1. Introduction
MXP S.A., operating under the brand ALBA Groupe (“ALBA Groupe”, “we”, “us” or “our”), is committed to protecting your privacy and processing your personal data in a lawful, fair and transparent manner.
This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you visit our website, contact us, request information about our services or otherwise interact with us.
Personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable Luxembourg data protection legislation.
2. Identity of the Data Controller
Unless otherwise expressly stated, the data controller responsible for the processing of personal data through this website is:
MXP S.A., operating under the trade name “ALBA Groupe”
20 A Route de Luxembourg
L-3253 Bettembourg
Luxembourg
RCS Registration Luxembourg: B170962
Email: info@albagroupe.com
Telephone: (+352) 20 60 22 21
Where a specific service is provided by another company belonging to ALBA Groupe, that company may act as an independent data controller or, where applicable, as a joint controller. Relevant information will be provided where necessary.
3. Personal Data We Collect
Depending on how you interact with us, we may collect and process the following categories of personal data:
- Identification data, such as your first name and surname;
- Contact details, such as your email address, telephone number and postal address;
- Professional information, such as your company, position or professional activity;
- Information submitted through forms, enquiries, requests or other communications;
- Technical and usage data, which may include IP address, browser and device information, operating system, pages visited, date and time of access, referral information and other information relating to your interaction with the Website, depending on the technology or service concerned. Certain analytics services used by us, such as Plausible Analytics, are specifically designed to provide aggregated Website statistics without storing raw IP addresses or persistent visitor identifiers.;
- Marketing and communication preferences, including newsletter subscriptions and consent preferences;
- Any other information you voluntarily provide to us.
We ask that you do not provide sensitive or special-category personal data unless it is necessary and specifically requested by us.
4. How We Collect Personal Data
We may collect personal data:
- Directly from you when you complete a form, contact us, subscribe to communications or request one of our services;
- Automatically when you use our Website, including through cookies, analytics technologies and similar technologies, where applicable and subject to applicable consent requirements;
- Through companies belonging to ALBA Groupe where necessary to respond to your request or provide a service;
- From third parties or publicly available sources, where permitted by applicable law.
5. Purposes and Legal Bases for Processing
We process personal data only where we have a valid legal basis under the GDPR.
Depending on the circumstances, your personal data may be processed:
To respond to enquiries and requests
We process your contact details and the information contained in your request in order to respond to you. The legal basis may be our legitimate interest in managing communications and enquiries or taking steps at your request prior to entering into a contract.
To provide our services and manage client relationships
Where you become a client or request a service, we process the information necessary to provide and manage that service. The legal basis is the performance of a contract or steps taken prior to entering into a contract.
To send newsletters and marketing communications
Where required by law, we send promotional communications only with your consent. You may withdraw your consent or unsubscribe at any time.
To improve our website and services
We may analyse the use and performance of our website in order to improve its functionality, content and user experience. We may analyse the use and performance of our Website in order to understand general usage trends, measure Website performance and improve its functionality, content and user experience. The applicable legal basis depends on the analytics technology used and the applicable legal requirements.
To ensure security and prevent misuse
Technical information may be processed to maintain the security and integrity of our website, prevent fraud and detect inappropriate or unlawful activity. Such processing is based on our legitimate interests and, where applicable, legal obligations.
To comply with legal obligations
We may process and retain information where necessary to comply with accounting, tax, regulatory or other legal obligations.
To establish, exercise or defend legal claims
Where necessary, personal data may be processed to protect our rights and interests or those of third parties.
Where processing is based on our legitimate interests, we assess those interests against your rights and freedoms before carrying out the processing.
6. Newsletter and Marketing Communications
If you subscribe to our newsletter or otherwise consent to receive marketing communications, we may process your name, email address, communication preferences and, where applicable, information relating to your interaction with our communications.
We use Odoo and Brevo to manage mailing lists, subscriptions and the distribution of newsletters and other electronic communications. Depending on the communication concerned, the personal data necessary to manage your subscription and deliver the relevant communications may therefore be processed through either of these platforms.
We may also process information relating to the delivery and interaction with our communications, such as delivery status, email opens and link clicks, where permitted by applicable law and according to your consent preferences.
