This Privacy Policy explains how Lux Photo Pro S.à r.l.-S, which publishes this website under the brand COEVO, collects and processes personal data on coevo.lu, in accordance with the EU General Data Protection Regulation (GDPR), Luxembourg data-protection law and the ePrivacy rules, under the supervision of the Commission nationale pour la protection des données (CNPD). Business contact data is still personal data: operating B2B does not exempt this processing from the GDPR.
1. Data controller
Lux Photo Pro S.à r.l.-S — 13 Avenue Gaston Diderich, L-1420 Luxembourg · RCS B290472 · VAT LU36089387. Privacy contact: Andrii Mitin (Managing Director), [email protected]. No Data Protection Officer is appointed (not legally required).
2. What this website collects
This site has no database of its own and no user accounts. It collects only what is listed here.
Contact form (page /contact/ and the home page). You give: name, business, email, phone (optional), website (optional), the services you tick, a message (optional). The form also sends: the summary of a website check, if you ran one; the page language; campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid, fbclid) and the referring page.
Waitlist (the system without shoots). You give: business name and email. It follows the same route as the contact form and is marked "Waitlist".
Free Instagram review. You give: your Instagram handle and email. Andrii Mitin looks at the public Instagram account and replies by email within one working day.
Free website check. You type a website address. Our server fetches that public page and its robots.txt, sitemap.xml and llms.txt; for the phone speed test the address is sent to Google PageSpeed Insights (Google LLC). The result is cached on Cloudflare by address only, for about 10 minutes (speed about 30 minutes). Nothing is stored about you unless you then send the contact form: the summary then goes with it.
Server logs and security. Cloudflare processes your IP address and request data to deliver and protect the site.
Visit statistics. Cloudflare Web Analytics, cookieless (see section 7).
3. Purposes and legal bases
- Replying to enquiries, quotes, the waitlist and the Instagram review — pre-contractual steps at your request / legitimate interest.
- Delivering and invoicing services — performance of a contract and legal obligation (accounting / VAT).
- Website security and rate limiting — legitimate interest.
- Visit statistics — legitimate interest (cookieless, no cross-site tracking).
4. How your enquiry is handled
When you send the contact form, the waitlist or the Instagram review, our server function passes it to our own business application (app.luxphotopro.lu, hosted on Cloudflare). The application records it in our CRM (Bitrix24) as a client and an order, so our team can reply. Our team is also notified internally (Telegram) about new enquiries.
Your IP address is used only in memory to limit sends (maximum 5 a minute) and is not stored with your enquiry. Campaign parameters travel with the enquiry so we know which message or page brought you here.
5. Processors and recipients
We act as controller; the following processors act on our instructions under data-processing agreements:
- Cloudflare — hosting, server functions, our business application, cache, security and visit statistics
- Bitrix24 — CRM (clients, orders)
- Google Workspace — email; replies come from [email protected]
- Google PageSpeed Insights — website check only, the address you typed and nothing else
- Telegram — internal notifications to our team about new enquiries
Some of our photographers, videographers and editors are contractors, including outside the EEA (e.g. United Kingdom, Switzerland, Ukraine), bound by confidentiality. Other recipients: accountants, legal advisers, tax authorities and, where relevant, a business successor.
6. International transfers
Where data is processed outside the EEA, transfers rely on an adequacy decision (e.g. UK, Switzerland) or EU Standard Contractual Clauses with supplementary measures.
7. Cookies, storage and statistics
coevo.lu sets nothing that needs your consent, so there is no consent banner. On your device it stores only:
- a cookie coevo_locale — the language you picked, kept for 1 year, first-party, functional;
- in your browser's session storage, coevo_utm (the campaign parameters of your landing visit) and coevo_check (the website-check result, to prefill the form) — both cleared when you close the tab.
Fonts are served from our own domain; there are no requests to Google Fonts.
Visit statistics use Cloudflare Web Analytics: cookieless, no cross-site tracking, it counts page views. There is no Google Analytics, no advertising pixel, no heatmap and no session replay on coevo.lu. If we ever add analytics or advertising cookies, we will ask for your consent first. Details: see our Cookies page.
8. Retention
| Data | Retention |
|---|---|
| Unanswered enquiries and waitlist entries | 3 years from last contact |
| Client data | Relationship + 3 years |
| Invoices / accounting | 10 years (Luxembourg law) |
| Website-check cache (address only) | About 10 minutes (speed about 30 minutes) |
| Session storage (campaign parameters, check result) | Until you close the tab |
| Language cookie | 1 year |
| Server logs and visit statistics | As set by Cloudflare |
9. People in our photographs
Photographs and video taken during shoots we carry out for clients are handled under the client's contract and a photo release where one is needed; this policy covers the data collected on coevo.lu. To withdraw consent to use of an image, email [email protected] — we remove the content within 30 days (we cannot control third-party re-shares).
10. Your rights
You may access, rectify, erase, restrict or object to processing of your data, request portability, and withdraw consent where processing rests on consent. Email [email protected] with proof of identity; we respond within one month (extendable by two for complex requests). You may lodge a complaint with the CNPD, 15 Boulevard du Jazz, L-4370 Belvaux, +352 26 10 60-1, https://cnpd.public.lu.
11. Security
We use HTTPS encryption, access controls on a need-to-know basis, contractor agreements, regular backups and periodic reviews. Breaches affecting your rights are notified to the CNPD within 72 hours and to affected individuals where required.
12. Changes
We may update this policy; material changes are announced by email or a prominent notice on the site.
Lux Photo Pro S.à r.l.-S (COEVO) — [email protected] · +352 691 773 777.
Last updated: 6 October 2026.