Privacy Policy

This Privacy Policy explains how special.lu (operated by Live Production S.à r.l.-S, Luxembourg) collects, uses and protects your personal data in accordance with the EU General Data Protection Regulation (GDPR) and Luxembourg law.

1. Who we are

The data controller is Live Production S.à r.l.-S. You can reach us using the contact details at the bottom of this page.

2. What data we collect

We collect the information you choose to send us (for example your name, email and message when you contact us or book a call), the details needed to deliver and manage the services you book (such as your event details, client account and the media in your private gallery), and limited technical data needed to run the website securely. When you review a website through the client portal, we also store your comments and replies, approval or change-request decisions, the website version and page concerned, and limited review context such as the selected page element and viewport size so that feedback remains attached to the right item.

Equipment rental and electronic contracts

For an equipment request or rental we process your identity and contact details, insurance policy or reference number, requested dates and intended use, offer and payment details, and the exact equipment and condition schedule. If you accept electronically, we also retain the document version and integrity hash, consent text, typed or drawn signature, timestamps, email used to sign, and limited technical evidence such as IP address and browser information. We use this data to answer the request, take pre-contract steps, perform the rental, keep an audit trail, comply with accounting and legal duties, and establish, exercise or defend legal claims. Enquiries are normally removed after 24 months; completed contracts, invoices and integrity evidence are retained only for the applicable contractual, limitation, tax and accounting periods.

3. Analytics — privacy-first and cookieless

We run our own lightweight, privacy-first analytics to understand how the site is used — for example which pages are visited and roughly where visitors come from. For each page view we record only the page path, the host of the referring website (never the full link), an approximate country (derived at our network edge), a coarse device type (such as mobile or desktop), and a salted, daily-rotating pseudonymous hash used to estimate visitor numbers. We do NOT use cookies or write analytics identifiers to your device, we do NOT store your IP address, we do NOT build profiles, and we do NOT track you across other websites. We honour the browser "Do Not Track" signal — if it is enabled, no analytics request is sent at all. The legal basis is our legitimate interest (Art 6(1)(f) GDPR) in understanding and improving how our website is used; because the data is minimal and not directly linked to your identity, this is balanced against your rights. As this analytics uses no non-essential cookies or device storage, no cookie-consent banner is required.

4. Why we use your data

• To respond to your enquiries and arrange bookings.
• To deliver the photography, videography and web services you request, including your client account, private galleries, website previews, version-specific feedback and approvals.
• To understand how the website is used, in aggregate, so we can improve it.
• To keep the website secure and functioning, and to meet our legal and accounting obligations.

5. Legal bases

We process your data on the basis of: performance of a contract (to deliver the services you book and run your client account); our legitimate interests (to keep the site secure and to understand site usage through privacy-first analytics); compliance with legal obligations (for example tax and accounting law); and, where it applies, your consent — which you can withdraw at any time.

6. Cookies

We use only essential, strictly-necessary technical storage needed to run the site and keep your client login secure. Opening an authorised website preview creates a short-lived, unguessable access address for that exact version; it expires after 15 idle minutes and is extended only while preview files are actively requested. The preview does not set an additional cookie. We do not set advertising or cross-site tracking cookies, our fonts are self-hosted, and third-party embeds (such as our booking calendar) only load when you actively click to load them. Because no non-essential cookies are set, no cookie-consent banner is required.

7. Sharing, service providers & international transfers

We do not sell your data. We share it only with the service providers (processors) we use to run special.lu, under data-processing agreements, and only as needed to deliver the service. Our main recipients are:

• Hetzner Online GmbH (Germany, EU) — hosting of the special.lu application and storage of client accounts, review records, files and galleries.
• Cloudflare, Inc. (USA, with EU edge locations) — DNS, content delivery and security for special.lu.
• Mailgun (configured to use its EU API endpoint) — transactional, service, booking and account-related email.

Client accounts, review records, files, gallery data and private website preview files are hosted by Hetzner in Germany. Mailgun is configured to use its EU API endpoint. Cloudflare processing for DNS, content delivery and security may involve transfers to the United States. Where an international transfer applies, it is covered by an appropriate GDPR safeguard, such as the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework.

8. How long we keep your data

We keep personal data only as long as necessary for the purposes above, then delete or anonymise it. In practice:

• Contact and booking enquiries: kept while we handle your request; identified enquiry or lead analytics records are deleted after 24 months.
• Client accounts, gallery media, website previews, review comments and version decisions: kept for the duration of your project and the agreed delivery and access period, then removed unless a longer period is agreed or needed to establish, exercise or defend legal claims.
• Website preview access tickets expire after 2 minutes. Each preview access address expires after 15 idle minutes and is extended only while that exact preview is actively requesting files; expired ticket records are removed as part of routine security housekeeping.
• Invoicing and accounting records: kept for the period required by Luxembourg tax and commercial law.
• First-party analytics: the pseudonymous visitor hash is removed after 48 hours, raw page-view and event rows are deleted after 180 days, and the daily salts are deleted after 2 days.

9. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you;
• Have inaccurate data corrected (rectification);
• Have your data deleted (erasure);
• Restrict how we process your data;
• Receive your data in a portable format (portability);
• Object to processing based on our legitimate interests;
• Withdraw your consent at any time, where processing is based on consent.

To exercise any of these rights, email us at [email protected]. We will respond free of charge and within one month. We may need to verify your identity first.

If you believe we have not handled your data properly, you have the right to lodge a complaint with the Luxembourg supervisory authority: the Commission nationale pour la protection des données (CNPD), 15 Boulevard du Jazz, L-4370 Belvaux, Luxembourg — cnpd.lu.

10. Information you must provide

You do not have to provide personal data simply to browse our public website. If you contact us, request a quote, book a service or use a client account, you must provide enough contact, project and account information for us to respond, enter into or perform the contract, and keep the account secure. Without the required information, we may be unable to respond or provide the requested service; optional fields are identified as such.

11. Automated decisions

We do not make decisions about you that are based solely on automated processing, and we do not carry out profiling.

12. Children

This website and our services are intended for adults and are not directed at children. We do not knowingly collect personal data from children.

13. Contact

Live Production S.à r.l.-S
56a Rue de Kahler, L-8378 Kleinbettingen, Luxembourg
[email protected]
+352 661 990 450