Where consent is the applicable legal basis, you may withdraw your consent at any time by clicking the unsubscribe link included in our communications or by contacting us at info@albagroupe.com.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
7. Cookies and Similar Technologies
Our website uses cookies and similar technologies to ensure its proper functioning, analyse website traffic and performance, provide embedded content and improve the overall user experience.
Where required by applicable law, cookies and similar technologies that are not strictly necessary will only be activated after obtaining your prior consent through our cookie management tool.
In particular, our website may use the following third-party services:
Google Analytics
We use Google Analytics to obtain statistical information about how visitors interact with our website, such as pages visited, duration of visits, approximate geographical information, device and browser information and other website usage data. This information helps us understand website performance and improve our content and services.
Google Analytics will only be activated where the applicable consent requirements have been satisfied. You may withdraw or modify your consent at any time through our cookie management tool.
YouTube
Our website may contain videos embedded from YouTube, a service provided by Google. When you view or interact with embedded YouTube content, information about your device and interaction with that content may be transmitted to Google. Where required, such content and associated technologies will only be activated after obtaining your consent.
Google Maps
We may use Google Maps to display interactive maps and location information. When Google Maps is activated, certain technical information, including information relating to your device and IP address, may be transmitted to Google. Where required, Google Maps will only be activated after obtaining your consent.
Google states that its privacy policy applies across its services, including YouTube and services made available on third-party websites.
For detailed information about the cookies and similar technologies used on this website, including their purposes, providers and retention periods, please refer to our Cookie Policy and cookie management tool.
Plausible Analytics
Website visitor data processed through Plausible is processed and stored within the European Union.
As Plausible Analytics does not use cookies or persistent identifiers for Website analytics, its standard analytics functionality operates independently from the consent required for non-essential cookies.
8. Sharing of Personal Data
We do not sell your personal data.
For the operation of our website, management of our activities, communications and provision of our services, we may use third-party service providers that process personal data on our behalf or, depending on the service concerned, act as independent data controllers.
These providers currently include:
| Provider | Purpose |
|---|---|
| Odoo | Website hosting and operation, CRM, contact management, mailing list and subscription management, distribution of newsletters and electronic communications, and related administrative and business management functions |
| Brevo | Mailing list and subscription management, distribution of newsletters and other electronic communications, and related communication services |
| Google Analytics | Website audience measurement, statistics and usage analysis |
Plausible Analytics | Privacy-friendly, aggregated Website audience measurement and usage statistics |
| YouTube (Google) | Hosting and displaying embedded video content |
| Google Maps (Google) | Displaying maps, locations and geographical information |
Depending on the service concerned, the relevant provider may process different categories of information, such as contact details, communication preferences, technical and device information, Website interaction data or other information necessary to provide the relevant service.
Where a provider processes personal data on our behalf, we take appropriate measures to ensure that such processing is governed by appropriate contractual and data protection safeguards.
Where a service provider processes personal data on our behalf, it acts under appropriate contractual and data protection arrangements. Where a third-party provider independently determines the purposes and means of processing, it may act as a separate data controller and its own privacy information will apply.
We may also disclose personal data to professional advisers, public authorities, courts, regulatory bodies and other recipients where required or permitted by applicable law.
9. Website Analytics
We use Google Analytics and Plausible Analytics to understand how visitors use our Website, measure Website performance and improve our content and services.
Google Analytics, a service provided by Google, may process information relating to Website usage, including pages visited, interactions, device and browser information, approximate geographical information, referral information, IP address and other online identifiers, depending on the applicable configuration.
Where required by applicable law, Google Analytics will only be activated after obtaining the user's prior consent through our cookie consent mechanism.
We also use Plausible Analytics, a privacy-focused web analytics service provided by Plausible Insights OÜ. Plausible is designed to provide aggregated Website statistics without using cookies, local storage or persistent identifiers for analytics purposes.
Plausible does not use cross-site or cross-device tracking and does not create persistent individual visitor profiles. Limited technical information transmitted as part of a web request may be processed temporarily in order to generate aggregated Website statistics. Raw IP addresses and full User-Agent information are not stored by Plausible. Website visitor analytics data processed through Plausible is processed and stored within the European Union.
The information obtained through these analytics services is used to understand Website traffic and general usage trends, evaluate Website performance and improve our content, functionality and services.
10. Sharing of Data within ALBA Groupe
Where necessary to provide the requested service, manage your relationship with us or respond to your enquiry, personal data may be shared with the relevant companies belonging to ALBA Groupe.
