourg.

We are the data controller for the personal data described here. Write to us at secretariat@luxembourgforfamilyoffice.lu.

The association has not appointed a Data Protection Officer, and is not required to do so: it does not carry out large-scale monitoring or process special categories of data on a large scale.

What we collect, and why

When you contact us or apply for membership

Our forms collect your name, email address, telephone number, organisation, role, country, city, postal address and website, the subject or event you are writing about, and your message. A membership application also asks for what the association needs to assess and invoice it: the category, the number of families served, your profession, the size of your organisation, your supervisory authority and registration number, the name, address and VAT number for the invoice, how you heard of the association and who introduced you, and whether the association may name you as a member. A sponsorship request also records what you would like to fund and how your support should be acknowledged. We use this to reply, to assess a membership or partnership application, to prepare an invoice, and to keep a record of the correspondence.

Each submission is stored on our server in encrypted form and sent to the secretariat’s mailbox over an encrypted connection, with a PDF copy of the record attached. To protect the forms from abuse, a short, non-reversible code derived from your connection’s IP address is kept for one hour.

Legal basis: your consent, given by ticking the box on the form, together with our legitimate interest in answering enquiries addressed to the association. For membership applications, processing is also necessary to take steps at your request before entering into a membership relationship.

When you sign in as a member

Members receive an account in order to read documents reserved to members. We hold the username, email address and encrypted password for that account, and the fact that a sign-in took place.

Legal basis: performance of the membership relationship.

When you simply read the site

Our host records standard server logs, including IP address, browser type and pages requested, to keep the site running and secure.

Legal basis: our legitimate interest in the security and integrity of the site.

What we do not do

We use no analytics, advertising or tracking technologies. We do not profile visitors, we do not sell or rent personal data, we do not use it for automated decision-making, and we do not currently send a newsletter. If that changes, this notice will be updated first and any mailing will be sent only to people who have asked for it.

Cookies

This site sets only cookies that are strictly necessary for it to work. Those need no consent, and they are listed here so you can see what they are:

  • WordPress session cookies: set only when a member signs in, to keep you signed in.
  • lffo_member: records only that a session exists, so the interface knows not to ask you to sign in again. It carries no identity.
  • Caching and security cookies set by our host and by Cloudflare to serve pages quickly and to tell a browser from an automated one. The one you are most likely to see is __cf_bm, which expires within the hour.
  • lffo_consent: set only once you have answered the cookie notice, and records only which of the optional categories you allowed or refused. It lasts six months, and you can change or clear it at any time from Cookie settings in the footer.

We use no analytics, advertising or social-media cookies, and no third-party tracker of any kind. Nothing on this site profiles you, follows you to other sites, or is shared with an advertising network. Under the ePrivacy rules the CNPD applies, cookies that are strictly necessary need no consent, and nothing on this site currently goes beyond them.

The cookie notice you are shown on a first visit is there for what may come, not for anything running today. Its three optional categories, preferences, statistics and marketing, are empty and switched off. If the association ever introduces audience measurement or anything else optional, nothing will be loaded or stored until you have actively agreed: refusing is exactly as easy as agreeing, both are a single click, and you can change your mind at any time from Cookie settings in the footer. If your browser sends a Global Privacy Control signal, it is read as a refusal. Should that day come, this section will say so before it happens.

Who else sees your data

We share personal data only with the providers who operate the site and our correspondence for us, as processors bound by contract: our hosting provider Newco; our email provider EuroDNS S.A., Luxembourg, which hosts the secretariat’s mailbox; and our content delivery and security provider Cloudflare, Inc. Where a provider processes data outside the European Economic Area, the transfer is covered by the European Commission’s standard contractual clauses.

We may also disclose data where the law requires it.

How long we keep it

  • Enquiries and unsuccessful applications: three years from our last exchange with you, after which they are deleted.
  • Membership records: for the duration of membership, then ten years, matching the retention period Luxembourg law requires for accounting and association records.
  • Server logs: six months, then overwritten.

Your rights

Under the General Data Protection Regulation you may ask us for a copy of your personal data, ask us to correct or erase it, ask us to restrict or stop processing it, ask to receive it in a portable form, and, where processing rests on consent, withdraw that consent at any time without affecting what was lawful beforehand.

Write to secretariat@luxembourgforfamilyoffice.lu. We answer within one month. If you are not satisfied you may complain to the Luxembourg supervisory authority, the Commission nationale pour la protection des données (CNPD), 15 boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu.

Changes

If we change how we handle personal data we will update this page and the date above.