Such sharing will only take place where an appropriate legal basis exists and to the extent necessary for the relevant purpose.
Where another ALBA Groupe company independently determines the purposes and means of processing your personal data, it may act as a separate data controller and provide you with additional privacy information where required.
11. International Data Transfers
Plausible Analytics is provided by Plausible Insights OÜ, an Estonian company. According to Plausible's current data processing practices, Website visitor analytics data is processed and stored within the European Union.
Other technology providers used by the Website, including Google, may process personal data outside the EEA or allow access to such data from outside the EEA. Where applicable, appropriate safeguards will be implemented in accordance with the GDPR.
Where necessary, additional technical, contractual or organisational measures may also be implemented to protect personal data transferred internationally.
The specific transfer arrangements may vary depending on the service provider, the service configuration and the processing or hosting arrangements applicable to the relevant service.
You may contact us at info@albagroupe.com for further information regarding the safeguards applicable to international transfers of your personal data.
12. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected and in accordance with applicable legal requirements.
The applicable retention period depends on the nature of the information and the purpose of processing. In determining the appropriate period, we take into account:
- The duration of our relationship with you;
- The purpose for which the information was collected;
- Applicable statutory limitation periods;
- Accounting, tax and other legal retention obligations;
- The need to establish, exercise or defend legal claims.
Where personal data is processed on the basis of consent, it will generally be processed until consent is withdrawn or the relevant purpose ceases to apply, subject to any applicable legal retention requirements.
Where possible, more specific retention periods may be communicated at the point at which the data is collected.
Newsletter subscription data may generally be retained until you unsubscribe or withdraw your consent, subject to the retention of limited information necessary to document your opt-out and comply with applicable legal requirements.
Enquiries and related correspondence may be retained for a reasonable period necessary to respond to the request, manage any resulting relationship and establish or defend legal claims.
13. Data Security
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures are reviewed and adapted where appropriate according to the nature of the personal data processed and the risks involved.
However, no electronic transmission or storage system can guarantee absolute security.
14. Your Data Protection Rights
Subject to the conditions established by the GDPR, you may have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete personal data;
- Request the erasure of your personal data;
- Request the restriction of processing;
- Object to certain processing of your personal data, including processing based on legitimate interests;
- Receive certain personal data in a structured, commonly used and machine-readable format and request its transmission to another controller (data portability);
- Withdraw your consent at any time where processing is based on consent;
- Object at any time to the use of your personal data for direct marketing purposes.
These rights are not absolute and may be subject to conditions or exceptions provided by applicable law.
To exercise your rights, please contact us at info@albagroupe.com. We may request information necessary to verify your identity before processing your request.
15. Right to Lodge a Complaint
If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the Luxembourg supervisory authority:
Commission nationale pour la protection des données (CNPD)
15, Boulevard du Jazz
L-4370 Belvaux
Luxembourg
You may also contact us directly before lodging a complaint so that we have an opportunity to address your concerns.
16. Automated Decision-Making and Profiling
Unless otherwise specifically communicated to you, ALBA Groupe does not use personal data collected through this website to make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.
Should this change, we will provide the information required by applicable data protection legislation.
17. Third-Party Websites
Our website may contain links to websites, platforms or services operated by third parties.
ALBA Groupe is not responsible for the privacy practices or content of third-party websites. We encourage you to review their respective privacy policies before providing personal information.
18. Children's Privacy
Our website and services are primarily intended for adults and professionals and are not specifically directed at children.
We do not knowingly seek to collect personal data from children through our website. If we become aware that personal data relating to a child has been collected without an appropriate legal basis, we will take appropriate steps in accordance with applicable law.
19. Changes to This Privacy Policy
We may amend this Privacy Policy from time to time to reflect changes to our activities, services, technologies or applicable legal requirements.
The updated version will be published on this website and the “Last updated” date shown at the top of this page will be amended accordingly.
Where changes materially affect the way we process your personal data, we will provide additional notice where required by law.
20. Contact Us
For questions concerning this Privacy Policy, the processing of your personal data or the exercise of your data protection rights, please contact:
ALBA Groupe – MXP S.A.
20 A Route de Luxembourg
L-3253 Bettembourg
Luxembourg
Email: info@albagroupe.com
Telephone: (+352) 20 60 22 21